@flowdular/sdk 0.2.3 → 0.3.0

package/modules/workflows/src/cli/commands.json

@@ -0,0 +1,17 @@
+{
+	"protocolVersion": 1,
+	"moduleId": "workflows.core",
+	"commands": [
+		{
+			"path": ["workflows", "secrets-rotate"],
+			"capability": {
+				"id": "workflows.secrets.rotate",
+				"version": 1,
+				"summary": "Re-seal stored run payloads with the current encryption key.",
+				"risk": "process",
+				"requiresApprovedSpec": false,
+				"supportsDryRun": true
+			}
+		}
+	]
+}

package/modules/workflows/src/cli/index.ts

@@ -0,0 +1,114 @@
+import {
+	defineCliExtension,
+	type CliExtensionContext,
+} from '@flowdular/sdk/cli-protocol';
+import {
+	DATABASE_CAPABILITY_IDS,
+	DATABASE_DIALECT_IDS,
+	type DatabaseAdapterLease,
+} from '@flowdular/sdk/database';
+import { workflowPayloadCodecFromEnvironment } from '../server/runtime.ts';
+import { migrateWorkflowsDatabase } from '../services/database-repository.ts';
+import { rotateWorkflowPayloads } from '../services/payload-rotation.ts';
+
+const rotateCapability = {
+	id: 'workflows.secrets.rotate',
+	version: 1,
+	summary: 'Re-seal stored run payloads with the current encryption key.',
+	risk: 'process' as const,
+	requiresApprovedSpec: false,
+	supportsDryRun: true,
+};
+
+interface OpenDatabase {
+	readonly leases: readonly DatabaseAdapterLease[];
+	readonly runtime: DatabaseAdapterLease;
+	readonly background: DatabaseAdapterLease;
+}
+
+/* The operator commands read the same deployment database the platform does;
+   there is no module-owned file to open. The runner owns the provider and a
+   module owns no driver, so it arrives on the context. An operator command may
+   be the first thing to touch a fresh database, so it migrates before reading. */
+async function open(context: CliExtensionContext): Promise<OpenDatabase> {
+	const databases = context.databases;
+	if (!databases) {
+		throw new Error(
+			'workflows.core CLI commands read the deployment database, and this workspace has none configured.',
+		);
+	}
+	const requirements = {
+		dialectIds: [DATABASE_DIALECT_IDS.postgresql],
+		capabilities: [DATABASE_CAPABILITY_IDS.TRANSACTIONS],
+	};
+	const migration = await databases.acquire({
+		namespace: 'workflows.core',
+		purpose: 'migration',
+		requirements,
+	});
+	await migrateWorkflowsDatabase(migration.database);
+	const runtime = await databases.acquire({
+		namespace: 'workflows.core',
+		purpose: 'runtime',
+		requirements,
+	});
+	/* The inventory counts payloads across the whole deployment, which only the
+	   cross-tenant read-only role may do. */
+	const background = await databases.acquire({
+		namespace: 'workflows.core',
+		purpose: 'background',
+		requirements,
+	});
+	return { leases: [migration, runtime, background], runtime, background };
+}
+
+/* The provider belongs to the runner; only the leases this command took are
+   released here. */
+async function close(open: OpenDatabase): Promise<void> {
+	for (const lease of open.leases) await lease.release();
+}
+
+export const cliExtension = defineCliExtension({
+	protocolVersion: 1,
+	moduleId: 'workflows.core',
+	commands: [
+		{
+			path: ['workflows', 'secrets-rotate'],
+			capability: rotateCapability,
+			execute: async (context) => {
+				/* The report names key ids and payload counts only; a stored payload
+				   never reaches the command output. */
+				const codec = workflowPayloadCodecFromEnvironment(
+					process.env,
+					context.workspaceRoot,
+				);
+				const opened = await open(context);
+				try {
+					const report = await rotateWorkflowPayloads({
+						runtime: opened.runtime.database,
+						background: opened.background.database,
+						codec,
+						apply: context.apply,
+					});
+					return {
+						data: { moduleId: 'workflows.core', ...report },
+						evidence: [
+							'modules/workflows/spec/module.yaml',
+							'docs/operations.md',
+						],
+						warnings:
+							report.skipped > 0
+								? [
+										`${report.skipped} payloads were rewritten or expired while this ran and keep their own envelope. Run the command again.`,
+									]
+								: [],
+					};
+				} finally {
+					await close(opened);
+				}
+			},
+		},
+	],
+});
+
+export default cliExtension;

package/modules/workflows/src/client/WorkflowExecutionHistory.tsrx

@@ -1,11 +1,12 @@
 import { t } from '@flowdular/sdk/client';
 import {
-	Button,
 	Filters,
+	Pagination,
 	SearchField,
 	TableCard,
 	Tag,
 	type TableColumn,
+	type TableSort,
 } from '@flowdular/sdk/ui';
 import type { WorkflowRunSummary } from '../domain/types.ts';
 import {
@@ -17,18 +18,24 @@ import {
 } from './presentation.ts';
 
 export interface WorkflowExecutionHistoryProps {
+	/** The page the server returned, already narrowed and ordered. */
 	readonly runs: readonly WorkflowRunSummary[];
 	readonly query: string;
+	readonly appliedQuery: string;
 	readonly statusFilter: string;
 	readonly filtersOpen: boolean;
 	readonly loading: boolean;
+	readonly sorting: readonly TableSort[];
+	readonly pageIndex: number;
+	readonly pageSize: number;
 	readonly hasMore: boolean;
 	readonly selectedRunId: string;
 	readonly onQuery: (value: string) => void;
 	readonly onStatusFilter: (value: string) => void;
 	readonly onToggleFilters: () => void;
+	readonly onSorting: (sorts: readonly TableSort[]) => void;
+	readonly onPage: (pageIndex: number) => void;
 	readonly onSelect: (run: WorkflowRunSummary) => void;
-	readonly onLoadMore: () => void;
 }
 
 function columns(): readonly TableColumn<WorkflowRunSummary>[] {
@@ -58,6 +65,7 @@ function columns(): readonly TableColumn<WorkflowRunSummary>[] {
 			key: 'queued',
 			header: t('workflows.history.column.queued'),
 			width: '18%',
+			value: (run) => run.queuedAt,
 			cell: (run) => dateTime(run.queuedAt),
 		},
 		{
@@ -96,29 +104,8 @@ function columns(): readonly TableColumn<WorkflowRunSummary>[] {
 export function WorkflowExecutionHistory(
 	props: WorkflowExecutionHistoryProps,
 ) @{
-	const term = props.query.trim().toLocaleLowerCase();
-	const visible = props.runs.filter(
-		(run) =>
-			(term === '' || run.workflowName.toLocaleLowerCase().includes(term) ||
-				run.workflowKey.toLocaleLowerCase().includes(term) ||
-				run.actor.label.toLocaleLowerCase().includes(term) ||
-				run.id.toLocaleLowerCase().includes(term)) &&
-				(props.statusFilter === '' || run.status === props.statusFilter),
-	);
-	const after =
-		props.hasMore
-			? <div class="workflow-history-more">
-					<Button disabled={props.loading} onClick={props.onLoadMore}>
-						{props.loading
-							? t('workflows.history.loadingMore')
-							: t('workflows.history.loadMore')}
-					</Button>
-				</div>
-			: null;
-
 	<TableCard
 		title={t('workflows.history.title')}
-		count={t('workflows.history.count', { count: props.runs.length })}
 		search={<SearchField
 			value={props.query}
 			placeholder={t('workflows.history.searchPlaceholder')}
@@ -147,11 +134,34 @@ export function WorkflowExecutionHistory(
 		</Filters>}
 		caption={t('workflows.history.caption')}
 		columns={columns()}
-		rows={visible}
+		rows={props.runs}
 		rowKey={(run) => run.id}
-		status={props.loading && props.runs.length === 0 ? 'loading' : 'idle'}
+		mode="server"
+		sorting
+		sortingState={props.sorting}
+		onSortingChange={props.onSorting}
+		pagination={{
+			pageIndex: props.pageIndex,
+			pageSize: props.pageSize,
+			onPageChange: props.onPage,
+			hasMore: props.hasMore,
+		}}
+		after={<Pagination
+			pageIndex={props.pageIndex}
+			pageSize={props.pageSize}
+			hasMore={props.hasMore}
+			onPageChange={props.onPage}
+			label={t('workflows.pagination.label')}
+			previousLabel={t('workflows.pagination.previous')}
+			nextLabel={t('workflows.pagination.next')}
+			summary={(page) => t('workflows.pagination.summary', {
+				page: page.pageIndex + 1,
+				from: page.from,
+			})}
+		/>}
+		status={props.loading ? 'loading' : 'idle'}
 		loadingLabel={t('workflows.history.loading')}
-		filtered={term !== '' || props.statusFilter !== ''}
+		filtered={props.appliedQuery !== '' || props.statusFilter !== ''}
 		empty={{
 			icon: 'activity',
 			title: t('workflows.history.emptyTitle'),
@@ -164,6 +174,5 @@ export function WorkflowExecutionHistory(
 		}}
 		onSelect={props.onSelect}
 		selectedKey={props.selectedRunId}
-		after={after}
 	/>
 }

package/modules/workflows/src/client/WorkflowInspector.tsrx

@@ -6,9 +6,11 @@ import type {
 	WorkflowAgentNodeV1,
 	WorkflowEdgeV1,
 	WorkflowGraphV1,
+	WorkflowHumanApprovalNodeV1,
 	WorkflowNodeFailurePolicyV1,
 	WorkflowNodeV1,
 } from '../domain/types.ts';
+import { WORKFLOW_LIMITS } from '../domain/types.ts';
 import type {
 	WorkflowActionCatalogItem,
 	WorkflowAgentCatalogItem,
@@ -47,6 +49,113 @@ function boundedInteger(
 	return Math.min(maximum, Math.max(minimum, parsed));
 }
 
+/* The whole requirement is pinned into the published graph, so this is where a
+   role that does not exist becomes a publish error rather than a run that
+   pauses on nobody. */
+function ApprovalRequirementEditor(props: {
+	readonly node: WorkflowHumanApprovalNodeV1;
+	readonly editable: boolean;
+	readonly onChange: (node: WorkflowNodeV1) => void;
+}) @{
+	const requirement = props.node.requirement;
+	const replace = (next: WorkflowHumanApprovalNodeV1['requirement']) =>
+		props.onChange({ ...props.node, requirement: next });
+
+	<div class="ui-form__section">
+		<FormField
+			label={t('workflows.inspector.approvalRole')}
+			help={t('workflows.inspector.approvalRoleHelp')}
+		>
+			<input
+				class="ui-input"
+				value={requirement.roleKey ?? ''}
+				maxlength={64}
+				disabled={!props.editable}
+				onInput={(event) => {
+					const value = event.currentTarget.value.trim();
+					const { roleKey: _dropped, ...rest } = requirement;
+					replace(value === '' ? rest : { ...rest, roleKey: value });
+				}}
+			/>
+		</FormField>
+		<FormField
+			label={t('workflows.inspector.approvalScope')}
+			help={t('workflows.inspector.approvalScopeHelp')}
+		>
+			<input
+				class="ui-input"
+				value={requirement.scope ?? ''}
+				maxlength={96}
+				disabled={!props.editable}
+				onInput={(event) => {
+					const value = event.currentTarget.value.trim();
+					const { scope: _dropped, ...rest } = requirement;
+					replace(value === '' ? rest : { ...rest, scope: value });
+				}}
+			/>
+		</FormField>
+		<FormField label={t('workflows.inspector.approvalDecisions')}>
+			<input
+				class="ui-input"
+				type="number"
+				min="1"
+				max={String(WORKFLOW_LIMITS.maxApprovalDecisions)}
+				value={requirement.decisions ?? 1}
+				disabled={!props.editable}
+				onInput={(event) => replace({
+					...requirement,
+					decisions: boundedInteger(
+						event.currentTarget.value,
+						1,
+						WORKFLOW_LIMITS.maxApprovalDecisions,
+					),
+				})}
+			/>
+		</FormField>
+		<FormField label={t('workflows.inspector.approvalExpiryDays')}>
+			<input
+				class="ui-input"
+				type="number"
+				min="1"
+				max={String(WORKFLOW_LIMITS.maxApprovalExpiryDays)}
+				value={requirement.expiresInDays ?? ''}
+				disabled={!props.editable}
+				onInput={(event) => {
+					const raw = event.currentTarget.value.trim();
+					const { expiresInDays: _dropped, ...rest } = requirement;
+					replace(
+						raw === ''
+							? rest
+							: {
+									...rest,
+									expiresInDays: boundedInteger(
+										raw,
+										1,
+										WORKFLOW_LIMITS.maxApprovalExpiryDays,
+									),
+								},
+					);
+				}}
+			/>
+		</FormField>
+		<FormField label={t('workflows.inspector.approvalPrompt')}>
+			<input
+				class="ui-input"
+				value={props.node.prompt ?? ''}
+				maxlength={200}
+				disabled={!props.editable}
+				onInput={(event) => {
+					const value = event.currentTarget.value;
+					const { prompt: _dropped, ...rest } = props.node;
+					props.onChange(
+						value.trim() === '' ? rest : { ...rest, prompt: value },
+					);
+				}}
+			/>
+		</FormField>
+	</div>
+}
+
 function FailurePolicyEditor(props: {
 	readonly node: | WorkflowAgentNodeV1
 	| WorkflowAgentDecisionNodeV1
@@ -362,6 +471,13 @@ export function WorkflowInspector(props: WorkflowInspectorProps) @{
 						onChange={props.onReplaceNode}
 					/>
 				}
+				@if (props.node.type === 'human-approval') {
+					<ApprovalRequirementEditor
+						node={props.node}
+						editable={props.editable}
+						onChange={props.onReplaceNode}
+					/>
+				}
 				@if (props.node.type === 'action') {
 					<ActionReferenceEditor
 						node={props.node}

package/modules/workflows/src/client/WorkflowNodePalette.tsrx

@@ -14,6 +14,7 @@ function icon(type: WorkflowNodeType): string {
 	if (type === 'gate') return 'shield';
 	if (type === 'validator') return 'check';
 	if (type === 'action') return 'plug';
+	if (type === 'human-approval') return 'user';
 	if (type === 'input') return 'download';
 	if (type === 'output') return 'external';
 	return 'modules';