@flowdrop/flowdrop 2.0.0-beta.1 → 2.0.0-beta.2

package/dist/components/playground/PipelinePanel.svelte

@@ -16,12 +16,14 @@
   import { logger } from '../../utils/logger.js';
   import type { Workflow, PipelineViewDef } from '../../types/index.js';
   import type { EndpointConfig } from '../../config/endpoints.js';
+  import type { AuthProvider } from '../../types/auth.js';
   import type { PlaygroundExecution } from '../../types/playground.js';
 
   interface Props {
     pipelineId: string | null;
     workflow: Workflow;
     endpointConfig: EndpointConfig;
+    authProvider?: AuthProvider;
     isPinned: boolean;
     /** All executions for the current session, oldest-first */
     executions?: PlaygroundExecution[];
@@ -39,6 +41,7 @@
     pipelineId,
     workflow,
     endpointConfig,
+    authProvider,
     isPinned,
     executions = [],
     latestExecutionId = null,
@@ -248,14 +251,27 @@
     {#if pipelineId}
       {#key pipelineId}
         {#if viewMode === 'kanban'}
-          <PipelineKanbanView {pipelineId} {workflow} {endpointConfig} {refreshTrigger} />
+          <PipelineKanbanView
+            {pipelineId}
+            {workflow}
+            {endpointConfig}
+            {authProvider}
+            {refreshTrigger}
+          />
         {:else if viewMode === 'table'}
-          <PipelineTableView {pipelineId} {workflow} {endpointConfig} {refreshTrigger} />
+          <PipelineTableView
+            {pipelineId}
+            {workflow}
+            {endpointConfig}
+            {authProvider}
+            {refreshTrigger}
+          />
         {:else if viewMode === 'graph'}
           <PipelineStatus
             {pipelineId}
             {workflow}
             {endpointConfig}
+            {authProvider}
             runLabel={pipelineId}
             {refreshTrigger}
             isEmbedded={true}
@@ -264,7 +280,7 @@
           {@const activeView = extraViews.find((v) => v.key === viewMode)}
           {#if activeView}
             {@const View = activeView.component}
-            <View {pipelineId} {workflow} {endpointConfig} {refreshTrigger} />
+            <View {pipelineId} {workflow} {endpointConfig} {authProvider} {refreshTrigger} />
           {/if}
         {/if}
       {/key}
@@ -277,6 +293,7 @@
         disableSidebar={true}
         mode="locked"
         {endpointConfig}
+        {authProvider}
       />
     {/if}
   </div>

package/dist/components/playground/PipelinePanel.svelte.d.ts

@@ -1,10 +1,12 @@
 import type { Workflow, PipelineViewDef } from '../../types/index.js';
 import type { EndpointConfig } from '../../config/endpoints.js';
+import type { AuthProvider } from '../../types/auth.js';
 import type { PlaygroundExecution } from '../../types/playground.js';
 interface Props {
     pipelineId: string | null;
     workflow: Workflow;
     endpointConfig: EndpointConfig;
+    authProvider?: AuthProvider;
     isPinned: boolean;
     /** All executions for the current session, oldest-first */
     executions?: PlaygroundExecution[];

package/dist/components/playground/PipelineTableView.svelte

@@ -55,15 +55,17 @@
   import { formatMicroseconds } from '../../utils/duration.js';
   import type { Workflow, WorkflowNode } from '../../types/index.js';
   import type { EndpointConfig } from '../../config/endpoints.js';
+  import type { AuthProvider } from '../../types/auth.js';
 
   interface Props {
     pipelineId: string;
     workflow: Workflow;
     endpointConfig: EndpointConfig;
+    authProvider?: AuthProvider;
     refreshTrigger?: number;
   }
 
-  let { pipelineId, workflow, endpointConfig, refreshTrigger = 0 }: Props = $props();
+  let { pipelineId, workflow, endpointConfig, authProvider, refreshTrigger = 0 }: Props = $props();
 
   interface JobRow {
     /** Stable key: job id, or node id for nodes without a job yet */
@@ -85,7 +87,7 @@
 
   // endpointConfig is consumed once to build the API client; it must be stable
   // svelte-ignore state_referenced_locally
-  const fetcher = createPipelineDataFetcher(() => pipelineId, endpointConfig);
+  const fetcher = createPipelineDataFetcher(() => pipelineId, endpointConfig, authProvider);
 
   $effect(() => {
     if (refreshTrigger <= 0) return;

package/dist/components/playground/PipelineTableView.svelte.d.ts

@@ -1,9 +1,11 @@
 import type { Workflow } from '../../types/index.js';
 import type { EndpointConfig } from '../../config/endpoints.js';
+import type { AuthProvider } from '../../types/auth.js';
 interface Props {
     pipelineId: string;
     workflow: Workflow;
     endpointConfig: EndpointConfig;
+    authProvider?: AuthProvider;
     refreshTrigger?: number;
 }
 declare const PipelineTableView: import("svelte").Component<Props, {}, "">;

package/dist/components/playground/Playground.svelte

@@ -17,6 +17,7 @@
   import ControlPanel from './ControlPanel.svelte';
   import type { Workflow } from '../../types/index.js';
   import type { EndpointConfig } from '../../config/endpoints.js';
+  import type { AuthProvider } from '../../types/auth.js';
   import type {
     PlaygroundMode,
     PlaygroundConfig,
@@ -35,6 +36,8 @@
     mode?: PlaygroundMode;
     initialSessionId?: string;
     endpointConfig?: EndpointConfig;
+    /** Auth provider applied to this instance's API requests. */
+    authProvider?: AuthProvider;
     config?: PlaygroundConfig;
     onClose?: () => void;
     onTogglePanel?: () => void;
@@ -49,6 +52,7 @@
     mode = 'standalone',
     initialSessionId,
     endpointConfig,
+    authProvider,
     config = {},
     onClose,
     onTogglePanel,
@@ -126,7 +130,7 @@
   }
 
   onMount(() => {
-    if (endpointConfig) fd.api.configure(endpointConfig);
+    if (endpointConfig) fd.api.configure(endpointConfig, authProvider);
     if (workflow) fd.playground.setWorkflow(workflow);
 
     const handleVisibility = () => {
@@ -134,9 +138,14 @@
         const sessionId = fd.playground.currentSession?.id;
         if (sessionId) {
           void playgroundService
-            .getMessages(fd.api.config, sessionId, {
-              since: playgroundService.getLastSequenceNumber() ?? undefined
-            })
+            .getMessages(
+              fd.api.config,
+              sessionId,
+              {
+                since: playgroundService.getLastSequenceNumber() ?? undefined
+              },
+              fd.api.authProvider
+            )
             .then((response) => fd.playground.applyServerResponse(response, sessionId))
             .catch((err) => logger.error('[Playground] Visibility catchup failed:', err));
         }
@@ -220,7 +229,12 @@
     fd.playground.setError(null);
 
     try {
-      const sessionList = await playgroundService.listSessions(fd.api.config, workflowId);
+      const sessionList = await playgroundService.listSessions(
+        fd.api.config,
+        workflowId,
+        undefined,
+        fd.api.authProvider
+      );
       fd.playground.setSessions(sessionList);
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : 'Failed to load sessions';
@@ -237,7 +251,11 @@
     const token = ++loadToken;
 
     try {
-      const session = await playgroundService.getSession(fd.api.config, sessionId);
+      const session = await playgroundService.getSession(
+        fd.api.config,
+        sessionId,
+        fd.api.authProvider
+      );
       if (token !== loadToken) return; // a newer session load superseded us
       fd.playground.setCurrentSession(session);
 
@@ -245,10 +263,15 @@
       // user scrolls up (loadOlderMessages). Clear right before applying the
       // fresh page — not before the await — so switching sessions doesn't blank
       // the view for the duration of the fetch.
-      const response = await playgroundService.getMessages(fd.api.config, sessionId, {
-        latest: true,
-        limit: messagePageSize
-      });
+      const response = await playgroundService.getMessages(
+        fd.api.config,
+        sessionId,
+        {
+          latest: true,
+          limit: messagePageSize
+        },
+        fd.api.authProvider
+      );
       if (token !== loadToken) return;
       fd.playground.clearMessages();
       fd.playground.applyServerResponse(response, sessionId);
@@ -281,10 +304,15 @@
     if (!sessionId || before === null) return;
 
     try {
-      const response = await playgroundService.getMessages(fd.api.config, sessionId, {
-        before,
-        limit: messagePageSize
-      });
+      const response = await playgroundService.getMessages(
+        fd.api.config,
+        sessionId,
+        {
+          before,
+          limit: messagePageSize
+        },
+        fd.api.authProvider
+      );
       // The session may have changed while the fetch was in flight — don't
       // splice an old session's page into the new session's store.
       if (fd.playground.currentSession?.id !== sessionId) return;
@@ -313,7 +341,13 @@
 
     try {
       const sessionName = `Session ${fd.playground.sessions.length + 1}`;
-      const session = await playgroundService.createSession(fd.api.config, workflowId, sessionName);
+      const session = await playgroundService.createSession(
+        fd.api.config,
+        workflowId,
+        sessionName,
+        undefined,
+        fd.api.authProvider
+      );
 
       // Stop polling the previous (possibly running) session before switching,
       // mirroring handleSelectSession. Otherwise its next poll keeps the old
@@ -349,7 +383,7 @@
 
   async function handleDeleteSession(sessionId: string): Promise<void> {
     try {
-      await playgroundService.deleteSession(fd.api.config, sessionId);
+      await playgroundService.deleteSession(fd.api.config, sessionId, fd.api.authProvider);
       fd.playground.removeSession(sessionId);
 
       if (fd.playground.currentSession?.id === sessionId) {
@@ -377,7 +411,13 @@
     fd.playground.setError(null);
 
     try {
-      const message = await playgroundService.sendMessage(fd.api.config, sessionId, content, {});
+      const message = await playgroundService.sendMessage(
+        fd.api.config,
+        sessionId,
+        content,
+        {},
+        fd.api.authProvider
+      );
       fd.playground.addMessage(message);
       // Only start polling if not already active — avoids resetting the cursor
       // mid-session and re-fetching messages that are already in the store.
@@ -399,7 +439,7 @@
     if (!sessionId) return;
 
     try {
-      await playgroundService.stopExecution(fd.api.config, sessionId);
+      await playgroundService.stopExecution(fd.api.config, sessionId, fd.api.authProvider);
       playgroundService.stopPolling();
       fd.playground.updateSessionStatus('idle');
     } catch (err) {
@@ -425,7 +465,8 @@
       (response) => fd.playground.applyServerResponse(response, sessionId),
       pollingInterval,
       overrideShouldStopPolling ?? config.shouldStopPolling,
-      initialSequenceNumber
+      initialSequenceNumber,
+      fd.api.authProvider
     );
   }
 
@@ -434,9 +475,14 @@
     if (!sessionId || isRefreshing) return;
     isRefreshing = true;
     try {
-      const response = await playgroundService.getMessages(fd.api.config, sessionId, {
-        since: playgroundService.getLastSequenceNumber() ?? undefined
-      });
+      const response = await playgroundService.getMessages(
+        fd.api.config,
+        sessionId,
+        {
+          since: playgroundService.getLastSequenceNumber() ?? undefined
+        },
+        fd.api.authProvider
+      );
       fd.playground.applyServerResponse(response, sessionId);
       if (response.sessionStatus === 'running' && !playgroundService.isPolling()) {
         startPolling(sessionId, true);
@@ -455,9 +501,14 @@
     try {
       // Catch up immediately rather than waiting for the next poll interval.
       // Use the service's sequence cursor so we only fetch new messages.
-      const response = await playgroundService.getMessages(fd.api.config, sessionId, {
-        since: playgroundService.getLastSequenceNumber() ?? undefined
-      });
+      const response = await playgroundService.getMessages(
+        fd.api.config,
+        sessionId,
+        {
+          since: playgroundService.getLastSequenceNumber() ?? undefined
+        },
+        fd.api.authProvider
+      );
       fd.playground.applyServerResponse(response, sessionId);
     } catch (err) {
       logger.error('[Playground] Failed to refresh after interrupt:', err);

package/dist/components/playground/Playground.svelte.d.ts

@@ -1,5 +1,6 @@
 import type { Workflow } from '../../types/index.js';
 import type { EndpointConfig } from '../../config/endpoints.js';
+import type { AuthProvider } from '../../types/auth.js';
 import type { PlaygroundMode, PlaygroundConfig } from '../../types/playground.js';
 import type { FlowDropInstance } from '../../stores/instanceContainer.svelte.js';
 interface Props {
@@ -8,6 +9,8 @@ interface Props {
     mode?: PlaygroundMode;
     initialSessionId?: string;
     endpointConfig?: EndpointConfig;
+    /** Auth provider applied to this instance's API requests. */
+    authProvider?: AuthProvider;
     config?: PlaygroundConfig;
     onClose?: () => void;
     onTogglePanel?: () => void;

package/dist/components/playground/PlaygroundApp.svelte

@@ -15,6 +15,7 @@
   import type { Workflow } from '../../types/index.js';
   import type { FlowDropInstance } from '../../stores/instanceContainer.svelte.js';
   import type { EndpointConfig } from '../../config/endpoints.js';
+  import type { AuthProvider } from '../../types/auth.js';
   import type { PlaygroundConfig } from '../../types/playground.js';
   import type { SettingsCategory } from '../../types/settings.js';
   import type { NavbarAction } from '../../types/navbar.js';
@@ -24,6 +25,8 @@
     workflow?: Workflow;
     mode?: 'standalone' | 'embedded';
     endpointConfig?: EndpointConfig;
+    /** Auth provider applied to this instance's API requests. */
+    authProvider?: AuthProvider;
     config?: PlaygroundConfig;
     showNavbar?: boolean;
     navbarTitle?: string;
@@ -47,6 +50,7 @@
     workflow,
     mode = 'standalone',
     endpointConfig,
+    authProvider,
     config = {},
     showNavbar = true,
     navbarTitle,
@@ -86,6 +90,7 @@
       {workflow}
       {mode}
       {endpointConfig}
+      {authProvider}
       {config}
       {initialSessionId}
       {initialPipelineOpen}

package/dist/components/playground/PlaygroundApp.svelte.d.ts

@@ -1,6 +1,7 @@
 import type { Workflow } from '../../types/index.js';
 import type { FlowDropInstance } from '../../stores/instanceContainer.svelte.js';
 import type { EndpointConfig } from '../../config/endpoints.js';
+import type { AuthProvider } from '../../types/auth.js';
 import type { PlaygroundConfig } from '../../types/playground.js';
 import type { SettingsCategory } from '../../types/settings.js';
 import type { NavbarAction } from '../../types/navbar.js';
@@ -9,6 +10,8 @@ interface Props {
     workflow?: Workflow;
     mode?: 'standalone' | 'embedded';
     endpointConfig?: EndpointConfig;
+    /** Auth provider applied to this instance's API requests. */
+    authProvider?: AuthProvider;
     config?: PlaygroundConfig;
     showNavbar?: boolean;
     navbarTitle?: string;

package/dist/components/playground/PlaygroundModal.svelte

@@ -12,6 +12,7 @@
   import type { Workflow } from '../../types/index.js';
   import type { FlowDropInstance } from '../../stores/instanceContainer.svelte.js';
   import type { EndpointConfig } from '../../config/endpoints.js';
+  import type { AuthProvider } from '../../types/auth.js';
   import type { PlaygroundConfig } from '../../types/playground.js';
   import { m } from '../../messages/index.js';
 
@@ -29,6 +30,8 @@
     initialSessionId?: string;
     /** API endpoint configuration */
     endpointConfig?: EndpointConfig;
+    /** Auth provider applied to this instance's API requests. */
+    authProvider?: AuthProvider;
     /** Playground configuration options */
     config?: PlaygroundConfig;
     /** Per-instance state container — forwarded to the inner Playground */
@@ -43,6 +46,7 @@
     workflow,
     initialSessionId,
     endpointConfig,
+    authProvider,
     config = {},
     instance,
     onClose
@@ -111,6 +115,7 @@
           mode="modal"
           {initialSessionId}
           {endpointConfig}
+          {authProvider}
           {config}
           {onClose}
         />

package/dist/components/playground/PlaygroundModal.svelte.d.ts

@@ -1,6 +1,7 @@
 import type { Workflow } from '../../types/index.js';
 import type { FlowDropInstance } from '../../stores/instanceContainer.svelte.js';
 import type { EndpointConfig } from '../../config/endpoints.js';
+import type { AuthProvider } from '../../types/auth.js';
 import type { PlaygroundConfig } from '../../types/playground.js';
 /**
  * Component props
@@ -16,6 +17,8 @@ interface Props {
     initialSessionId?: string;
     /** API endpoint configuration */
     endpointConfig?: EndpointConfig;
+    /** Auth provider applied to this instance's API requests. */
+    authProvider?: AuthProvider;
     /** Playground configuration options */
     config?: PlaygroundConfig;
     /** Per-instance state container — forwarded to the inner Playground */

package/dist/components/playground/PlaygroundStudio.svelte

@@ -8,6 +8,7 @@
   import { logger } from '../../utils/logger.js';
   import type { Workflow, PipelineViewDef } from '../../types/index.js';
   import type { EndpointConfig } from '../../config/endpoints.js';
+  import type { AuthProvider } from '../../types/auth.js';
   import type { PlaygroundConfig, PlaygroundMode } from '../../types/playground.js';
 
   interface Props {
@@ -17,6 +18,8 @@
     workflow?: Workflow;
     /** API endpoint configuration */
     endpointConfig?: EndpointConfig;
+    /** Auth provider applied to this instance's API requests. */
+    authProvider?: AuthProvider;
     /** Display mode (default: standalone) */
     mode?: PlaygroundMode;
     /** Session ID to activate on mount. Changing this prop remounts the Playground. */
@@ -43,6 +46,7 @@
     workflowId,
     workflow: workflowProp,
     endpointConfig,
+    authProvider,
     mode = 'standalone',
     initialSessionId,
     config = {},
@@ -99,7 +103,7 @@
       fd.pipelinePanel.setOpen(initialPipelineOpen);
     }
     if (endpointConfig) {
-      fd.api.configure(endpointConfig);
+      fd.api.configure(endpointConfig, authProvider);
     }
     if (!workflowProp) {
       void loadWorkflow();
@@ -182,6 +186,7 @@
           pipelineId={activeId}
           workflow={resolvedWorkflow}
           {endpointConfig}
+          {authProvider}
           isPinned={fd.playground.pinnedExecutionId !== null}
           {executions}
           latestExecutionId={fd.playground.latestExecutionId}
@@ -238,6 +243,7 @@
             {workflowId}
             workflow={resolvedWorkflow}
             {endpointConfig}
+            {authProvider}
             {mode}
             {initialSessionId}
             {config}

package/dist/components/playground/PlaygroundStudio.svelte.d.ts

@@ -1,6 +1,7 @@
 import type { FlowDropInstance } from '../../stores/instanceContainer.svelte.js';
 import type { Workflow, PipelineViewDef } from '../../types/index.js';
 import type { EndpointConfig } from '../../config/endpoints.js';
+import type { AuthProvider } from '../../types/auth.js';
 import type { PlaygroundConfig, PlaygroundMode } from '../../types/playground.js';
 interface Props {
     /** Target workflow ID */
@@ -9,6 +10,8 @@ interface Props {
     workflow?: Workflow;
     /** API endpoint configuration */
     endpointConfig?: EndpointConfig;
+    /** Auth provider applied to this instance's API requests. */
+    authProvider?: AuthProvider;
     /** Display mode (default: standalone) */
     mode?: PlaygroundMode;
     /** Session ID to activate on mount. Changing this prop remounts the Playground. */

package/dist/components/playground/pipelineViewUtils.svelte.d.ts

@@ -1,4 +1,5 @@
 import type { EndpointConfig } from '../../config/endpoints.js';
+import type { AuthProvider } from '../../types/auth.js';
 import type { NodeExecutionStatus, KanbanColumnDef } from '../../types/index.js';
 export type NodeStatus = NodeExecutionStatus;
 export interface NodeStatusData {
@@ -40,7 +41,7 @@ export declare function resolveStatus(raw: NodeStatusData | undefined): NodeStat
  * `endpointConfig` is used once to construct the API client — it must be stable.
  * `getPipelineId` is called on every fetch so pipeline ID changes are picked up.
  */
-export declare function createPipelineDataFetcher(getPipelineId: () => string, endpointConfig: EndpointConfig): {
+export declare function createPipelineDataFetcher(getPipelineId: () => string, endpointConfig: EndpointConfig, authProvider?: AuthProvider): {
     readonly nodeStatusMap: Record<string, NodeStatusData>;
     readonly jobs: PipelineJobItem[];
     readonly kanbanConfig: KanbanColumnDef[] | null;

package/dist/components/playground/pipelineViewUtils.svelte.js

@@ -55,8 +55,8 @@ export function resolveStatus(raw) {
  * `endpointConfig` is used once to construct the API client — it must be stable.
  * `getPipelineId` is called on every fetch so pipeline ID changes are picked up.
  */
-export function createPipelineDataFetcher(getPipelineId, endpointConfig) {
-    const client = new EnhancedFlowDropApiClient(endpointConfig);
+export function createPipelineDataFetcher(getPipelineId, endpointConfig, authProvider) {
+    const client = new EnhancedFlowDropApiClient(endpointConfig, authProvider);
     let nodeStatusMap = $state({});
     let jobs = $state([]);
     let kanbanConfig = $state(null);

package/dist/config/endpoints.d.ts

@@ -3,6 +3,7 @@
  * Provides configurable endpoints for all API actions
  */
 import type { AgentSpecEndpointConfig } from './agentSpecEndpoints.js';
+import type { AuthProvider } from '../types/auth.js';
 export interface EndpointConfig {
     /** Base URL for all endpoints */
     baseUrl: string;
@@ -159,3 +160,25 @@ export declare function getEndpointMethod(config: EndpointConfig, endpointKey: s
  * Get custom headers for an endpoint
  */
 export declare function getEndpointHeaders(config: EndpointConfig, endpointKey: string): Record<string, string>;
+/**
+ * Build request headers for an endpoint, layering the auth provider's headers
+ * over the static endpoint headers.
+ *
+ * This is the single header-building path shared by the per-instance services
+ * (playground, chat, interrupt, settings, port config, categories). Routing all
+ * of them through this helper guarantees a configured {@link AuthProvider}
+ * authenticates every request consistently — matching the behaviour of
+ * {@link EnhancedFlowDropApiClient}, which owns the equivalent merge for the
+ * typed workflow/node API.
+ *
+ * `getAuthHeaders()` is awaited per call so providers can return freshly
+ * refreshed tokens. When no provider is supplied the result is identical to
+ * {@link getEndpointHeaders} (no auth) — keeping unauthenticated callers
+ * working unchanged.
+ *
+ * @param config - The endpoint configuration
+ * @param endpointKey - Key identifying the endpoint (for static header lookup)
+ * @param authProvider - Optional auth provider supplying `Authorization` etc.
+ * @returns Merged headers: static endpoint headers < auth headers
+ */
+export declare function getRequestHeaders(config: EndpointConfig, endpointKey: string, authProvider?: AuthProvider): Promise<Record<string, string>>;

package/dist/config/endpoints.js

@@ -141,3 +141,31 @@ export function getEndpointHeaders(config, endpointKey) {
     }
     return baseHeaders;
 }
+/**
+ * Build request headers for an endpoint, layering the auth provider's headers
+ * over the static endpoint headers.
+ *
+ * This is the single header-building path shared by the per-instance services
+ * (playground, chat, interrupt, settings, port config, categories). Routing all
+ * of them through this helper guarantees a configured {@link AuthProvider}
+ * authenticates every request consistently — matching the behaviour of
+ * {@link EnhancedFlowDropApiClient}, which owns the equivalent merge for the
+ * typed workflow/node API.
+ *
+ * `getAuthHeaders()` is awaited per call so providers can return freshly
+ * refreshed tokens. When no provider is supplied the result is identical to
+ * {@link getEndpointHeaders} (no auth) — keeping unauthenticated callers
+ * working unchanged.
+ *
+ * @param config - The endpoint configuration
+ * @param endpointKey - Key identifying the endpoint (for static header lookup)
+ * @param authProvider - Optional auth provider supplying `Authorization` etc.
+ * @returns Merged headers: static endpoint headers < auth headers
+ */
+export async function getRequestHeaders(config, endpointKey, authProvider) {
+    const headers = getEndpointHeaders(config, endpointKey);
+    if (authProvider) {
+        Object.assign(headers, await authProvider.getAuthHeaders());
+    }
+    return headers;
+}

package/dist/core/index.d.ts

@@ -68,7 +68,7 @@ export { computeAutoLayout } from '../adapters/agentspec/autoLayout.js';
 export type { AutoLayoutConfig } from '../adapters/agentspec/autoLayout.js';
 export type { AgentSpecEndpointConfig } from '../config/agentSpecEndpoints.js';
 export { defaultAgentSpecEndpoints, createAgentSpecEndpointConfig, buildAgentSpecUrl, getAgentSpecAuthHeaders } from '../config/agentSpecEndpoints.js';
-export { AgentSpecExecutionService, agentSpecExecutionService } from '../services/agentSpecExecutionService.js';
+export { AgentSpecExecutionService } from '../services/agentSpecExecutionService.js';
 export type { AgentSpecExecutionHandle } from '../services/agentSpecExecutionService.js';
 export { workflowSchema, WORKFLOW_SCHEMA_VERSION } from '../schemas/index.js';
 export type { FlowDropTheme, FlowDropThemeName, FlowDropThemeConfig } from '../types/theme.js';
@@ -77,7 +77,6 @@ export type { FlowDropSkin, FlowDropSkinName, FlowDropSkinTokens } from '../type
 export { slateSkin, defaultSkin } from '../skins/index.js';
 export type { ThemePreference, ResolvedTheme } from '../stores/settingsStore.svelte.js';
 export { getTheme as theme, getResolvedTheme as resolvedTheme, setTheme, toggleTheme, cycleTheme, initializeTheme, isThemeInitialized } from '../stores/settingsStore.svelte.js';
-export { sanitizeHtml } from '../utils/sanitize.js';
 export { logger, setLogLevel, getLogLevel } from '../utils/logger.js';
 export type { LogLevel } from '../utils/logger.js';
 export { computeSwapPreview, computeSwapPreviewWithOptions, executeSwap, mapConfig, getVersionUpgrade, compareSemver, performSwap, validateSwapResult, SwapValidationError } from '../utils/nodeSwap.js';

package/dist/core/index.js

@@ -80,8 +80,8 @@ export { validateForAgentSpecExport, validateAgentSpecFlow } from '../adapters/a
 // Agent Spec auto-layout
 export { computeAutoLayout } from '../adapters/agentspec/autoLayout.js';
 export { defaultAgentSpecEndpoints, createAgentSpecEndpointConfig, buildAgentSpecUrl, getAgentSpecAuthHeaders } from '../config/agentSpecEndpoints.js';
-// Agent Spec execution service
-export { AgentSpecExecutionService, agentSpecExecutionService } from '../services/agentSpecExecutionService.js';
+// Agent Spec execution service (instantiate per instance — no global singleton)
+export { AgentSpecExecutionService } from '../services/agentSpecExecutionService.js';
 // ============================================================================
 // Workflow JSON Schema
 // ============================================================================
@@ -90,10 +90,6 @@ export { defaultTheme, minimalTheme, resolveTheme } from '../themes/index.js';
 export { slateSkin, defaultSkin } from '../skins/index.js';
 export { getTheme as theme, getResolvedTheme as resolvedTheme, setTheme, toggleTheme, cycleTheme, initializeTheme, isThemeInitialized } from '../stores/settingsStore.svelte.js';
 // ============================================================================
-// HTML Sanitization
-// ============================================================================
-export { sanitizeHtml } from '../utils/sanitize.js';
-// ============================================================================
 // Logger
 // ============================================================================
 export { logger, setLogLevel, getLogLevel } from '../utils/logger.js';