@decaf-ts/integrations 0.8.0 → 0.9.0

package/lib/cjs/graph/engine/execution/GraphExecutionEngine.cjs

@@ -2,11 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GraphExecutionEngine = void 0;
 const constants_js_1 = require("./../constants.cjs");
-const constants_js_2 = require("./../../shared/constants.cjs");
+const graph_1 = require("@decaf-ts/ui-decorators/graph");
 const index_js_1 = require("./../errors/index.cjs");
 const GraphExecutionEventEmitter_js_1 = require("./../events/GraphExecutionEventEmitter.cjs");
 const GraphExecutionEventFactory_js_1 = require("./../events/GraphExecutionEventFactory.cjs");
 const GraphExecutionPlanner_js_1 = require("./../planning/GraphExecutionPlanner.cjs");
+const GraphWorkflowDocumentValidator_js_1 = require("./../validation/GraphWorkflowDocumentValidator.cjs");
+const GraphParameterValidator_js_1 = require("./../validation/GraphParameterValidator.cjs");
+const GraphValidationErrors_js_1 = require("./../validation/GraphValidationErrors.cjs");
 const InMemoryGraphValueStoreAdapter_js_1 = require("./../store/InMemoryGraphValueStoreAdapter.cjs");
 const GraphValueStore_js_1 = require("./../store/GraphValueStore.cjs");
 const GraphPinningService_js_1 = require("./../pinning/GraphPinningService.cjs");
@@ -18,13 +21,20 @@ const GraphExecutionResult_js_1 = require("./GraphExecutionResult.cjs");
 /**
  * Reference graph execution engine.
  *
- * Executes a {@link GraphWorkflowDefinition} by:
- * 1. Planning the workflow into topological layers.
- * 2. Seeding workflow inputs into the value store.
- * 3. Executing nodes layer-by-layer with configurable concurrency.
- * 4. Routing values along edges.
- * 5. Emitting structured events through Decaf's Observable pipeline.
- * 6. Returning a complete {@link GraphExecutionResult}.
+ * Executes a canonical {@link GraphWorkflowDocument} by:
+ * 1. Validating it through the nine-stage gate and resolving it against the
+ *    backend catalogue (§4.8).
+ * 2. Planning the resolved workflow into topological layers (§4.9).
+ * 3. Seeding workflow inputs into the value store.
+ * 4. Executing nodes layer-by-layer with configurable concurrency, honouring
+ *    disabled-node semantics.
+ * 5. Building node inputs from routed edges, literal bindings, allowed
+ *    expressions, and manifest defaults; keeping configuration (parameters,
+ *    credentials) separate from input data.
+ * 6. Validating executor outputs against the effective output manifest.
+ * 7. Routing values along data edges.
+ * 8. Emitting structured events through Decaf's Observable pipeline.
+ * 9. Returning a complete {@link GraphExecutionResult}.
  */
 class GraphExecutionEngine {
     constructor(config) {
@@ -35,6 +45,13 @@ class GraphExecutionEngine {
         this.defaultOptions = config.defaultOptions ?? {};
         this.codeSandboxEvaluator = config.codeSandboxEvaluator;
         this.config = config;
+        this.documentValidator =
+            config.documentValidator ??
+                new GraphWorkflowDocumentValidator_js_1.GraphWorkflowDocumentValidator({
+                    catalogue: config.catalogue ?? config.registry.catalog,
+                    limits: config.documentLimits,
+                    credentialAuthorizer: config.credentialAuthorizer,
+                });
         config.onEngineCreated?.(this);
     }
     /**
@@ -63,85 +80,143 @@ class GraphExecutionEngine {
         await this.emitter.updateObservers(event);
     }
     /**
-     * Executes a workflow with the given inputs and options.
+     * Executes a canonical workflow document with the given inputs and options.
+     *
+     * Resolution happens internally (DECAF-50 §4.9): the document is validated
+     * through the nine-stage gate and resolved against the backend catalogue
+     * before planning. Decorated `GraphWorkflowDefinition` objects are NOT
+     * accepted — compile them with the §4.18 transition compiler first.
      *
-     * @param workflow - The workflow definition to execute.
-     * @param inputs - Workflow input values keyed by input port name.
+     * @param document - The canonical workflow document to execute.
+     * @param inputs - Workflow input values keyed by input port id.
      * @param options - Optional execution overrides (merged over the defaults).
      * @returns The complete execution result, including a `runId`, per-node
-     * results, and workflow outputs (or the failure payload).
+     *   results, and workflow outputs (or the failure payload).
+     * @throws {GraphDocumentValidationError} when the document fails the
+     *   nine-stage validation gate (carries every structured issue).
      */
-    async execute(workflow, inputs = {}, options = {}) {
+    async execute(document, inputs = {}, options = {}) {
         const opts = this.mergeOptions(options);
+        this.assertNotAborted(opts);
         const runId = opts.runId ?? this.generateRunId();
         const path = opts.path ?? [];
         const eventFactory = new GraphExecutionEventFactory_js_1.GraphExecutionEventFactory();
         const valueStore = new GraphValueStore_js_1.GraphValueStore(this.valueStoreAdapter);
-        valueStore.seedWorkflowInputs(inputs);
-        const plan = this.planner.plan(workflow);
-        const frame = new GraphExecutionFrame_js_1.GraphExecutionFrame(runId, plan, valueStore, eventFactory);
+        valueStore.seedWorkflowInputs(this.withWorkflowInputDefaults(document, inputs));
         const emitFn = async (partial) => {
             await this.emitEvent(frame, {
-                type: partial.type ?? constants_js_2.GraphExecutionEventType.NODE_OUTPUT,
+                type: partial.type ?? graph_1.GraphExecutionEventType.NODE_OUTPUT,
                 runId,
                 parentRunId: opts.parentRunId,
-                workflowId: workflow.name,
+                workflowId: document.id || document.name,
                 nodeId: partial.nodeId,
                 path: partial.path ?? path,
                 ...partial,
             });
         };
+        const emitValidationEvent = async (partial) => {
+            const event = eventFactory.create({
+                id: "",
+                sequence: 0,
+                timestamp: new Date(),
+                runId,
+                parentRunId: opts.parentRunId,
+                workflowId: document.id || document.name,
+                path,
+                ...partial,
+            });
+            await this.emitter.updateObservers(event);
+        };
+        // ------------------------------------------------------------------
+        // Validation + resolution (nine-stage gate, §4.8) — internal.
+        // ------------------------------------------------------------------
+        await emitValidationEvent({
+            type: graph_1.GraphExecutionEventType.VALIDATION_STARTED,
+            status: graph_1.GraphExecutionStatus.PLANNING,
+        });
+        const validation = await this.documentValidator.validate(document);
+        if (!validation.valid || !validation.resolved) {
+            await emitValidationEvent({
+                type: graph_1.GraphExecutionEventType.VALIDATION_FAILED,
+                status: graph_1.GraphExecutionStatus.FAILED,
+                payload: { issues: validation.issues },
+            });
+            throw new GraphValidationErrors_js_1.GraphDocumentValidationError(`Graph workflow document '${document.id}' failed validation with ${validation.issues.length} issue(s)`, validation.issues);
+        }
+        await emitValidationEvent({
+            type: graph_1.GraphExecutionEventType.VALIDATION_COMPLETED,
+            status: graph_1.GraphExecutionStatus.PLANNING,
+            payload: { issues: validation.issues.length },
+        });
+        this.assertNotAborted(opts);
+        const plan = this.planner.plan(validation.resolved);
+        const frame = new GraphExecutionFrame_js_1.GraphExecutionFrame(runId, plan, valueStore, eventFactory);
         await this.emitEvent(frame, {
-            type: constants_js_2.GraphExecutionEventType.WORKFLOW_STARTED,
+            type: graph_1.GraphExecutionEventType.WORKFLOW_STARTED,
             runId,
             parentRunId: opts.parentRunId,
-            workflowId: workflow.name,
+            workflowId: plan.workflowId,
             path,
-            status: constants_js_2.GraphExecutionStatus.RUNNING,
+            status: graph_1.GraphExecutionStatus.RUNNING,
             payload: { inputs },
         });
         await this.emitEvent(frame, {
-            type: constants_js_2.GraphExecutionEventType.WORKFLOW_PLANNED,
+            type: graph_1.GraphExecutionEventType.WORKFLOW_PLANNED,
             runId,
             parentRunId: opts.parentRunId,
-            workflowId: workflow.name,
+            workflowId: plan.workflowId,
             path,
-            status: constants_js_2.GraphExecutionStatus.PLANNING,
+            status: graph_1.GraphExecutionStatus.PLANNING,
             payload: { layers: plan.layers.length, nodes: plan.nodes.length },
         });
         try {
             for (const layer of plan.layers) {
+                this.assertNotAborted(opts);
                 await this.executeLayer(frame, plan, layer.nodes, opts, emitFn);
             }
-            const firstFailure = [...frame.nodeResults.values()].find((result) => result.status === constants_js_2.GraphExecutionStatus.FAILED);
+            this.assertNotAborted(opts);
+            const firstFailure = [...frame.nodeResults.values()].find((result) => result.status === graph_1.GraphExecutionStatus.FAILED);
             if (firstFailure?.error) {
                 throw new index_js_1.GraphExecutionError(firstFailure.error.message, firstFailure.error.code ?? "GRAPH_EXECUTION_ERROR", firstFailure.error.details);
             }
             frame.finish();
             await this.emitEvent(frame, {
-                type: constants_js_2.GraphExecutionEventType.WORKFLOW_COMPLETED,
+                type: graph_1.GraphExecutionEventType.WORKFLOW_COMPLETED,
                 runId,
                 parentRunId: opts.parentRunId,
-                workflowId: workflow.name,
+                workflowId: plan.workflowId,
                 path,
-                status: constants_js_2.GraphExecutionStatus.SUCCEEDED,
+                status: graph_1.GraphExecutionStatus.SUCCEEDED,
                 payload: { outputs: valueStore.getWorkflowValues() },
             });
-            return (0, GraphExecutionResult_js_1.buildGraphExecutionResult)(frame, workflow, inputs, constants_js_2.GraphExecutionStatus.SUCCEEDED, opts.metadata);
+            return (0, GraphExecutionResult_js_1.buildGraphExecutionResult)(frame, document, inputs, graph_1.GraphExecutionStatus.SUCCEEDED, opts.metadata);
         }
         catch (error) {
             frame.finish();
             const errorPayload = this.toErrorPayload(error);
+            if (error instanceof index_js_1.GraphRunCancelledError ||
+                opts.abortSignal?.aborted === true) {
+                await this.emitEvent(frame, {
+                    type: graph_1.GraphExecutionEventType.WORKFLOW_CANCELLED,
+                    runId,
+                    parentRunId: opts.parentRunId,
+                    workflowId: plan.workflowId,
+                    path,
+                    status: graph_1.GraphExecutionStatus.CANCELLED,
+                    error: errorPayload,
+                });
+                return (0, GraphExecutionResult_js_1.buildGraphExecutionResult)(frame, document, inputs, graph_1.GraphExecutionStatus.CANCELLED, opts.metadata);
+            }
             await this.emitEvent(frame, {
-                type: constants_js_2.GraphExecutionEventType.WORKFLOW_FAILED,
+                type: graph_1.GraphExecutionEventType.WORKFLOW_FAILED,
                 runId,
                 parentRunId: opts.parentRunId,
-                workflowId: workflow.name,
+                workflowId: plan.workflowId,
                 path,
-                status: constants_js_2.GraphExecutionStatus.FAILED,
+                status: graph_1.GraphExecutionStatus.FAILED,
                 error: errorPayload,
             });
-            return (0, GraphExecutionResult_js_1.buildGraphExecutionResult)(frame, workflow, inputs, constants_js_2.GraphExecutionStatus.FAILED, opts.metadata);
+            return (0, GraphExecutionResult_js_1.buildGraphExecutionResult)(frame, document, inputs, graph_1.GraphExecutionStatus.FAILED, opts.metadata);
         }
     }
     /**
@@ -153,7 +228,7 @@ class GraphExecutionEngine {
     async pinNode(options) {
         const service = this.createPinningService();
         await service.pinNode(options);
-        await this.emitPinningEvent(options.nodeId, constants_js_2.GraphExecutionEventType.NODE_PINNED);
+        await this.emitPinningEvent(options.nodeId, graph_1.GraphExecutionEventType.NODE_PINNED);
     }
     /**
      * Unpins a node by its fingerprint.
@@ -161,7 +236,7 @@ class GraphExecutionEngine {
     async unpinNode(options) {
         const service = this.createPinningService();
         await service.unpinNode(options);
-        await this.emitPinningEvent(options.nodeId, constants_js_2.GraphExecutionEventType.NODE_UNPINNED);
+        await this.emitPinningEvent(options.nodeId, graph_1.GraphExecutionEventType.NODE_UNPINNED);
     }
     /**
      * Creates a {@link GraphPinningService} backed by this engine's value store
@@ -188,6 +263,19 @@ class GraphExecutionEngine {
         });
         await this.emitter.updateObservers(event);
     }
+    /**
+     * Fills unprovided workflow inputs with their declared port defaults.
+     */
+    withWorkflowInputDefaults(document, inputs) {
+        const seeded = { ...inputs };
+        for (const port of document.inputs) {
+            if (seeded[port.id] === undefined &&
+                port.defaultValue !== undefined) {
+                seeded[port.id] = port.defaultValue;
+            }
+        }
+        return seeded;
+    }
     /**
      * Executes a layer of nodes with the configured concurrency.
      */
@@ -200,21 +288,26 @@ class GraphExecutionEngine {
         }
     }
     /**
-     * Executes a single node.
+     * Executes a single node, honouring disabled-node semantics (§4.9).
      */
     async executeNode(frame, plan, planNode, opts, emitFn) {
+        this.assertNotAborted(opts);
+        if (planNode.instance.disabled === true) {
+            await this.executeDisabledNode(frame, plan, planNode, opts);
+            return;
+        }
         const startedAt = new Date();
         const nodePath = [...(opts.path ?? []), planNode.id];
         await this.emitEvent(frame, {
-            type: constants_js_2.GraphExecutionEventType.NODE_STARTED,
+            type: graph_1.GraphExecutionEventType.NODE_STARTED,
             runId: frame.runId,
             workflowId: plan.workflowId,
             nodeId: planNode.id,
             path: nodePath,
-            status: constants_js_2.GraphExecutionStatus.RUNNING,
+            status: graph_1.GraphExecutionStatus.RUNNING,
         });
-        this.emitNodeStateChanged(frame, plan, planNode, nodePath, constants_js_2.GraphVisualState.RUNNING, constants_js_2.GraphExecutionStatus.RUNNING);
-        const inputs = this.resolveNodeInputs(frame, plan, planNode);
+        this.emitNodeStateChanged(frame, plan, planNode, nodePath, graph_1.GraphVisualState.RUNNING, graph_1.GraphExecutionStatus.RUNNING);
+        const inputs = await this.resolveNodeInputs(frame, plan, planNode, opts);
         // Cache-hit: check for a pinned value before executing the node
         if (opts.usePinnedValues) {
             const cached = await this.tryPinnedValue(frame, plan, planNode, inputs);
@@ -224,7 +317,7 @@ class GraphExecutionEngine {
                 const finishedAt = new Date();
                 const result = {
                     nodeId: planNode.id,
-                    status: constants_js_2.GraphExecutionStatus.CACHED,
+                    status: graph_1.GraphExecutionStatus.CACHED,
                     inputs,
                     outputs: cached.outputs,
                     startedAt,
@@ -235,62 +328,69 @@ class GraphExecutionEngine {
                 };
                 frame.recordNodeResult(result);
                 await this.emitEvent(frame, {
-                    type: constants_js_2.GraphExecutionEventType.NODE_CACHE_HIT,
+                    type: graph_1.GraphExecutionEventType.NODE_CACHE_HIT,
                     runId: frame.runId,
                     workflowId: plan.workflowId,
                     nodeId: planNode.id,
                     path: nodePath,
-                    status: constants_js_2.GraphExecutionStatus.CACHED,
+                    status: graph_1.GraphExecutionStatus.CACHED,
                     payload: { outputs: cached.outputs },
                 });
                 await this.emitEvent(frame, {
-                    type: constants_js_2.GraphExecutionEventType.NODE_COMPLETED,
+                    type: graph_1.GraphExecutionEventType.NODE_COMPLETED,
                     runId: frame.runId,
                     workflowId: plan.workflowId,
                     nodeId: planNode.id,
                     path: nodePath,
-                    status: constants_js_2.GraphExecutionStatus.SUCCEEDED,
+                    status: graph_1.GraphExecutionStatus.SUCCEEDED,
                     payload: { outputs: cached.outputs, fromCache: true },
                 });
-                this.emitNodeStateChanged(frame, plan, planNode, nodePath, constants_js_2.GraphVisualState.SUCCEEDED, constants_js_2.GraphExecutionStatus.SUCCEEDED);
+                this.emitNodeStateChanged(frame, plan, planNode, nodePath, graph_1.GraphVisualState.SUCCEEDED, graph_1.GraphExecutionStatus.SUCCEEDED);
                 return;
             }
         }
         try {
-            const executor = this.config.registry.resolve(planNode.kind);
-            const context = new GraphExecutionContext_js_1.GraphExecutionContext(frame.runId, opts.parentRunId, plan.workflow, planNode.definition, nodePath, emitFn, opts.metadata);
-            const outputs = await executor.execute(inputs, context);
-            const resolvedOutputs = outputs ?? {};
-            frame.valueStore.setNodeOutputs(planNode.id, resolvedOutputs);
-            this.routeOutgoingEdges(frame, plan, planNode, resolvedOutputs);
+            const context = new GraphExecutionContext_js_1.GraphExecutionContext(frame.runId, opts.parentRunId, plan.workflowId, plan.resolved.document, planNode.instance, planNode.manifest, nodePath, emitFn, opts.metadata);
+            const request = {
+                nodeId: planNode.id,
+                kind: planNode.kind,
+                inputs,
+                parameters: planNode.instance.parameters ?? {},
+                credentials: this.collectCredentials(planNode),
+                metadata: planNode.instance.metadata,
+            };
+            const rawOutputs = await this.invokeExecutor(planNode, request, context);
+            const outputs = this.validateNodeOutputs(planNode, rawOutputs ?? {});
+            frame.valueStore.setNodeOutputs(planNode.id, outputs);
+            this.routeOutgoingEdges(frame, plan, planNode, outputs);
             const finishedAt = new Date();
             const result = {
                 nodeId: planNode.id,
-                status: constants_js_2.GraphExecutionStatus.SUCCEEDED,
+                status: graph_1.GraphExecutionStatus.SUCCEEDED,
                 inputs,
-                outputs: resolvedOutputs,
+                outputs,
                 startedAt,
                 finishedAt,
                 events: [],
             };
             frame.recordNodeResult(result);
             await this.emitEvent(frame, {
-                type: constants_js_2.GraphExecutionEventType.NODE_COMPLETED,
+                type: graph_1.GraphExecutionEventType.NODE_COMPLETED,
                 runId: frame.runId,
                 workflowId: plan.workflowId,
                 nodeId: planNode.id,
                 path: nodePath,
-                status: constants_js_2.GraphExecutionStatus.SUCCEEDED,
-                payload: { outputs: resolvedOutputs },
+                status: graph_1.GraphExecutionStatus.SUCCEEDED,
+                payload: { outputs },
             });
-            this.emitNodeStateChanged(frame, plan, planNode, nodePath, constants_js_2.GraphVisualState.SUCCEEDED, constants_js_2.GraphExecutionStatus.SUCCEEDED);
+            this.emitNodeStateChanged(frame, plan, planNode, nodePath, graph_1.GraphVisualState.SUCCEEDED, graph_1.GraphExecutionStatus.SUCCEEDED);
         }
         catch (error) {
             const finishedAt = new Date();
             const errorPayload = this.toErrorPayload(error);
             const result = {
                 nodeId: planNode.id,
-                status: constants_js_2.GraphExecutionStatus.FAILED,
+                status: graph_1.GraphExecutionStatus.FAILED,
                 inputs,
                 error: errorPayload,
                 startedAt,
@@ -299,21 +399,158 @@ class GraphExecutionEngine {
             };
             frame.recordNodeResult(result);
             await this.emitEvent(frame, {
-                type: constants_js_2.GraphExecutionEventType.NODE_FAILED,
+                type: graph_1.GraphExecutionEventType.NODE_FAILED,
                 runId: frame.runId,
                 workflowId: plan.workflowId,
                 nodeId: planNode.id,
                 path: nodePath,
-                status: constants_js_2.GraphExecutionStatus.FAILED,
+                status: graph_1.GraphExecutionStatus.FAILED,
                 error: errorPayload,
             });
-            this.emitNodeStateChanged(frame, plan, planNode, nodePath, constants_js_2.GraphVisualState.FAILED, constants_js_2.GraphExecutionStatus.FAILED);
+            this.emitNodeStateChanged(frame, plan, planNode, nodePath, graph_1.GraphVisualState.FAILED, graph_1.GraphExecutionStatus.FAILED);
             if (opts.failFast ?? true)
                 throw error;
         }
     }
     /**
-     * Resolves a node's input values from incoming edges.
+     * Applies the explicit disabled-node semantics (§4.9):
+     * `skip`, `passThroughFirstInput`, or `emitDefaults`, resolved from the
+     * instance metadata, document settings, and the default.
+     */
+    async executeDisabledNode(frame, plan, planNode, opts) {
+        const startedAt = new Date();
+        const nodePath = [...(opts.path ?? []), planNode.id];
+        const behavior = GraphParameterValidator_js_1.GraphParameterValidator.disabledBehaviorOf(planNode.instance, plan.resolved.document.settings);
+        await this.emitEvent(frame, {
+            type: graph_1.GraphExecutionEventType.NODE_SKIPPED,
+            runId: frame.runId,
+            workflowId: plan.workflowId,
+            nodeId: planNode.id,
+            path: nodePath,
+            status: graph_1.GraphExecutionStatus.SKIPPED,
+            payload: { disabled: true, behavior },
+        });
+        if (behavior === "skip") {
+            const result = {
+                nodeId: planNode.id,
+                status: graph_1.GraphExecutionStatus.SKIPPED,
+                inputs: {},
+                startedAt,
+                finishedAt: new Date(),
+                events: [],
+            };
+            frame.recordNodeResult(result);
+            this.emitNodeStateChanged(frame, plan, planNode, nodePath, graph_1.GraphVisualState.SKIPPED, graph_1.GraphExecutionStatus.SKIPPED);
+            return;
+        }
+        const inputs = await this.resolveNodeInputs(frame, plan, planNode, opts);
+        let outputs;
+        if (behavior === "passThroughFirstInput") {
+            const firstIncoming = (plan.incomingByNode.get(planNode.id) ?? []).find((edge) => edge.type === "data");
+            const firstOutput = planNode.manifest.outputs[0]?.id ?? "value";
+            const value = firstIncoming
+                ? frame.valueStore.getPort(firstIncoming.sourceNodeId, firstIncoming.sourcePort)
+                : Object.values(inputs)[0];
+            outputs = { [firstOutput]: value };
+        }
+        else {
+            // emitDefaults — every declared output port is emitted with its
+            // declared default (absent a declared default, undefined).
+            outputs = {};
+            for (const port of planNode.manifest.outputs) {
+                outputs[port.id] = port.metadata?.["defaultValue"];
+            }
+        }
+        frame.valueStore.setNodeOutputs(planNode.id, outputs);
+        this.routeOutgoingEdges(frame, plan, planNode, outputs);
+        const result = {
+            nodeId: planNode.id,
+            status: graph_1.GraphExecutionStatus.SUCCEEDED,
+            inputs,
+            outputs,
+            startedAt,
+            finishedAt: new Date(),
+            events: [],
+        };
+        frame.recordNodeResult(result);
+        this.emitNodeStateChanged(frame, plan, planNode, nodePath, graph_1.GraphVisualState.SUCCEEDED, graph_1.GraphExecutionStatus.SUCCEEDED);
+    }
+    /**
+     * Invokes the node's catalogue-resolved executor (§4.9 request contract,
+     * post-cutover: every executor receives the full request with
+     * configuration and input data separated).
+     */
+    async invokeExecutor(planNode, request, context) {
+        return await planNode.executor.execute(request, context);
+    }
+    /**
+     * Validates executor outputs against the effective output manifest
+     * (§4.9): unknown outputs are rejected by default; missing required
+     * outputs fail the node. Lenient transition manifests (legacy
+     * executor-only registrations) are exempt until cutover.
+     */
+    validateNodeOutputs(planNode, outputs) {
+        const manifest = planNode.manifest;
+        if (manifest.policies?.allowUnknownOutputs === true) {
+            return outputs;
+        }
+        const declaredOutputs = new Set(manifest.outputs.map((port) => port.id));
+        const unknownOutputs = Object.keys(outputs).filter((key) => !declaredOutputs.has(key));
+        if (unknownOutputs.length > 0) {
+            throw new index_js_1.GraphExecutionError(`Node '${planNode.id}' of kind '${planNode.kind}' produced unknown output(s): ${unknownOutputs.join(", ")}`, "GRAPH_OUTPUT_VALIDATION_FAILED", { nodeId: planNode.id, unknownOutputs });
+        }
+        const missingRequired = manifest.outputs
+            .filter((port) => port.required === true && !(port.id in outputs))
+            .map((port) => port.id);
+        if (missingRequired.length > 0) {
+            throw new index_js_1.GraphExecutionError(`Node '${planNode.id}' of kind '${planNode.kind}' did not produce required output(s): ${missingRequired.join(", ")}`, "GRAPH_OUTPUT_VALIDATION_FAILED", { nodeId: planNode.id, missingRequired });
+        }
+        return outputs;
+    }
+    /**
+     * Collects the resolved credential references for a node: credential-type
+     * parameter values plus the `credentials` record in instance metadata.
+     * Documents carry references only — secret material never enters requests.
+     */
+    collectCredentials(planNode) {
+        const credentials = {};
+        for (const parameter of planNode.manifest.parameters) {
+            if (parameter.type !== "credential")
+                continue;
+            const value = (planNode.instance.parameters ?? {})[parameter.id];
+            if (typeof value === "string" && value.length > 0) {
+                credentials[parameter.id] = {
+                    credentialId: value,
+                    credentialType: parameter.credentialType ?? "",
+                };
+            }
+            else if ((0, GraphParameterValidator_js_1.isGraphCredentialReferenceLike)(value)) {
+                credentials[parameter.id] = {
+                    credentialId: value.credentialId,
+                    credentialType: value.credentialType,
+                };
+            }
+        }
+        const extra = (planNode.instance.metadata ?? {})["credentials"];
+        if (extra && typeof extra === "object" && !Array.isArray(extra)) {
+            for (const [key, raw] of Object.entries(extra)) {
+                const value = raw;
+                if (typeof value === "string" && value.length > 0) {
+                    credentials[key] = { credentialId: value, credentialType: "" };
+                }
+                else if ((0, GraphParameterValidator_js_1.isGraphCredentialReferenceLike)(value)) {
+                    credentials[key] = {
+                        credentialId: value.credentialId,
+                        credentialType: value.credentialType,
+                    };
+                }
+            }
+        }
+        return credentials;
+    }
+    /**
+     * Resolves a node's input values from routed data edges, literal bindings,
+     * allowed expression bindings, and manifest port defaults (§4.9).
      *
      * When multiple edges target the same port, their values are spread into the
      * top-level inputs keyed by each edge's `sourcePort`. This allows multiple
@@ -321,9 +558,9 @@ class GraphExecutionEngine {
      * `data` port) and have all values accessible directly as
      * `$input.{sourcePort}` (e.g. `$input.count`, `$input.text`).
      */
-    resolveNodeInputs(frame, plan, planNode) {
+    async resolveNodeInputs(frame, plan, planNode, opts) {
         const inputs = {};
-        const incoming = plan.incomingByNode.get(planNode.id) ?? [];
+        const incoming = (plan.incomingByNode.get(planNode.id) ?? []).filter((edge) => edge.type === "data");
         const edgesByTarget = new Map();
         for (const edge of incoming) {
             const list = edgesByTarget.get(edge.targetPort) ?? [];
@@ -340,8 +577,46 @@ class GraphExecutionEngine {
                 }
             }
         }
+        // Literal bindings, expression bindings, and manifest defaults.
+        const bindings = planNode.instance.inputBindings ?? {};
+        for (const port of planNode.manifest.inputs) {
+            const binding = bindings[port.id];
+            if (binding?.mode === "literal") {
+                inputs[port.id] = binding.value;
+            }
+            else if (binding?.mode === "expression") {
+                inputs[port.id] = await this.evaluateExpressionBinding(planNode, binding.expression, inputs, opts);
+            }
+            else if (inputs[port.id] === undefined) {
+                const defaultValue = port.metadata?.["defaultValue"];
+                if (defaultValue !== undefined) {
+                    inputs[port.id] = defaultValue;
+                }
+            }
+        }
         return inputs;
     }
+    /**
+     * Evaluates an expression binding with the EXISTING allowed-expression
+     * machinery only (the pluggable {@link CodeSandboxEvaluator}, DECAF-32
+     * §22.4) — no new evaluator. The expression sees the already-routed input
+     * values as `$input` and the run metadata as context.
+     */
+    async evaluateExpressionBinding(planNode, expression, inputs, opts) {
+        const evaluator = this.codeSandboxEvaluator;
+        if (!evaluator) {
+            throw new index_js_1.GraphExecutionError(`Expression binding on node '${planNode.id}' requires a CodeSandboxEvaluator to be registered in GraphExecutionEngineConfig.codeSandboxEvaluator`, "GRAPH_CODE_SANDBOX_NOT_CONFIGURED", { nodeId: planNode.id, expression });
+        }
+        const md = opts.metadata;
+        return await evaluator.evaluate({
+            code: expression,
+            language: "javascript",
+            input: inputs,
+            vars: md?.vars ?? undefined,
+            item: md?.item,
+            index: md?.index,
+        });
+    }
     /**
      * Attempts to read a pinned value for the node. Returns the cached outputs
      * when a valid pinned value exists, or `undefined` to proceed with normal
@@ -353,7 +628,7 @@ class GraphExecutionEngine {
             return undefined;
         const service = this.createPinningService();
         const depFingerprints = this.computeDependencyFingerprints(frame, plan, planNode.id);
-        return service.readPinnedValue(plan.workflow, planNode, inputs, depFingerprints);
+        return service.readPinnedValue(plan.workflowId, planNode, inputs, depFingerprints);
     }
     /**
      * Recursively computes fingerprints for all upstream dependencies of a node
@@ -370,24 +645,25 @@ class GraphExecutionEngine {
                 const depResult = frame.nodeResults.get(dep);
                 const inputs = depResult?.inputs ?? {};
                 const nestedDeps = this.computeDependencyFingerprints(frame, plan, dep);
-                fingerprints[dep] = service.computeFingerprint(plan.workflow, node, inputs, nestedDeps);
+                fingerprints[dep] = service.computeFingerprint(plan.workflowId, node, inputs, nestedDeps);
             }
         }
         return fingerprints;
     }
     /**
-     * Routes a node's outputs to downstream inputs and workflow outputs.
+     * Routes a node's outputs to downstream inputs and workflow outputs along
+     * data edges (connection edges are structural and never route values).
      */
     routeOutgoingEdges(frame, plan, planNode, outputs) {
-        const outgoing = plan.outgoingByNode.get(planNode.id) ?? [];
+        const outgoing = (plan.outgoingByNode.get(planNode.id) ?? []).filter((edge) => edge.type === "data");
         for (const edge of outgoing) {
             const value = outputs[edge.sourcePort];
             if (edge.targetNodeId === constants_js_1.GRAPH_WORKFLOW_BOUNDARY) {
                 frame.valueStore.setWorkflowOutput(edge.targetPort, value);
             }
-            this.emitEdgeStateChanged(frame, plan, planNode, edge, constants_js_2.GraphVisualState.SUCCEEDED, constants_js_2.GraphExecutionStatus.SUCCEEDED);
+            this.emitEdgeStateChanged(frame, plan, planNode, edge, graph_1.GraphVisualState.SUCCEEDED, graph_1.GraphExecutionStatus.SUCCEEDED);
             this.emitEvent(frame, {
-                type: constants_js_2.GraphExecutionEventType.EDGE_VALUE_ROUTED,
+                type: graph_1.GraphExecutionEventType.EDGE_VALUE_ROUTED,
                 runId: frame.runId,
                 workflowId: plan.workflowId,
                 edgeId: edge.id,
@@ -419,7 +695,7 @@ class GraphExecutionEngine {
      */
     emitNodeStateChanged(frame, plan, planNode, nodePath, state, status) {
         this.emitEvent(frame, {
-            type: constants_js_2.GraphExecutionEventType.NODE_STATE_CHANGED,
+            type: graph_1.GraphExecutionEventType.NODE_STATE_CHANGED,
             runId: frame.runId,
             workflowId: plan.workflowId,
             nodeId: planNode.id,
@@ -442,7 +718,7 @@ class GraphExecutionEngine {
      */
     emitEdgeStateChanged(frame, plan, planNode, edge, state, status) {
         this.emitEvent(frame, {
-            type: constants_js_2.GraphExecutionEventType.EDGE_STATE_CHANGED,
+            type: graph_1.GraphExecutionEventType.EDGE_STATE_CHANGED,
             runId: frame.runId,
             workflowId: plan.workflowId,
             edgeId: edge.id,
@@ -478,6 +754,11 @@ class GraphExecutionEngine {
             ...options,
         };
     }
+    assertNotAborted(opts) {
+        if (opts.abortSignal?.aborted === true) {
+            throw new index_js_1.GraphRunCancelledError(opts.runId ?? "unknown");
+        }
+    }
     /**
      * Generates a unique run id.
      */