@decaf-ts/integrations 0.8.0 → 0.9.0

package/lib/esm/nest/graph/GraphRunModel.js

@@ -0,0 +1,74 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { model } from "@decaf-ts/decorator-validation";
+import { BaseModel, column, pk, table } from "@decaf-ts/core";
+/**
+ * Persistent run record for the graph run lifecycle (DECAF-50 §4.14): one
+ * row per {@link GraphRun}, storing lifecycle status, the executed
+ * document's fingerprint, inputs, result, and error payloads. Written and
+ * read through {@link GraphRunModelService}, which adapts it to the
+ * engine-side {@link GraphRun} shape.
+ */
+let GraphRunModel = class GraphRunModel extends BaseModel {
+    constructor(arg) {
+        super(arg);
+    }
+};
+__decorate([
+    pk({ type: String, generated: false }),
+    __metadata("design:type", String)
+], GraphRunModel.prototype, "runId", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", String)
+], GraphRunModel.prototype, "workflowId", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", String)
+], GraphRunModel.prototype, "owner", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", String)
+], GraphRunModel.prototype, "status", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", String)
+], GraphRunModel.prototype, "documentFingerprint", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", Object)
+], GraphRunModel.prototype, "inputs", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", Object)
+], GraphRunModel.prototype, "result", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", Object)
+], GraphRunModel.prototype, "error", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", Date)
+], GraphRunModel.prototype, "createdAt", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", Date)
+], GraphRunModel.prototype, "startedAt", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", Date)
+], GraphRunModel.prototype, "finishedAt", void 0);
+GraphRunModel = __decorate([
+    table("graph_run"),
+    model(),
+    __metadata("design:paramtypes", [Object])
+], GraphRunModel);
+export { GraphRunModel };
+//# sourceMappingURL=GraphRunModel.js.map

package/lib/esm/nest/graph/GraphRunModel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphRunModel.js","sourceRoot":"","sources":["../../../../src/nest/graph/GraphRunModel.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;;;;GAMG;AAGI,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,SAAS;IAkC1C,YAAY,GAA4B;QACtC,KAAK,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;CACF,CAAA;AAnCC;IADC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;;4CACxB;AAGf;IADC,MAAM,EAAE;;iDACW;AAGpB;IADC,MAAM,EAAE;;4CACM;AAGf;IADC,MAAM,EAAE;;6CACO;AAGhB;IADC,MAAM,EAAE;;0DACoB;AAG7B;IADC,MAAM,EAAE;;6CACwB;AAGjC;IADC,MAAM,EAAE;;6CACwB;AAGjC;IADC,MAAM,EAAE;;4CACuB;AAGhC;IADC,MAAM,EAAE;8BACG,IAAI;gDAAC;AAGjB;IADC,MAAM,EAAE;8BACG,IAAI;gDAAC;AAGjB;IADC,MAAM,EAAE;8BACI,IAAI;iDAAC;AAhCP,aAAa;IAFzB,KAAK,CAAC,WAAW,CAAC;IAClB,KAAK,EAAE;;GACK,aAAa,CAqCzB"}

package/lib/esm/nest/graph/GraphRunModelService.js

@@ -0,0 +1,112 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+/**
+ * @module integrations/nest/graph/GraphRunModelService
+ * @summary Persistent run store on the Decaf model layer.
+ * @description Persists {@link GraphRun} rows as {@link GraphRunModel} via
+ * the Decaf {@link ModelService}, implementing the engine-side
+ * {@link GraphRunStore} and converting between the engine run shape and the
+ * JSON-safe persisted columns.
+ */
+import { ModelService, service, } from "@decaf-ts/core";
+import { isGraphRunStatus } from "@decaf-ts/ui-decorators/graph";
+import { GraphRunModel } from "./GraphRunModel.js";
+function toJsonSafe(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    return JSON.parse(JSON.stringify(value));
+}
+function runToModel(run) {
+    return new GraphRunModel({
+        runId: run.runId,
+        workflowId: run.workflowId,
+        ...(run.ownerUser ? { owner: run.ownerUser } : {}),
+        status: run.status,
+        ...(run.documentFingerprint
+            ? { documentFingerprint: run.documentFingerprint }
+            : {}),
+        ...(run.result !== undefined
+            ? { result: toJsonSafe(run.result) }
+            : {}),
+        ...(run.error ? { error: toJsonSafe(run.error) } : {}),
+        createdAt: new Date(run.createdAt),
+        ...(run.startedAt ? { startedAt: new Date(run.startedAt) } : {}),
+        ...(run.finishedAt ? { finishedAt: new Date(run.finishedAt) } : {}),
+    });
+}
+function modelToRun(model) {
+    const result = model.result;
+    return {
+        runId: model.runId,
+        workflowId: model.workflowId,
+        ownerUser: model.owner ?? null,
+        status: isGraphRunStatus(model.status) ? model.status : "failed",
+        createdAt: model.createdAt.toISOString(),
+        ...(model.startedAt ? { startedAt: model.startedAt.toISOString() } : {}),
+        ...(model.finishedAt ? { finishedAt: model.finishedAt.toISOString() } : {}),
+        ...(result ? { result } : {}),
+        ...(model.error
+            ? { error: model.error }
+            : {}),
+        ...(model.documentFingerprint
+            ? { documentFingerprint: model.documentFingerprint }
+            : {}),
+    };
+}
+/**
+ * Model-backed {@link GraphRunStore}: persists runs as {@link GraphRunModel}
+ * rows via the Decaf ModelService, converting between the engine-side
+ * {@link GraphRun} shape and the JSON-safe persisted columns.
+ */
+let GraphRunModelService = class GraphRunModelService extends ModelService {
+    constructor() {
+        super(GraphRunModel);
+    }
+    async saveRun(run, ...args) {
+        const { ctxArgs } = (await this.logCtx(args, "saveRun", true)).for(this.saveRun);
+        const model = runToModel(run);
+        let existing;
+        try {
+            existing = (await super.read(run.runId, ...ctxArgs));
+        }
+        catch {
+            existing = null;
+        }
+        if (existing) {
+            existing.workflowId = model.workflowId;
+            existing.owner = model.owner;
+            existing.status = model.status;
+            existing.documentFingerprint = model.documentFingerprint;
+            existing.result = model.result;
+            existing.error = model.error;
+            existing.startedAt = model.startedAt;
+            existing.finishedAt = model.finishedAt;
+            await this.update(existing, ...ctxArgs);
+            return;
+        }
+        await this.create(model, ...ctxArgs);
+    }
+    async readRun(runId, ...args) {
+        const { ctxArgs } = (await this.logCtx(args, "readRun", true)).for(this.readRun);
+        try {
+            const model = (await super.read(runId, ...ctxArgs));
+            return modelToRun(model);
+        }
+        catch {
+            return null;
+        }
+    }
+};
+GraphRunModelService = __decorate([
+    service(GraphRunModel),
+    __metadata("design:paramtypes", [])
+], GraphRunModelService);
+export { GraphRunModelService };
+//# sourceMappingURL=GraphRunModelService.js.map

package/lib/esm/nest/graph/GraphRunModelService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphRunModelService.js","sourceRoot":"","sources":["../../../../src/nest/graph/GraphRunModelService.ts"],"names":[],"mappings":";;;;;;;;;AAAA;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,OAAO,GAGR,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,2BAAwB;AAEhD,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAA4B,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,GAAa;IAC/B,OAAO,IAAI,aAAa,CAAC;QACvB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,GAAG,CAAC,mBAAmB;YACzB,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAA4B,EAAE;YAC/D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,MAA4B,CAAC;IAClD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC9B,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAChE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;QACxC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,KAAK;YACb,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAqC,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,mBAAmB;YAC3B,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,YAA2B;IAEnE;QACE,KAAK,CAAC,aAAa,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,GAAa,EACb,GAAG,IAAiC;QAEpC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAChE,IAAI,CAAC,OAAO,CACb,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,QAA8B,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAkB,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;YACvC,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC7B,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC/B,QAAQ,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;YACzD,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC/B,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC7B,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACrC,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;YACvC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,KAAa,EACb,GAAG,IAAiC;QAEpC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAChE,IAAI,CAAC,OAAO,CACb,CAAC;QACF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAkB,CAAC;YACrE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AAjDY,oBAAoB;IADhC,OAAO,CAAC,aAAa,CAAC;;GACV,oBAAoB,CAiDhC"}

package/lib/esm/nest/graph/GraphWorkflowBoundaryValidation.js

@@ -0,0 +1,164 @@
+import { ValidationError } from "@decaf-ts/db-decorators";
+import { assertGraphWorkflowDocumentValid, isGraphJsonSafeValue, isGraphWorkflowDocumentShape, } from "@decaf-ts/ui-decorators/graph";
+import { DEFAULT_GRAPH_WORKFLOW_DOCUMENT_LIMITS, } from "./GraphWorkflowDocumentLimits.js";
+/**
+ * Field keys that must never appear on a submitted workflow document or any
+ * of its structural records (DECAF-50 §4.16): client input resembling node,
+ * definition, executor, authoritative ports, or frontend component
+ * definitions is rejected at the boundary.
+ */
+export const GRAPH_WORKFLOW_FORBIDDEN_FIELD_KEYS = [
+    "node",
+    "definition",
+    "executor",
+    "execute",
+    "ports",
+    "component",
+];
+function issue(code, path, message, extra) {
+    return {
+        code,
+        path,
+        message,
+        ...(extra?.nodeId !== undefined ? { nodeId: extra.nodeId } : {}),
+        ...(extra?.edgeId !== undefined ? { edgeId: extra.edgeId } : {}),
+        ...(extra?.details ? { details: extra.details } : {}),
+    };
+}
+function forbiddenFieldIssues(record, path) {
+    const issues = [];
+    for (const key of Object.keys(record)) {
+        if (GRAPH_WORKFLOW_FORBIDDEN_FIELD_KEYS.includes(key)) {
+            issues.push(issue("document.forbidden-field", `${path}.${key}`, `Field '${key}' is not accepted in a canonical workflow document: node, definition, executor, execute, ports and component fields are rejected at the boundary`, {
+                details: { field: key },
+            }));
+        }
+    }
+    return issues;
+}
+function collectForbiddenFieldIssues(document, issues) {
+    issues.push(...forbiddenFieldIssues(document, "$"));
+    document.inputs.forEach((port, index) => issues.push(...forbiddenFieldIssues(port, `inputs[${index}]`)));
+    document.outputs.forEach((port, index) => issues.push(...forbiddenFieldIssues(port, `outputs[${index}]`)));
+    for (const node of document.nodes) {
+        issues.push(...forbiddenFieldIssues(node, `nodes[${node.id}]`));
+        if (node.loop) {
+            issues.push(...forbiddenFieldIssues(node.loop, `nodes[${node.id}].loop`));
+            collectForbiddenFieldIssues(node.loop.body, issues);
+        }
+    }
+    for (const edge of document.edges) {
+        issues.push(...forbiddenFieldIssues(edge, `edges[${edge.id}]`));
+    }
+}
+function duplicateIdIssues(document) {
+    const issues = [];
+    const portIds = new Set();
+    for (const port of [...document.inputs, ...document.outputs]) {
+        if (portIds.has(port.id)) {
+            issues.push(issue("document.duplicate-port-id", `ports[${port.id}]`, `Workflow port '${port.id}' is declared more than once; workflow port ids must be unique`));
+        }
+        else {
+            portIds.add(port.id);
+        }
+    }
+    const nodeIds = new Set();
+    for (const node of document.nodes) {
+        if (nodeIds.has(node.id)) {
+            issues.push(issue("document.duplicate-node-id", `nodes[${node.id}]`, `Node '${node.id}' is declared more than once; node ids must be unique`, { nodeId: node.id }));
+        }
+        else {
+            nodeIds.add(node.id);
+        }
+    }
+    const edgeIds = new Set();
+    for (const edge of document.edges) {
+        if (edgeIds.has(edge.id)) {
+            issues.push(issue("document.duplicate-edge-id", `edges[${edge.id}]`, `Edge '${edge.id}' is declared more than once; edge ids must be unique`, { edgeId: edge.id }));
+        }
+        else {
+            edgeIds.add(edge.id);
+        }
+    }
+    return issues;
+}
+function limitIssues(document, limits) {
+    const issues = [];
+    if (document.nodes.length > limits.maxNodes) {
+        issues.push(issue("document.limit.nodes", "$.nodes", `Document declares ${document.nodes.length} nodes; at most ${limits.maxNodes} are allowed`, { details: { count: document.nodes.length, limit: limits.maxNodes } }));
+    }
+    if (document.edges.length > limits.maxEdges) {
+        issues.push(issue("document.limit.edges", "$.edges", `Document declares ${document.edges.length} edges; at most ${limits.maxEdges} are allowed`, { details: { count: document.edges.length, limit: limits.maxEdges } }));
+    }
+    const maxDepth = maxNestingDepthOf(document);
+    if (maxDepth > limits.maxNestingDepth) {
+        issues.push(issue("document.limit.depth", "$.nodes", `Document nests loop bodies ${maxDepth} levels deep; at most ${limits.maxNestingDepth} levels are allowed`, { details: { depth: maxDepth, limit: limits.maxNestingDepth } }));
+    }
+    const bytes = Buffer.byteLength(JSON.stringify(document), "utf8");
+    if (bytes > limits.maxDocumentBytes) {
+        issues.push(issue("document.limit.size", "$", `Document serializes to ${bytes} bytes; at most ${limits.maxDocumentBytes} bytes are allowed`, { details: { bytes, limit: limits.maxDocumentBytes } }));
+    }
+    return issues;
+}
+function maxNestingDepthOf(document, depth = 0) {
+    let max = depth;
+    for (const node of document.nodes) {
+        if (node.loop?.body) {
+            max = Math.max(max, maxNestingDepthOf(node.loop.body, depth + 1));
+        }
+    }
+    return max;
+}
+function kindIssues(document, catalogue) {
+    const issues = [];
+    for (const node of document.nodes) {
+        if (!catalogue.has(node.kind)) {
+            issues.push(issue("node.unknown-kind", `nodes[${node.id}].kind`, `Node '${node.id}' references kind '${node.kind}' which is not registered in the backend catalogue`, { nodeId: node.id, details: { kind: node.kind } }));
+        }
+        if (node.loop?.body) {
+            issues.push(...kindIssues(node.loop.body, catalogue));
+        }
+    }
+    return issues;
+}
+/**
+ * Validates a submitted canonical workflow document at the persistence
+ * boundary (DECAF-50 §4.10/§4.16): document shape, JSON safety, forbidden
+ * definition/executor/component fields, duplicate ids, backend-enforced
+ * resource limits, structural validity (via the shared document contract
+ * assertions) and catalogue kind existence. Issues accumulate as structured
+ * {@link GraphValidationIssue}s instead of failing abruptly.
+ *
+ * Full nine-stage document/catalogue validation (DECAF-50 §4.8) is owned by
+ * the engine validation phase; this boundary pass is the persistence gate.
+ */
+export function validateGraphWorkflowDocumentAtBoundary(document, options = {}) {
+    const limits = {
+        ...DEFAULT_GRAPH_WORKFLOW_DOCUMENT_LIMITS,
+        ...options.limits,
+    };
+    const issues = [];
+    if (!isGraphWorkflowDocumentShape(document)) {
+        issues.push(issue("document.shape", "$", "Payload is not a canonical GraphWorkflowDocument: id and name must be strings and inputs, outputs, nodes and edges must be arrays"));
+        return { valid: false, issues };
+    }
+    if (!isGraphJsonSafeValue(document)) {
+        issues.push(issue("document.json-unsafe", "$", "Document contains JSON-unsafe values: functions, class instances, undefined, NaN/Infinity, symbol keys and unsafe prototype keys (__proto__/prototype/constructor) are rejected"));
+        return { valid: false, issues };
+    }
+    collectForbiddenFieldIssues(document, issues);
+    issues.push(...duplicateIdIssues(document));
+    issues.push(...limitIssues(document, limits));
+    try {
+        assertGraphWorkflowDocumentValid(document);
+    }
+    catch (e) {
+        const message = e instanceof ValidationError ? e.message : String(e);
+        issues.push(issue("document.structure", "$", message));
+    }
+    if (options.catalogue) {
+        issues.push(...kindIssues(document, options.catalogue));
+    }
+    return { valid: issues.length === 0, issues };
+}
+//# sourceMappingURL=GraphWorkflowBoundaryValidation.js.map

package/lib/esm/nest/graph/GraphWorkflowBoundaryValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphWorkflowBoundaryValidation.js","sourceRoot":"","sources":["../../../../src/nest/graph/GraphWorkflowBoundaryValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EACL,gCAAgC,EAChC,oBAAoB,EACpB,4BAA4B,GAI7B,MAAM,+BAA+B,CAAC;AAMvC,OAAO,EACL,sCAAsC,GAEvC,yCAAsC;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAsB;IACpE,MAAM;IACN,YAAY;IACZ,UAAU;IACV,SAAS;IACT,OAAO;IACP,WAAW;CACZ,CAAC;AAQF,SAAS,KAAK,CACZ,IAAY,EACZ,IAAY,EACZ,OAAe,EACf,KAA0F;IAE1F,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,OAAO;QACP,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAA+B,EAC/B,IAAY;IAEZ,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,mCAAmC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,0BAA0B,EAC1B,GAAG,IAAI,IAAI,GAAG,EAAE,EAChB,UAAU,GAAG,kJAAkJ,EAC/J;gBACE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;aACxB,CACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,2BAA2B,CAClC,QAA+B,EAC/B,MAA8B;IAE9B,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,QAA8C,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACtC,MAAM,CAAC,IAAI,CACT,GAAG,oBAAoB,CAAC,IAA0C,EAAE,UAAU,KAAK,GAAG,CAAC,CACxF,CACF,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACvC,MAAM,CAAC,IAAI,CACT,GAAG,oBAAoB,CAAC,IAA0C,EAAE,WAAW,KAAK,GAAG,CAAC,CACzF,CACF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CACT,GAAG,oBAAoB,CAAC,IAA0C,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG,CAAC,CACzF,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CACT,GAAG,oBAAoB,CACrB,IAAI,CAAC,IAA0C,EAC/C,SAAS,IAAI,CAAC,EAAE,QAAQ,CACzB,CACF,CAAC;YACF,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CACT,GAAG,oBAAoB,CAAC,IAA0C,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG,CAAC,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA+B;IACxD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAgC,EAAE,CAAC;QAC5F,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,4BAA4B,EAC5B,SAAS,IAAI,CAAC,EAAE,GAAG,EACnB,kBAAkB,IAAI,CAAC,EAAE,gEAAgE,CAC1F,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,4BAA4B,EAC5B,SAAS,IAAI,CAAC,EAAE,GAAG,EACnB,SAAS,IAAI,CAAC,EAAE,uDAAuD,EACvE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CACpB,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,4BAA4B,EAC5B,SAAS,IAAI,CAAC,EAAE,GAAG,EACnB,SAAS,IAAI,CAAC,EAAE,uDAAuD,EACvE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CACpB,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAClB,QAA+B,EAC/B,MAA6C;IAE7C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sBAAsB,EACtB,SAAS,EACT,qBAAqB,QAAQ,CAAC,KAAK,CAAC,MAAM,mBAAmB,MAAM,CAAC,QAAQ,cAAc,EAC1F,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CACtE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sBAAsB,EACtB,SAAS,EACT,qBAAqB,QAAQ,CAAC,KAAK,CAAC,MAAM,mBAAmB,MAAM,CAAC,QAAQ,cAAc,EAC1F,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CACtE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,QAAQ,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sBAAsB,EACtB,SAAS,EACT,8BAA8B,QAAQ,yBAAyB,MAAM,CAAC,eAAe,qBAAqB,EAC1G,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,CAChE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,KAAK,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,qBAAqB,EACrB,GAAG,EACH,0BAA0B,KAAK,mBAAmB,MAAM,CAAC,gBAAgB,oBAAoB,EAC7F,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,CACvD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA+B,EAAE,KAAK,GAAG,CAAC;IACnE,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YACpB,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CACjB,QAA+B,EAC/B,SAA6B;IAE7B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,KAAK,CACH,mBAAmB,EACnB,SAAS,IAAI,CAAC,EAAE,QAAQ,EACxB,SAAS,IAAI,CAAC,EAAE,sBAAsB,IAAI,CAAC,IAAI,oDAAoD,EACnG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAClD,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uCAAuC,CACrD,QAA+B,EAC/B,UAAkD,EAAE;IAEpD,MAAM,MAAM,GAAG;QACb,GAAG,sCAAsC;QACzC,GAAG,OAAO,CAAC,MAAM;KAClB,CAAC;IACF,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CACT,KAAK,CACH,gBAAgB,EAChB,GAAG,EACH,mIAAmI,CACpI,CACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sBAAsB,EACtB,GAAG,EACH,iLAAiL,CAClL,CACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,2BAA2B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAE9C,IAAI,CAAC;QACH,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,YAAY,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}

package/lib/esm/nest/graph/GraphWorkflowController.js

@@ -0,0 +1,153 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Body, Controller, Get, HttpException, HttpStatus, NotFoundException, Optional, Param, Put, Post, Inject, } from "@nestjs/common";
+import { NotFoundError, ValidationError } from "@decaf-ts/db-decorators";
+import { AuthorizationError, ForbiddenError } from "@decaf-ts/core";
+import { DecafRequestContext } from "@decaf-ts/for-nest";
+import { GraphWorkflowService, GRAPH_WORKFLOW_OPTIONS } from "./GraphWorkflowService.js";
+import { GraphWorkflowDocumentRejectedError } from "./GraphWorkflowErrors.js";
+function graphWorkflowHttpErrorOf(e, workflowId) {
+    if (e instanceof GraphWorkflowDocumentRejectedError) {
+        return new HttpException({
+            message: "Graph workflow document rejected at the boundary",
+            issues: e.issues,
+        }, HttpStatus.UNPROCESSABLE_ENTITY);
+    }
+    if (e instanceof ForbiddenError || e instanceof AuthorizationError) {
+        return new HttpException(workflowId
+            ? `Graph workflow '${workflowId}' is owned by another user`
+            : e.message, HttpStatus.FORBIDDEN);
+    }
+    if (e instanceof NotFoundError) {
+        return new NotFoundException(e.message);
+    }
+    if (e instanceof ValidationError) {
+        return new HttpException(e.message, HttpStatus.BAD_REQUEST);
+    }
+    if (e instanceof HttpException)
+        return e;
+    const message = e instanceof Error ? e.message : String(e);
+    return new HttpException(message, HttpStatus.INTERNAL_SERVER_ERROR);
+}
+/**
+ * Canonical workflow document persistence endpoints (DECAF-50 §4.10):
+ *
+ * - `PUT   /graph/workflows/{workflowId}` — validate and persist a canonical
+ *   document (or a `{ document, editor, metadata }` snapshot wrapper, whose
+ *   editor state is preserved verbatim for lossless round trips).
+ * - `GET  /graph/workflows/{workflowId}` — load the canonical document;
+ *   legacy persisted snapshots are converted losslessly on the read path.
+ * - `POST /graph/workflows/validate` — run boundary validation and return
+ *   structured issues (`code`, `path`, `nodeId`, `edgeId`, `message`,
+ *   safe `details`).
+ *
+ * @class GraphWorkflowController
+ */
+let GraphWorkflowController = class GraphWorkflowController {
+    constructor(workflowService, requestContext, options = {}) {
+        this.workflowService = workflowService;
+        this.requestContext = requestContext;
+        this.options = options;
+    }
+    /**
+     * Enforces the configured authentication mode: `auth` defaults to
+     * `"required"` (SAA-595 secure-defaults alignment) and rejects
+     * unauthenticated calls with `401`; `"optional"` admits anonymous
+     * requests for standalone module runs (DECAF-48 §4.15).
+     */
+    requireAuthenticatedContext() {
+        if ((this.options.auth ?? "required") !== "required") {
+            return this.requestContext;
+        }
+        if (!this.requestContext) {
+            throw new HttpException("Graph workflow access requires an authenticated request context", HttpStatus.UNAUTHORIZED);
+        }
+        return this.requestContext;
+    }
+    async saveWorkflow(workflowId, body) {
+        const context = this.requireAuthenticatedContext();
+        try {
+            const model = this.isCanonicalWrapper(body)
+                ? await this.workflowService.saveSnapshot(workflowId, body, context)
+                : await this.workflowService.saveDocument(workflowId, body, context);
+            return {
+                workflowId,
+                ...(model.name ? { name: model.name } : {}),
+                savedAt: model.updatedAt.toISOString(),
+            };
+        }
+        catch (e) {
+            throw graphWorkflowHttpErrorOf(e, workflowId);
+        }
+    }
+    async getWorkflow(workflowId) {
+        const context = this.requireAuthenticatedContext();
+        try {
+            return await this.workflowService.getDocument(workflowId, context);
+        }
+        catch (e) {
+            throw graphWorkflowHttpErrorOf(e, workflowId);
+        }
+    }
+    async validateWorkflow(body) {
+        this.requireAuthenticatedContext();
+        const document = this.documentOf(body);
+        return this.workflowService.validateDocument(document, this.requestContext);
+    }
+    isCanonicalWrapper(body) {
+        return (!!body &&
+            typeof body === "object" &&
+            !Array.isArray(body) &&
+            body["document"] !== undefined &&
+            body["nodes"] === undefined);
+    }
+    documentOf(body) {
+        if (this.isCanonicalWrapper(body)) {
+            return body.document;
+        }
+        return body;
+    }
+};
+__decorate([
+    Put("workflows/:workflowId"),
+    __param(0, Param("workflowId")),
+    __param(1, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], GraphWorkflowController.prototype, "saveWorkflow", null);
+__decorate([
+    Get("workflows/:workflowId"),
+    __param(0, Param("workflowId")),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], GraphWorkflowController.prototype, "getWorkflow", null);
+__decorate([
+    Post("workflows/validate"),
+    __param(0, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], GraphWorkflowController.prototype, "validateWorkflow", null);
+GraphWorkflowController = __decorate([
+    Controller("graph"),
+    __param(1, Optional()),
+    __param(1, Inject(DecafRequestContext)),
+    __param(2, Optional()),
+    __param(2, Inject(GRAPH_WORKFLOW_OPTIONS)),
+    __metadata("design:paramtypes", [GraphWorkflowService,
+        DecafRequestContext, Object])
+], GraphWorkflowController);
+export { GraphWorkflowController };
+//# sourceMappingURL=GraphWorkflowController.js.map

package/lib/esm/nest/graph/GraphWorkflowController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphWorkflowController.js","sourceRoot":"","sources":["../../../../src/nest/graph/GraphWorkflowController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EACL,IAAI,EACJ,UAAU,EACV,GAAG,EACH,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,GAAG,EACH,IAAI,EACJ,MAAM,GACP,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,kCAA+B;AACtF,OAAO,EAAE,kCAAkC,EAAE,iCAA8B;AA8B3E,SAAS,wBAAwB,CAAC,CAAU,EAAE,UAAmB;IAC/D,IAAI,CAAC,YAAY,kCAAkC,EAAE,CAAC;QACpD,OAAO,IAAI,aAAa,CACtB;YACE,OAAO,EAAE,kDAAkD;YAC3D,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,EACD,UAAU,CAAC,oBAAoB,CAChC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,cAAc,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;QACnE,OAAO,IAAI,aAAa,CACtB,UAAU;YACR,CAAC,CAAC,mBAAmB,UAAU,4BAA4B;YAC3D,CAAC,CAAC,CAAC,CAAC,OAAO,EACb,UAAU,CAAC,SAAS,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,YAAY,eAAe,EAAE,CAAC;QACjC,OAAO,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,YAAY,aAAa;QAAE,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;GAaG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,YACmB,eAAqC,EAErC,cAAoC,EAEpC,UAA0C,EAAE;QAJ5C,oBAAe,GAAf,eAAe,CAAsB;QAErC,mBAAc,GAAd,cAAc,CAAsB;QAEpC,YAAO,GAAP,OAAO,CAAqC;IAC5D,CAAC;IAEJ;;;;;OAKG;IACK,2BAA2B;QACjC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,aAAa,CACrB,iEAAiE,EACjE,UAAU,CAAC,YAAY,CACxB,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CACK,UAAkB,EAC/B,IAAa;QAErB,MAAM,OAAO,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;gBACzC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CACrC,UAAU,EACV,IAA+B,EAC/B,OAAO,CACR;gBACH,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CACrC,UAAU,EACV,IAA6B,EAC7B,OAAO,CACR,CAAC;YACN,OAAO;gBACL,UAAU;gBACV,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;aACvC,CAAC;QACJ,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,wBAAwB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CACM,UAAkB;QAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,wBAAwB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CACZ,IAAa;QAErB,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9E,CAAC;IAEO,kBAAkB,CAAC,IAAa;QACtC,OAAO,CACL,CAAC,CAAC,IAAI;YACN,OAAO,IAAI,KAAK,QAAQ;YACxB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,IAAgC,CAAC,UAAU,CAAC,KAAK,SAAS;YAC1D,IAAgC,CAAC,OAAO,CAAC,KAAK,SAAS,CACzD,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,IAAa;QAC9B,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAQ,IAA4C,CAAC,QAAQ,CAAC;QAChE,CAAC;QACD,OAAO,IAA6B,CAAC;IACvC,CAAC;CACF,CAAA;AAhEO;IADL,GAAG,CAAC,uBAAuB,CAAC;IAE1B,WAAA,KAAK,CAAC,YAAY,CAAC,CAAA;IACnB,WAAA,IAAI,EAAE,CAAA;;;;2DAuBR;AAGK;IADL,GAAG,CAAC,uBAAuB,CAAC;IAE1B,WAAA,KAAK,CAAC,YAAY,CAAC,CAAA;;;;0DAQrB;AAGK;IADL,IAAI,CAAC,oBAAoB,CAAC;IAExB,WAAA,IAAI,EAAE,CAAA;;;;+DAKR;AA3EU,uBAAuB;IADnC,UAAU,CAAC,OAAO,CAAC;IAIf,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAEvC,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,sBAAsB,CAAC,CAAA;qCAHT,oBAAoB;QAEpB,mBAAmB;GAJ5C,uBAAuB,CA6FnC"}

package/lib/esm/nest/graph/GraphWorkflowDocumentLimits.js

@@ -0,0 +1,8 @@
+/** Default document resource limits (§4.16): payload size, nesting depth, node and edge counts. */
+export const DEFAULT_GRAPH_WORKFLOW_DOCUMENT_LIMITS = {
+    maxDocumentBytes: 2_000_000,
+    maxNestingDepth: 10,
+    maxNodes: 500,
+    maxEdges: 1_000,
+};
+//# sourceMappingURL=GraphWorkflowDocumentLimits.js.map

package/lib/esm/nest/graph/GraphWorkflowDocumentLimits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphWorkflowDocumentLimits.js","sourceRoot":"","sources":["../../../../src/nest/graph/GraphWorkflowDocumentLimits.ts"],"names":[],"mappings":"AAgCA,mGAAmG;AACnG,MAAM,CAAC,MAAM,sCAAsC,GACjD;IACE,gBAAgB,EAAE,SAAS;IAC3B,eAAe,EAAE,EAAE;IACnB,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,KAAK;CAChB,CAAC"}

package/lib/esm/nest/graph/GraphWorkflowErrors.js

@@ -0,0 +1,18 @@
+import { ValidationError } from "@decaf-ts/db-decorators";
+/**
+ * Raised when a submitted workflow document fails boundary validation and
+ * must not be persisted (DECAF-50 §4.10). Carries the structured issues so
+ * HTTP transports can surface them without re-running validation.
+ *
+ * @class GraphWorkflowDocumentRejectedError
+ */
+export class GraphWorkflowDocumentRejectedError extends ValidationError {
+    constructor(issues) {
+        super(`Graph workflow document rejected with ${issues.length} issue(s): ${issues
+            .map((i) => `${i.code} at ${i.path} (${i.message})`)
+            .join("; ")}`);
+        this.name = GraphWorkflowDocumentRejectedError.name;
+        this.issues = issues;
+    }
+}
+//# sourceMappingURL=GraphWorkflowErrors.js.map

package/lib/esm/nest/graph/GraphWorkflowErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphWorkflowErrors.js","sourceRoot":"","sources":["../../../../src/nest/graph/GraphWorkflowErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D;;;;;;GAMG;AACH,MAAM,OAAO,kCAAmC,SAAQ,eAAe;IAGrE,YAAY,MAA8B;QACxC,KAAK,CACH,yCAAyC,MAAM,CAAC,MAAM,cAAc,MAAM;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC,IAAI,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/lib/esm/nest/graph/GraphWorkflowModel.js

@@ -9,6 +9,20 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import { model } from "@decaf-ts/decorator-validation";
 import { BaseModel, column, pk, table } from "@decaf-ts/core";
+/**
+ * Canonical workflow persistence model (DECAF-50 §4.10).
+ *
+ * `document` is the executable source of truth. `snapshot` is retained
+ * temporarily (DECAF-50 §4.18 transition) so legacy persisted snapshots keep
+ * loading through lossless read-path conversion; it must never become the
+ * executable source of truth again and is removed at cutover (P7).
+ *
+ * `owner` implements the DECAF-48 `{ workflowId, ownerUser }` ownership tuple:
+ * the authenticated user that created the workflow, or `undefined` for
+ * system/standalone saves (tolerated per DECAF-48 §4.15).
+ *
+ * @class GraphWorkflowModel
+ */
 let GraphWorkflowModel = class GraphWorkflowModel extends BaseModel {
     constructor(arg) {
         super(arg);
@@ -18,12 +32,24 @@ __decorate([
     pk({ type: String, generated: false }),
     __metadata("design:type", String)
 ], GraphWorkflowModel.prototype, "workflowId", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", String)
+], GraphWorkflowModel.prototype, "name", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", Object)
+], GraphWorkflowModel.prototype, "document", void 0);
+__decorate([
+    column(),
+    __metadata("design:type", String)
+], GraphWorkflowModel.prototype, "owner", void 0);
 __decorate([
     column(),
     __metadata("design:type", Object)
 ], GraphWorkflowModel.prototype, "snapshot", void 0);
 GraphWorkflowModel = __decorate([
-    table("graph_workflow_snapshot"),
+    table("graph_workflow"),
     model(),
     __metadata("design:paramtypes", [Object])
 ], GraphWorkflowModel);

package/lib/esm/nest/graph/GraphWorkflowModel.js.map

@@ -1 +1 @@
-{"version":3,"file":"GraphWorkflowModel.js","sourceRoot":"","sources":["../../../../src/nest/graph/GraphWorkflowModel.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAIvD,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,SAAS;IAO/C,YAAY,GAAiC;QAC3C,KAAK,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;CACF,CAAA;AARC;IADC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;;sDACnB;AAGpB;IADC,MAAM,EAAE;;oDAC0B;AALxB,kBAAkB;IAF9B,KAAK,CAAC,yBAAyB,CAAC;IAChC,KAAK,EAAE;;GACK,kBAAkB,CAU9B"}
+{"version":3,"file":"GraphWorkflowModel.js","sourceRoot":"","sources":["../../../../src/nest/graph/GraphWorkflowModel.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG9D;;;;;;;;;;;;;GAaG;AAGI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,SAAS;IAgB/C,YAAY,GAAiC;QAC3C,KAAK,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;CACF,CAAA;AAjBC;IADC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;;sDACnB;AAGpB;IADC,MAAM,EAAE;;gDACK;AAGd;IADC,MAAM,EAAE;;oDACwB;AAGjC;IADC,MAAM,EAAE;;iDACM;AAGf;IADC,MAAM,EAAE;;oDAC0B;AAdxB,kBAAkB;IAF9B,KAAK,CAAC,gBAAgB,CAAC;IACvB,KAAK,EAAE;;GACK,kBAAkB,CAmB9B"}