@flowdrop/flowdrop 1.15.0 → 2.0.0-beta.1

package/dist/services/draftStorage.js

@@ -1,7 +1,8 @@
 /**
  * Draft Storage Service for FlowDrop
  *
- * Handles saving and loading workflow drafts to/from localStorage.
+ * Handles saving and loading workflow drafts to/from browser storage
+ * (localStorage by default, configurable via {@link setDraftStorage}).
  * Provides interval-based auto-save functionality.
  *
  * @module services/draftStorage
@@ -11,6 +12,96 @@ import { logger } from '../utils/logger.js';
  * Default storage key prefix
  */
 const STORAGE_KEY_PREFIX = 'flowdrop:draft';
+/**
+ * Wrap a Web Storage object (localStorage/sessionStorage) as a DraftStorageAdapter.
+ * The storage global is resolved lazily so SSR and test environments that
+ * replace the globals keep working.
+ */
+function createWebStorageAdapter(getStorage) {
+    return {
+        getItem: (key) => getStorage().getItem(key),
+        setItem: (key, value) => getStorage().setItem(key, value),
+        removeItem: (key) => getStorage().removeItem(key),
+        keys: () => {
+            const storage = getStorage();
+            const keys = [];
+            for (let i = 0; i < storage.length; i++) {
+                const key = storage.key(i);
+                if (key !== null) {
+                    keys.push(key);
+                }
+            }
+            return keys;
+        }
+    };
+}
+const WEB_STORAGE_ADAPTERS = {
+    local: createWebStorageAdapter(() => localStorage),
+    session: createWebStorageAdapter(() => sessionStorage)
+};
+/**
+ * Module-level default adapter (localStorage by default).
+ *
+ * Used by the standalone helpers (`saveDraft`, `clearAllDrafts`, ...) when no
+ * explicit adapter is passed, and as the fallback for managers constructed
+ * without a `storage` option. Per-instance code (each `DraftAutoSaveManager`,
+ * each mounted app) captures its own resolved adapter instead, so multiple
+ * FlowDrop instances with different backends do not interfere.
+ */
+let activeAdapter = WEB_STORAGE_ADAPTERS.local;
+/**
+ * Resolve a {@link DraftStorageOption} to a concrete adapter.
+ *
+ * `'local'` / `'session'` map to the built-in Web Storage adapters, a custom
+ * adapter is returned as-is, and `undefined` resolves to the current
+ * module-level default (see {@link setDraftStorage}).
+ */
+export function resolveDraftStorage(option) {
+    if (option === undefined) {
+        return activeAdapter;
+    }
+    return typeof option === 'string' ? WEB_STORAGE_ADAPTERS[option] : option;
+}
+/**
+ * Configure the module-level default for where workflow drafts are persisted.
+ *
+ * - `'local'` (default): `localStorage` — drafts survive reloads and browser
+ *   restarts, and remain stored on the device even after the tab is closed,
+ *   until saved or cleared.
+ * - `'session'`: `sessionStorage` — drafts are scoped to the current tab and
+ *   removed when it closes. Note this also means drafts do not survive a
+ *   crash-and-reopen.
+ * - A custom {@link DraftStorageAdapter} for anything else.
+ *
+ * This sets the default used by the standalone helpers and by managers
+ * constructed without an explicit `storage` option. Mounted apps capture
+ * their own adapter at mount time, so calling this does not retarget
+ * already-running instances. With multiple mounts the most recent mount's
+ * backend wins *for the standalone helpers only*.
+ *
+ * Security note: neither built-in backend protects against same-origin
+ * script access (XSS) — both are readable by any script on the page. If
+ * workflows may contain secrets in node configs, disable drafts via
+ * `features.autoSaveDraft: false` or keep them off-disk with a custom
+ * in-memory adapter.
+ */
+export function setDraftStorage(option) {
+    activeAdapter = resolveDraftStorage(option);
+}
+/**
+ * Get the current module-level default draft storage adapter
+ */
+export function getDraftStorage() {
+    return activeAdapter;
+}
+/**
+ * Storage prefix of the page-default instance (`flowdrop:draft:default`).
+ *
+ * Every instance — including the default — uses an id-scoped prefix since
+ * v2.0. Standalone helper callers that don't pass a prefix get this one, so
+ * they keep addressing the default editor's drafts.
+ */
+export const DEFAULT_INSTANCE_DRAFT_PREFIX = `${STORAGE_KEY_PREFIX}:default`;
 /**
  * Generate a storage key for a workflow
  *
@@ -19,25 +110,58 @@ const STORAGE_KEY_PREFIX = 'flowdrop:draft';
  *
  * @param workflowId - The workflow ID (optional)
  * @param customKey - Custom storage key provided by enterprise (optional)
+ * @param prefix - Key namespace; pass a FlowDrop instance's `storagePrefix`
+ *   to scope drafts per instance. Defaults to the page-default instance's
+ *   prefix.
  * @returns The storage key to use
  */
-export function getDraftStorageKey(workflowId, customKey) {
+export function getDraftStorageKey(workflowId, customKey, prefix = DEFAULT_INSTANCE_DRAFT_PREFIX) {
     if (customKey) {
         return customKey;
     }
     if (workflowId) {
-        return `${STORAGE_KEY_PREFIX}:${workflowId}`;
+        return `${prefix}:${workflowId}`;
     }
-    return `${STORAGE_KEY_PREFIX}:new`;
+    return `${prefix}:new`;
 }
 /**
- * Save a workflow draft to localStorage
+ * One-time migration of a 1.x draft key to its 2.0 scoped equivalent.
+ *
+ * In 1.x the page-default instance stored drafts under the bare
+ * `flowdrop:draft:<workflowId>` key; since 2.0 it uses
+ * `flowdrop:draft:default:<workflowId>`. When the scoped key is empty and the
+ * legacy key holds a draft, the draft is moved (copied, then the legacy key
+ * removed) so users upgrading mid-edit don't lose work.
+ *
+ * @param legacyKey - The 1.x bare-prefix key
+ * @param scopedKey - The 2.0 instance-scoped key
+ * @param storage - Adapter to migrate within (defaults to the module-level default)
+ */
+export function migrateLegacyDraftKey(legacyKey, scopedKey, storage = activeAdapter) {
+    if (legacyKey === scopedKey)
+        return;
+    try {
+        if (storage.getItem(scopedKey) !== null)
+            return;
+        const legacy = storage.getItem(legacyKey);
+        if (legacy === null)
+            return;
+        storage.setItem(scopedKey, legacy);
+        storage.removeItem(legacyKey);
+    }
+    catch (error) {
+        logger.warn('Failed to migrate legacy draft key:', error);
+    }
+}
+/**
+ * Save a workflow draft to draft storage
  *
  * @param workflow - The workflow to save
  * @param storageKey - The storage key to use
+ * @param storage - Adapter to write to (defaults to the module-level default)
  * @returns true if saved successfully, false otherwise
  */
-export function saveDraft(workflow, storageKey) {
+export function saveDraft(workflow, storageKey, storage = activeAdapter) {
     try {
         const draft = {
             workflow,
@@ -47,62 +171,65 @@ export function saveDraft(workflow, storageKey) {
                 workflowName: workflow.name
             }
         };
-        localStorage.setItem(storageKey, JSON.stringify(draft));
+        storage.setItem(storageKey, JSON.stringify(draft));
         return true;
     }
     catch (error) {
-        // localStorage might be full or disabled
-        logger.warn('Failed to save draft to localStorage:', error);
+        // Storage might be full or disabled
+        logger.warn('Failed to save draft to storage:', error);
         return false;
     }
 }
 /**
- * Load a workflow draft from localStorage
+ * Load a workflow draft from draft storage
  *
  * @param storageKey - The storage key to load from
+ * @param storage - Adapter to read from (defaults to the module-level default)
  * @returns The stored draft, or null if not found
  */
-export function loadDraft(storageKey) {
+export function loadDraft(storageKey, storage = activeAdapter) {
     try {
-        const stored = localStorage.getItem(storageKey);
+        const stored = storage.getItem(storageKey);
         if (!stored) {
             return null;
         }
         const draft = JSON.parse(stored);
         // Validate the draft structure
         if (!draft.workflow || !draft.metadata) {
-            logger.warn('Invalid draft structure in localStorage');
+            logger.warn('Invalid draft structure in storage');
             return null;
         }
         return draft;
     }
     catch (error) {
-        logger.warn('Failed to load draft from localStorage:', error);
+        logger.warn('Failed to load draft from storage:', error);
         return null;
     }
 }
 /**
- * Delete a workflow draft from localStorage
+ * Delete a workflow draft from draft storage
  *
  * @param storageKey - The storage key to delete
+ * @param storage - Adapter to delete from (defaults to the module-level default)
  */
-export function deleteDraft(storageKey) {
+export function deleteDraft(storageKey, storage = activeAdapter) {
     try {
-        localStorage.removeItem(storageKey);
+        storage.removeItem(storageKey);
     }
     catch (error) {
-        logger.warn('Failed to delete draft from localStorage:', error);
+        logger.warn('Failed to delete draft from storage:', error);
     }
 }
 /**
  * Check if a draft exists for a given storage key
  *
  * @param storageKey - The storage key to check
+ * @param storage - Adapter to check (defaults to the module-level default)
  * @returns true if a draft exists
  */
-export function hasDraft(storageKey) {
+export function hasDraft(storageKey, storage = activeAdapter) {
     try {
-        return localStorage.getItem(storageKey) !== null;
+        return storage.getItem(storageKey) !== null;
     }
     catch {
         return false;
@@ -114,14 +241,15 @@ export function hasDraft(storageKey) {
  * Useful for displaying draft information without parsing the entire workflow.
  *
  * @param storageKey - The storage key to check
+ * @param storage - Adapter to read from (defaults to the module-level default)
  * @returns Draft metadata, or null if not found
  */
-export function getDraftMetadata(storageKey) {
-    const draft = loadDraft(storageKey);
+export function getDraftMetadata(storageKey, storage = activeAdapter) {
+    const draft = loadDraft(storageKey, storage);
     return draft?.metadata ?? null;
 }
 /**
- * Clear all FlowDrop drafts from localStorage
+ * Clear all FlowDrop drafts from draft storage
  *
  * Removes every key beginning with `flowdrop:draft:`. Intended to be called
  * from a host application's logout handler so workflow drafts do not persist
@@ -130,29 +258,29 @@ export function getDraftMetadata(storageKey) {
  * @param extraKeys - Additional explicit keys to remove. Pass any custom
  *   `draftStorageKey` values configured at mount time so they are cleared
  *   alongside the default-prefixed keys.
+ * @param storage - Adapter to clear (defaults to the module-level default)
  * @returns The number of entries removed.
  */
-export function clearAllDrafts(extraKeys = []) {
+export function clearAllDrafts(extraKeys = [], storage = activeAdapter) {
     try {
         const keysToRemove = new Set();
-        for (let i = 0; i < localStorage.length; i++) {
-            const key = localStorage.key(i);
-            if (key && key.startsWith(`${STORAGE_KEY_PREFIX}:`)) {
+        for (const key of storage.keys()) {
+            if (key.startsWith(`${STORAGE_KEY_PREFIX}:`)) {
                 keysToRemove.add(key);
             }
         }
         for (const key of extraKeys) {
-            if (localStorage.getItem(key) !== null) {
+            if (storage.getItem(key) !== null) {
                 keysToRemove.add(key);
             }
         }
         for (const key of keysToRemove) {
-            localStorage.removeItem(key);
+            storage.removeItem(key);
         }
         return keysToRemove.size;
     }
     catch (error) {
-        logger.warn('Failed to clear drafts from localStorage:', error);
+        logger.warn('Failed to clear drafts from storage:', error);
         return 0;
     }
 }
@@ -175,6 +303,17 @@ export class DraftAutoSaveManager {
     getWorkflow;
     /** Function to check if workflow is dirty */
     isDirty;
+    /**
+     * Runtime gate for draft persistence (e.g. a user-facing opt-out setting).
+     * Checked on every save, so it can change after construction.
+     */
+    isPersistenceAllowed;
+    /**
+     * Storage adapter this instance writes to.
+     * Captured at construction, so a later `setDraftStorage()` call (e.g. from
+     * another FlowDrop mount on the same page) cannot retarget this manager.
+     */
+    storage;
     /** Last saved workflow hash (for change detection) */
     lastSavedHash = null;
     /**
@@ -188,6 +327,8 @@ export class DraftAutoSaveManager {
         this.enabled = options.enabled;
         this.getWorkflow = options.getWorkflow;
         this.isDirty = options.isDirty;
+        this.isPersistenceAllowed = options.isPersistenceAllowed ?? (() => true);
+        this.storage = resolveDraftStorage(options.storage);
     }
     /**
      * Start auto-save interval
@@ -217,7 +358,7 @@ export class DraftAutoSaveManager {
      * @returns true if a draft was saved
      */
     saveIfDirty() {
-        if (!this.enabled) {
+        if (!this.enabled || !this.isPersistenceAllowed()) {
             return false;
         }
         const workflow = this.getWorkflow();
@@ -233,7 +374,7 @@ export class DraftAutoSaveManager {
         if (currentHash === this.lastSavedHash) {
             return false;
         }
-        const saved = saveDraft(workflow, this.storageKey);
+        const saved = saveDraft(workflow, this.storageKey, this.storage);
         if (saved) {
             this.lastSavedHash = currentHash;
         }
@@ -247,11 +388,14 @@ export class DraftAutoSaveManager {
      * @returns true if saved successfully
      */
     forceSave() {
+        if (!this.isPersistenceAllowed()) {
+            return false;
+        }
         const workflow = this.getWorkflow();
         if (!workflow) {
             return false;
         }
-        const saved = saveDraft(workflow, this.storageKey);
+        const saved = saveDraft(workflow, this.storageKey, this.storage);
         if (saved) {
             this.lastSavedHash = this.hashWorkflow(workflow);
         }
@@ -261,7 +405,7 @@ export class DraftAutoSaveManager {
      * Clear the draft from storage
      */
     clearDraft() {
-        deleteDraft(this.storageKey);
+        deleteDraft(this.storageKey, this.storage);
         this.lastSavedHash = null;
     }
     /**
@@ -284,10 +428,14 @@ export class DraftAutoSaveManager {
      */
     updateStorageKey(newKey) {
         // If there's an existing draft with the old key, migrate it
-        const existingDraft = loadDraft(this.storageKey);
+        const existingDraft = loadDraft(this.storageKey, this.storage);
         if (existingDraft && this.storageKey !== newKey) {
-            deleteDraft(this.storageKey);
-            saveDraft(existingDraft.workflow, newKey);
+            deleteDraft(this.storageKey, this.storage);
+            // Migration is still a write — respect the user's opt-out. The old
+            // draft is deleted either way, which is in line with opting out.
+            if (this.isPersistenceAllowed()) {
+                saveDraft(existingDraft.workflow, newKey, this.storage);
+            }
         }
         this.storageKey = newKey;
     }

package/dist/services/dynamicSchemaService.d.ts

@@ -6,6 +6,7 @@
  * @module services/dynamicSchemaService
  */
 import type { ConfigSchema, DynamicSchemaEndpoint, ExternalEditLink, ConfigEditOptions, WorkflowNode } from '../types/index.js';
+import type { EndpointConfig } from '../config/endpoints.js';
 /**
  * Result of a dynamic schema fetch operation
  */
@@ -41,7 +42,7 @@ export interface DynamicSchemaResult {
  * }
  * ```
  */
-export declare function fetchDynamicSchema(endpoint: DynamicSchemaEndpoint, node: WorkflowNode, workflowId?: string): Promise<DynamicSchemaResult>;
+export declare function fetchDynamicSchema(endpointConfig: EndpointConfig | null, endpoint: DynamicSchemaEndpoint, node: WorkflowNode, workflowId?: string): Promise<DynamicSchemaResult>;
 /**
  * Resolves an external edit link URL with template variables.
  *

package/dist/services/dynamicSchemaService.js

@@ -5,7 +5,6 @@
  *
  * @module services/dynamicSchemaService
  */
-import { getEndpointConfig } from './api.js';
 import { DEFAULT_CACHE_TTL_MS } from '../config/constants.js';
 /**
  * Schema cache with TTL support
@@ -137,7 +136,7 @@ function isCacheValid(entry, ttl = DEFAULT_CACHE_TTL) {
  * }
  * ```
  */
-export async function fetchDynamicSchema(endpoint, node, workflowId) {
+export async function fetchDynamicSchema(endpointConfig, endpoint, node, workflowId) {
     // Build the context from the node
     const context = {
         id: node.id,
@@ -163,13 +162,10 @@ export async function fetchDynamicSchema(endpoint, node, workflowId) {
     // Resolve the URL with template variables
     let url = resolveTemplate(endpoint.url, endpoint.parameterMapping, context);
     // If URL is relative, try to prepend base URL from endpoint config
-    if (url.startsWith('/')) {
-        const currentConfig = getEndpointConfig();
-        if (currentConfig?.baseUrl) {
-            // Remove trailing slash from base URL and leading slash from relative URL
-            const baseUrl = currentConfig.baseUrl.replace(/\/$/, '');
-            url = `${baseUrl}${url}`;
-        }
+    if (url.startsWith('/') && endpointConfig?.baseUrl) {
+        // Remove trailing slash from base URL and leading slash from relative URL
+        const baseUrl = endpointConfig.baseUrl.replace(/\/$/, '');
+        url = `${baseUrl}${url}`;
     }
     // Prepare request options
     const method = endpoint.method ?? 'GET';
@@ -179,19 +175,6 @@ export async function fetchDynamicSchema(endpoint, node, workflowId) {
         'Content-Type': 'application/json',
         ...endpoint.headers
     };
-    // Add auth headers from endpoint config if available
-    const currentConfig = getEndpointConfig();
-    if (currentConfig?.auth) {
-        if (currentConfig.auth.type === 'bearer' && currentConfig.auth.token) {
-            headers['Authorization'] = `Bearer ${currentConfig.auth.token}`;
-        }
-        else if (currentConfig.auth.type === 'api_key' && currentConfig.auth.apiKey) {
-            headers['X-API-Key'] = currentConfig.auth.apiKey;
-        }
-        else if (currentConfig.auth.type === 'custom' && currentConfig.auth.headers) {
-            Object.assign(headers, currentConfig.auth.headers);
-        }
-    }
     // Prepare fetch options
     const fetchOptions = {
         method,

package/dist/services/globalSave.d.ts

@@ -7,24 +7,15 @@
  * reimplementing the logic, ensuring "blur active element" flushing and metadata
  * construction happen in exactly one place.
  */
+import { type FlowDropInstance } from '../stores/instanceContainer.svelte.js';
 import type { Workflow } from '../types/index.js';
 import type { FlowDropEventHandlers, FlowDropFeatures } from '../types/events.js';
-/**
- * Minimal interface for the enhanced API client used when an authProvider is present.
- * Matches the surface of EnhancedFlowDropApiClient that save needs.
- */
-export interface SaveApiClient {
-    saveWorkflow(workflow: Workflow): Promise<Workflow>;
-    updateWorkflow(id: string, workflow: Workflow): Promise<Workflow>;
-}
 /**
  * Options accepted by globalSaveWorkflow().
  * All fields are optional — omitting them falls back to the basic behaviour
- * (no event handlers, always show toasts, legacy workflowApi).
+ * (no event handlers, always show toasts).
  */
 export interface GlobalSaveOptions {
-    /** Enhanced API client with authProvider support. Falls back to legacy workflowApi when absent. */
-    apiClient?: SaveApiClient | null;
     /** Event handler hooks (onBeforeSave, onAfterSave, onSaveError, onApiError). */
     eventHandlers?: FlowDropEventHandlers;
     /** Feature flags (showToasts). Defaults to DEFAULT_FEATURES. */
@@ -41,6 +32,11 @@ export interface GlobalSaveOptions {
      * Use this to update draft storage keys or other ID-dependent state.
      */
     onSaved?: (savedWorkflow: Workflow) => void;
+    /**
+     * The FlowDrop instance whose workflow should be saved.
+     * Defaults to the page-default instance when omitted.
+     */
+    instance?: FlowDropInstance;
 }
 /**
  * Options accepted by globalExportWorkflow().
@@ -48,6 +44,11 @@ export interface GlobalSaveOptions {
 export interface GlobalExportOptions {
     /** Feature flags (showToasts). Defaults to DEFAULT_FEATURES. */
     features?: Partial<FlowDropFeatures>;
+    /**
+     * The FlowDrop instance whose workflow should be exported.
+     * Defaults to the page-default instance when omitted.
+     */
+    instance?: FlowDropInstance;
 }
 /**
  * Save the current workflow to the backend.
@@ -59,7 +60,7 @@ export interface GlobalExportOptions {
  *  1. Flush pending form changes (blur active element + tick)
  *  2. Optionally call onBeforeSave — return false cancels the save
  *  3. Build the canonical Workflow object (preserving metadata, format, etc.)
- *  4. Persist via enhanced apiClient or legacy workflowApi
+ *  4. Persist via the instance's API client (fd.api.client)
  *  5. Update the store if the server assigned a new ID
  *  6. Call onMarkAsSaved / onAfterSave hooks
  *  7. Show toast notifications (respecting features.showToasts)