@flowdular/sdk 0.2.4 → 0.3.1

package/modules/users/translations/pl.json

@@ -19,6 +19,10 @@
 	"invite.sending": "Wysyłanie…",
 	"invite.sent": "Zaproszenie wysłano na {email}.",
 	"invite.error": "Nie udało się wysłać zaproszenia.",
+	"export.action": "Eksportuj CSV",
+	"export.started": "Eksport członków wystartował. Pojawi się na ekranie Eksporty, gdy plik będzie gotowy.",
+	"export.link": "Otwórz Eksporty",
+	"export.error": "Nie udało się rozpocząć eksportu.",
 	"action.manage": "Zarządzaj",
 	"action.cancel": "Anuluj",
 	"action.close": "Zamknij",
@@ -31,10 +35,11 @@
 	"denied.members": "Odczyt katalogu użytkowników wymaga uprawnienia users.members.read.",
 	"table.title": "Członkowie",
 	"table.caption": "Użytkownicy przestrzeni roboczej",
-	"table.count": "Właściciele: {owners} · konta: {accounts}",
+	"table.count": "Konta: {accounts}",
 	"table.user": "Użytkownik",
+	"table.email": "E-mail",
 	"table.role": "Rola",
-	"table.status": "Status",
+	"table.status": "Dostęp do przestrzeni",
 	"table.scopes": "Zakresy",
 	"table.actions": "Akcje użytkownika",
 	"table.loading": "Wczytywanie kont…",
@@ -42,11 +47,36 @@
 	"table.emptyHint": "Utwórz pierwsze konto w tej przestrzeni roboczej.",
 	"table.emptyFilteredTitle": "Brak pasujących kont",
 	"table.emptyFilteredHint": "Żadne konto w tej przestrzeni nie pasuje do bieżącego filtra.",
+	"selection.label": "Zaznacz wszystkich członków na ekranie",
+	"selection.rowLabel": "Zaznacz {name}",
+	"selection.clear": "Wyczyść zaznaczenie",
+	"selection.summary": "Zaznaczono: {count}",
+	"action.deactivateSelected": "Dezaktywuj zaznaczonych",
+	"action.assignRoleSelected": "Przypisz rolę",
+	"action.bulkRefused": "Zaznacz co najmniej jednego członka innego niż Ty.",
+	"deactivateMany.title": "Dezaktywować zaznaczonych członków?",
+	"deactivateMany.description": "Liczba członków tracących dostęp do tej przestrzeni: {count}. Ich sesje i tokeny API w tej przestrzeni zostaną unieważnione, a inne przestrzenie pozostaną bez zmian.",
+	"roleMany.title": "Przypisz rolę zaznaczonym członkom",
+	"roleMany.description": "Rola zastąpi zakresy członków w liczbie {count}.",
+	"notice.deactivatedMany": "Dezaktywowano {updated}, brak {missing}, odrzucono {refused}.",
+	"notice.roleAssignedMany": "Rolę przypisano {updated}, brak {missing}, odrzucono {refused}.",
+	"error.deactivateMany": "Nie udało się dezaktywować zaznaczonych członków.",
+	"error.roleMany": "Nie udało się przypisać roli zaznaczonym członkom.",
+	"common.messages": "Komunikaty",
 	"table.note": "Role określają dostęp kont. Właściciele zarządzają przestrzenią roboczą, a każda pozostała rola ma dokładnie podane zakresy.",
-	"search.placeholder": "Filtruj po nazwie lub adresie e-mail",
+	"search.placeholder": "Zaczyna się od nazwy lub adresu e-mail",
 	"search.label": "Filtruj członków",
+	"filter.label": "Filtry",
+	"filter.status": "Dostęp do przestrzeni",
+	"filter.allStatuses": "Wszystkie",
+	"pagination.label": "Strony listy członków",
+	"pagination.previous": "Poprzednia",
+	"pagination.next": "Następna",
+	"pagination.size": "Członków na stronie",
+	"pagination.summary": "Strona {page} · od członka {from}",
 	"status.active": "Aktywne",
 	"status.disabled": "Wyłączone",
+	"status.blocked": "Blokada operatora",
 	"status.passwordResetPending": "Oczekuje na zmianę hasła",
 	"drawer.newTitle": "Nowe konto",
 	"drawer.newSubtitle": "Bezpośredni dostęp do przestrzeni roboczej",
@@ -68,28 +98,47 @@
 	"member.saveName": "Zapisz nazwę",
 	"member.roleDescription": "Rola ustawia poniższe zakresy. Role niestandardowe są dostępne na ekranie Role.",
 	"member.assignRole": "Przypisz rolę",
+	"member.access": "Dostęp do tej przestrzeni roboczej",
+	"member.accessDescription": "Włącza lub wyłącza to członkostwo. Nie zmienia innych przestrzeni roboczych tej osoby ani jej konta.",
+	"membership.active": "Aktywny w tej przestrzeni",
+	"membership.disabled": "Wyłączony w tej przestrzeni",
+	"membership.reasonActive": "Członek normalnie loguje się do tej przestrzeni roboczej. Pozostałe przestrzenie pozostają bez zmian.",
+	"membership.reasonDisabled": "Logowanie do tej przestrzeni roboczej jest odrzucane, a jej sesje i tokeny API zostały unieważnione. Pozostałe przestrzenie działają dalej.",
+	"membership.disable": "Wyłącz dostęp",
+	"membership.confirmTitle": "Wyłączyć dostęp dla {name}?",
+	"membership.confirmDescription": "Sesje i tokeny API tej przestrzeni roboczej zostaną natychmiast unieważnione, a logowanie tutaj odrzucone. Pozostałe przestrzenie pozostaną nietknięte. Ponowne włączenie przywraca logowanie, ale nie unieważnione tokeny.",
+	"membership.error": "Nie udało się zmienić dostępu do przestrzeni roboczej.",
+	"membership.errorSelf": "Nie możesz zmienić własnego dostępu do tej przestrzeni roboczej. Poproś innego właściciela.",
+	"membership.errorLastOwner": "To ostatni aktywny właściciel przestrzeni roboczej. Najpierw nadaj rolę właściciela innemu członkowi.",
+	"membership.errorOwnerRequired": "Tylko właściciel może zmienić dostęp innego właściciela do tej przestrzeni roboczej.",
+	"membership.errorNotFound": "Tego członka nie ma już w przestrzeni roboczej. Odśwież listę.",
 	"member.account": "Konto",
-	"member.accountDescription": "Wyłączenie natychmiast kończy wszystkie sesje i blokuje logowanie.",
-	"member.disable": "Wyłącz konto",
-	"member.enable": "Włącz konto",
+	"member.accountDescription": "Globalny stan konta, którym zarządza operator. Wylogowanie kończy wszystkie sesje tego konta, we wszystkich przestrzeniach roboczych.",
+	"member.accountReadOnly": "Zablokowanie lub odblokowanie konta to działanie operatora wdrożenia i nie można go wykonać tutaj. Aby odebrać dostęp do tej przestrzeni roboczej, użyj przełącznika powyżej.",
 	"member.signOutEverywhere": "Wyloguj ze wszystkich urządzeń",
 	"member.temporaryPassword": "Hasło tymczasowe",
 	"member.temporaryPasswordHelp": "Co najmniej {min} znaków. Członek ustawi nowe hasło przy następnym logowaniu.",
 	"member.resetPassword": "Zresetuj hasło",
+	"member.mfa": "Uwierzytelnianie wieloskładnikowe",
+	"member.mfaDescription": "Usuń zarejestrowaną aplikację uwierzytelniającą, gdy członek utraci urządzenie. Członek rejestruje ją ponownie w ustawieniach bezpieczeństwa konta.",
+	"member.resetMfa": "Zresetuj MFA",
 	"member.removeTitle": "Usuń z przestrzeni roboczej",
 	"member.removeDescription": "Kończy członkostwo wraz z sesjami i tokenami. Konto pozostaje, jeśli należy do innej przestrzeni roboczej.",
 	"member.remove": "Usuń członka",
 	"notice.nameSaved": "Zapisano nazwę wyświetlaną.",
 	"notice.roleAssigned": "Przypisano rolę.",
 	"notice.scopesSaved": "Zapisano zakresy.",
-	"notice.accountDisabled": "Konto zostało wyłączone.",
-	"notice.accountEnabled": "Konto zostało włączone.",
+	"notice.membershipDisabled": "Wyłączono dostęp do tej przestrzeni roboczej.",
+	"notice.membershipEnabled": "Włączono dostęp do tej przestrzeni roboczej.",
 	"notice.passwordSet": "Ustawiono hasło tymczasowe. Członek musi zmienić je przy logowaniu.",
+	"notice.mfaReset": "Uwierzytelnianie wieloskładnikowe zostało wyczyszczone. Członek musi zarejestrować je ponownie.",
 	"notice.sessionsCount": "Zakończone sesje: {count}.",
 	"notice.sessionsEnded": "Sesje zostały zakończone.",
 	"remove.title": "Usunąć tego członka?",
 	"remove.fallbackName": "Ten członek",
 	"remove.description": "{name} natychmiast utraci dostęp do tej przestrzeni roboczej. Sesje i tokeny API tego członkostwa zostaną unieważnione.",
+	"mfaReset.title": "Zresetować uwierzytelnianie wieloskładnikowe?",
+	"mfaReset.description": "{name} utraci zarejestrowaną aplikację uwierzytelniającą oraz wszystkie kody odzyskiwania i musi zarejestrować ją ponownie przed kolejnym logowaniem wymagającym drugiego składnika.",
 	"roles.title": "Role",
 	"roles.description": "Role wbudowane i niestandardowe wraz z dokładnymi zakresami uprawnień.",
 	"roles.new": "Nowa rola",

package/modules/workflows/migrations/0004_payload_rotation_inventory.up.sql

@@ -0,0 +1,17 @@
+-- The rotation command has to find the payloads still sealed with a retired key
+-- before it knows whose they are. The retention sweep sees only payloads with an
+-- expiry; a rotation covers every live one, so it reads under a policy of its
+-- own and is granted the key id alone. The ciphertext stays unreadable on this
+-- connection, and every payload it re-seals is read again under the tenant that
+-- row named.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coreloom_background') THEN
+    RAISE EXCEPTION 'The coreloom_background role must exist before this migration.';
+  END IF;
+END
+$$;
+CREATE POLICY workflow_payloads_rotation_policy ON workflow_payloads
+  FOR SELECT TO coreloom_background
+  USING (kind = 'execution');
+GRANT SELECT (encryption_key_id) ON workflow_payloads TO coreloom_background;

package/modules/workflows/migrations/0005_workflows_human_approval.up.sql

@@ -0,0 +1,28 @@
+-- A run waiting on a person waits for days, not for the seconds an agent or an
+-- action takes. Leaving it in 'running' would keep it at the head of the claim
+-- queue, where it would be re-claimed every poll and, because the queue is
+-- ordered by queued_at, would starve every run queued after it.
+--
+-- 'waiting-approval' is the status that takes such a run out of the queue. It
+-- comes back when approvals.core calls back, which sets the node's
+-- next_attempt_at to now, or when the recheck the node armed falls due; the
+-- claim predicate reads that column exactly as it already does for a retry.
+--
+-- The approval itself is the third child kind. It reuses the attempt's
+-- waiting-child machinery, so the request id is stored in child_id and recovery
+-- after a restart finds the open request instead of opening a second one.
+ALTER TABLE workflow_runs DROP CONSTRAINT IF EXISTS workflow_runs_status_check;
+ALTER TABLE workflow_runs ADD CONSTRAINT workflow_runs_status_check
+  CHECK (status IN ('queued', 'running', 'waiting-agent', 'waiting-approval', 'waiting-retry', 'cancel-requested', 'succeeded', 'failed', 'refused', 'cancelled'));
+ALTER TABLE workflow_node_attempts DROP CONSTRAINT IF EXISTS workflow_node_attempts_child_kind_check;
+ALTER TABLE workflow_node_attempts ADD CONSTRAINT workflow_node_attempts_child_kind_check
+  CHECK (child_kind IN ('agent', 'action', 'approval'));
+-- The claim poll has to see that a node is asleep on an approval before it can
+-- decide whether the run is due, and the cross-tenant policy showed it retries
+-- only. It is widened to the second waiting state and no further: the four
+-- routing columns it was already granted stay the whole of what it can read,
+-- and the run is read again under its own tenant before anything is written.
+DROP POLICY IF EXISTS workflow_node_states_background_policy ON workflow_node_states;
+CREATE POLICY workflow_node_states_background_policy ON workflow_node_states
+  FOR SELECT TO coreloom_background
+  USING (status IN ('waiting-retry', 'waiting-child'));

package/modules/workflows/migrations/0006_workflows_retention_indexes.up.sql

@@ -0,0 +1,11 @@
+-- The retention sweep of workflows.core.runs asks one workspace for its oldest
+-- settled runs, and a subject erasure asks it for the runs one account
+-- requested. Both are bounded batches, so both need a range scan rather than a
+-- pass over the workspace's runs. The requester lives inside the stored actor
+-- document, so the index is over that one field of it; the export walks the
+-- order workflow_runs_tenant_queue_idx already carries and needs no index of
+-- its own.
+CREATE INDEX IF NOT EXISTS workflow_runs_tenant_settled_idx
+  ON workflow_runs (tenant_id, completed_at);
+CREATE INDEX IF NOT EXISTS workflow_runs_tenant_requester_idx
+  ON workflow_runs (tenant_id, (actor_json::jsonb ->> 'id'), id);

package/modules/workflows/migrations/0007_workflows_erasure_subject_indexes.up.sql

@@ -0,0 +1,17 @@
+-- A subject erasure asks one workspace for the runs a person is behind, and
+-- that is three questions rather than one: the runs the person started, the
+-- runs a service actor they configured started, and the runs an agent started
+-- on their behalf. 0006 indexed the first, which is the only one held in the
+-- actor's own id. These give the other two the same support.
+-- Neither is reachable from the connection the erasure runs on, and 0006's is
+-- not either. The jsonb extraction operator is not leakproof, so under the
+-- forced row level security policy PostgreSQL applies the policy first and the
+-- comparison stays a filter rather than an index condition: measured over
+-- 20000 runs, the runtime role scans the workspace while the migration role
+-- uses the index. The batch limit is what bounds an erasure until the subject
+-- account is stored in a column of its own, which compares leakproof and
+-- indexes plainly; that column is the precise fix and it retires all three.
+CREATE INDEX IF NOT EXISTS workflow_runs_tenant_configured_by_idx
+  ON workflow_runs (tenant_id, (actor_json::jsonb -> 'configuredBy' ->> 'id'), id);
+CREATE INDEX IF NOT EXISTS workflow_runs_tenant_subject_idx
+  ON workflow_runs (tenant_id, (authorization_subject_json::jsonb ->> 'id'), id);

package/modules/workflows/migrations/0008_workflows_subject_account.up.sql

@@ -0,0 +1,24 @@
+-- The person behind a run, resolved once at write time instead of read out of
+-- the stored actor document on every erasure. A run started by a person names
+-- them in its actor, a run started by a schedule, a webhook or an automation
+-- names them in the service actor's configuredBy, and a run an agent started
+-- names them in the delegated authorization subject; this column is that one
+-- answer, and the three predicates it replaces become a single equality.
+-- This supersedes the expression indexes of 0006 and 0007, which the erasure
+-- cannot use: the jsonb extraction operator is not leakproof, so under the
+-- forced row level security policy PostgreSQL applies the policy first and the
+-- comparison can never become an index condition. A plain text column compares
+-- leakproof and indexes normally, so the same query becomes an index scan on
+-- the connection the erasure actually runs on. Both older indexes stay because
+-- an applied migration is immutable; they are dead weight, not a hazard.
+ALTER TABLE workflow_runs
+  ADD COLUMN subject_account_id TEXT;
+UPDATE workflow_runs
+SET subject_account_id = COALESCE(
+  actor_json::jsonb -> 'configuredBy' ->> 'id',
+  authorization_subject_json::jsonb ->> 'id',
+  actor_json::jsonb ->> 'id'
+)
+WHERE subject_account_id IS NULL;
+CREATE INDEX IF NOT EXISTS workflow_runs_tenant_subject_account_idx
+  ON workflow_runs (tenant_id, subject_account_id, id);

package/modules/workflows/migrations/0009_workflows_definition_list_indexes.up.sql

@@ -0,0 +1,9 @@
+-- The definitions screen pages by keyset over the order it shows, by name or by
+-- last update, each ending in the id. 0001 indexed (tenant_id, name, id), which
+-- serves neither an ORDER BY over lower(name) nor one over updated_at, so both
+-- orders walked the workspace's rows and sorted them. These two carry each
+-- order the way the page reads it.
+CREATE INDEX IF NOT EXISTS workflow_definitions_tenant_lower_name_idx
+  ON workflow_definitions (tenant_id, lower(name), id);
+CREATE INDEX IF NOT EXISTS workflow_definitions_tenant_updated_idx
+  ON workflow_definitions (tenant_id, updated_at, id);

package/modules/workflows/module.json

@@ -3,9 +3,16 @@
 	"schemaVersion": 1,
 	"id": "workflows.core",
 	"package": "@flowdular/module-workflows",
-	"version": "0.3.0",
+	"version": "0.6.7",
 	"profile": "full",
-	"capabilities": ["api", "database", "client", "translations", "integration"],
+	"capabilities": [
+		"api",
+		"database",
+		"client",
+		"translations",
+		"integration",
+		"cli"
+	],
 	"platform": {
 		"server": true,
 		"client": true
@@ -13,19 +20,40 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "0.5.0"
+			"range": "^0.7.0"
 		},
 		{
 			"id": "auth.core",
-			"range": "0.10.0"
+			"range": "^0.13.0"
 		},
 		{
 			"id": "agents.core",
-			"range": "0.9.1"
+			"range": "^0.12.0"
+		}
+	],
+	"provides": ["workflows.execution.v1"],
+	"requires": [
+		{
+			"id": "agents.run-execution.v2"
+		},
+		{
+			"id": "agents.actions.v1"
+		},
+		{
+			"id": "notifications.publish.v1",
+			"optional": true
+		},
+		{
+			"id": "approvals.requests.v1",
+			"optional": true
 		}
 	],
 	"tenancy": "required",
 	"locales": ["en", "pl"],
 	"stability": "experimental",
-	"platformApi": "0.1.0"
+	"cli": {
+		"catalog": "src/cli/commands.json",
+		"entry": "src/cli/index.ts"
+	},
+	"platformApi": "^0.1.0"
 }

package/modules/workflows/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/module-workflows",
-	"version": "0.3.0",
+	"version": "0.6.7",
 	"type": "module",
 	"exports": {
 		".": "./src/index.ts",
@@ -14,6 +14,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
+		"@flowdular/cli-protocol": "workspace:*",
 		"@flowdular/client": "workspace:*",
 		"@flowdular/contracts": "workspace:*",
 		"@flowdular/database": "workspace:*",

package/modules/workflows/spec/module.yaml

@@ -1,6 +1,6 @@
 schemaVersion: 1
 id: workflows.core
-specVersion: 0.3.0
+specVersion: 0.6.7
 status: approved
 name: Agentic Workflows
 description: Builds, publishes, simulates, and executes durable tenant-scoped DAG workflows whose versioned nodes coordinate pinned agents, deterministic decisions, validated data, and registered module actions.
@@ -11,13 +11,14 @@ capabilities:
   - client
   - translations
   - integration
+  - cli
 dependencies:
   - id: system.core
-    range: 0.5.0
+    range: ^0.7.0
   - id: auth.core
-    range: 0.10.0
+    range: ^0.13.0
   - id: agents.core
-    range: 0.9.1
+    range: ^0.12.0
 tenancy: required
 locales:
   - en
@@ -31,12 +32,13 @@ invariants:
   - A workflow definition grants no authority. Live execution intersects the immutable node plan with the initiating actor's trusted permission snapshot and every referenced agent or action permission.
   - Manual and module-originated runs retain the real user or agent actor. Schedule and webhook runs retain a service actor with the configuring user snapshot, while trigger kind and identifier remain separate execution-origin fields.
   - Graph configuration contains declarative typed literal, path, and template mappings only. Arbitrary JavaScript, expressions with side effects, source code, shell commands, dynamic imports, and runtime-downloaded code are forbidden.
-  - Input, output, agent-decision, gate, validator, action, merge, and terminal output nodes communicate only through declared, schema-bound ports and immutable JSON envelopes.
+  - Input, output, agent-decision, gate, validator, action, human-approval, merge, and terminal output nodes communicate only through declared, schema-bound ports and immutable JSON envelopes.
   - An agent-decision node must return a schema-valid pass or fail decision with bounded structured data. Free-form text never decides a branch.
   - Deterministic gate nodes use a versioned allowlisted logic language. Agentic judgment is represented by an explicit agent-decision node, never hidden inside a gate.
   - A validator node emits pass only for data that satisfies its pinned schema and emits bounded structured validation errors on fail.
+  - A human-approval node declares its requirement in the published graph and is validated against the workspace roles at publish time; an unknown role or an absent approvals.core refuses publication with a stable code. At run time the node opens one request through approvals.requests.v1 keyed by the run and node, takes the run out of the claim queue until the request resolves or its bounded recheck falls due, resumes on approval, and fails the run with a stable code on rejection, expiry or cancellation. Whenever the run stops waiting for a pending request, whether the run is cancelled, the request's deadline passes, or the run's duration bound is reached, the request is withdrawn rather than left asking people to decide something nobody is waiting for. A simulated run approves without asking anybody. The prompt the node asks and its label are bounded at validation and publication by the limits approvals.core accepts for a request title, so a question that module would refuse fails the publish rather than the run that reaches the node.
   - An action node invokes only a registered, versioned action contract through agents.core, under the required permissions, input schema, timeout, output bound, idempotency key, and audit boundary.
-  - Version one admits only read and workspace-write actions. External and destructive actions are excluded from the workflow catalog, publication, and execution until a later approved human-approval and approval-receipt contract exists.
+  - Version one admits only read and workspace-write actions. External and destructive actions stay excluded from the workflow catalog, publication, and execution; the human-approval node gates a person's decision and never widens the action risk class.
   - Each live workflow run durably snapshots its workflow revision, actor, origin, permission digest, mode, input, limits, and idempotency key before enqueue returns.
   - Workflow workers claim runs with expiring leases, renew live claims, and recover queued or expired work after restart without concurrently owning the same run.
   - A node runs at most once successfully. Retries create immutable attempts and reuse a stable side-effect idempotency key so recovery cannot duplicate an agent enqueue or action mutation.
@@ -54,12 +56,14 @@ invariants:
   - Automated payload retention may remove separately stored payload blobs only after appending a retention event. Run identity, status, revisions, attempts, durations, cost, hashes, and audit linkage remain queryable.
   - Capability absence is detected through the platform registry returning null. A caller hides its optional workflow feature or refuses clearly before invocation; no absent module can return its own unavailable result.
   - automations.core remains a separate optional clock and ingress module. It may trigger workflows through an integration capability but workflows.core owns no schedules, webhook secrets, or polling clock.
-  - A live run is bounded by graph size, payload size, node attempts, total duration, and lineage depth. Cross-workflow invocation and cycles between workflows are not supported in version one.
-  - Interactive history and audit pages use opaque versioned cursors bound to tenant, filters, sort order, and the first-page snapshot boundary. Malformed, foreign, or mismatched cursors are refused instead of being interpreted loosely.
+  - A live run is bounded by graph size, payload size, node attempts, total duration, and lineage depth. Cross-workflow invocation and cycles between workflows are not supported in version one. The total duration bound counts the time the run could work; time asleep on a human approval is excluded from it and bounded by that request's own expiry instead, so a person's window is never a run's.
+  - Interactive definition, history and audit lists are keyset pages of at most 100 rows over an indexed sort key (definitions by name or last update, runs by queued time, audit by sequence or time), read through opaque signed cursors bound to the tenant, the filters and the sort order. Malformed, foreign, or mismatched cursors are refused instead of being interpreted loosely.
   - Usage and cost use a versioned typed rollup with integer token counts, integer micro-USD amounts, pricing snapshot references, provisional or final state, and explicit unpriced child and action counts. Dry-run has no rollup and simulation uses not-applicable rollups.
   - Every state transition named as audit-required commits its run event, projection update, and hash-chained workflow audit event atomically. Edge data events remain ordered run evidence unless their transition also changes audited execution state.
   - Every request-time read and write runs on a tenant-scoped database handle. The worker claim poll and payload retention are the only cross-tenant reads, they run on a separate read-only role, and on PostgreSQL that role is granted only the columns that route the work under a policy of each table itself.
+  - Run outcome notifications are an optional integration. When a live run reaches a terminal state the worker resolves notifications.publish.v1 from the platform capability registry at that moment, never at composition time, and publishes the outcome keyed by the run id. notifications.core is never a declared dependency. An absent capability, a cancelled run, a simulated run, and a run with no person behind it publish nothing. A publisher failure is logged once at warning level and never changes the settled run, and the kind is read from the settled row so a worker that lost the settling race reports the outcome the run actually has.
   - A run found by the cross-tenant claim poll is read again and re-checked under the tenant that row named before it is claimed, and payload retention performs each redaction in its own transaction under the tenant that owns it.
+  - workflows.core declares three data classes to the platform registry while it composes, and performs their operations itself on its own leases under its own tenant transaction. workflows.core.runs holds the run record, its node states and attempts, its edge evidence, its ordered events and its sealed execution payloads, keeps them 90 days by default, sweeps only settled runs in bounded batches so a run still working, waiting on a child or asleep on an approval is never taken from its worker, exports one workspace by keyset in bounded pages, and erases in bounded batches the runs one account is the person behind, reporting a full batch as truncated. The person behind a run is the actor when a person started it, the account the actor was configured by when a schedule, a webhook or an automation started it, and the delegated authorization subject when an agent did, and the erasure matches all three so a run started on somebody's behalf is not left holding their account. A run resolves that person once when it is written and stores the answer, so an erasure is one indexed equality rather than a read of the stored actor document, which the forced row-level security policy would leave unindexable. workflows.core.audit-events is exportable and is kept until a person deletes it, because the trail is hash chained and removing its oldest links by age would make the next verification report a break it cannot tell from tampering. workflows.core.definitions is workspace configuration, is kept until a person deletes it and carries no sweep, and exports the published revision of each workflow alone. No export carries a sealed execution payload, because the archive carries the redacted evidence the run already recorded.
 permissions:
   - id: workflows.definitions.read
     description: Read workflow definitions, drafts, published revisions, and validation reports in the active tenant.
@@ -80,6 +84,7 @@ dataOwnership:
   - Business modules own their records and service operations. An action node can reach them only through a registered action contract and never through their repositories or databases.
   - auth.core owns accounts, memberships, sessions, scopes, and authorization evidence. Workflows stores the bounded invocation snapshot needed for durable execution, not credentials or session tokens.
   - automations.core owns schedules, webhook definitions, trigger secrets, and ingress audit. A triggered workflow stores only the service actor, configuring user snapshot, origin kind, and source reference.
+  - notifications.core owns inbox items, deliveries, and read state. workflows.core owns the run it reports and hands over only the run id, the outcome kind, a bounded English title and step summary, and the accountable member; it never writes or reads notification records and never receives them back.
 acceptanceScenarios:
   - id: WORKFLOW-CREATE
     given: A principal with workflow definition management permission supplies a valid name and empty draft graph.
@@ -164,7 +169,7 @@ acceptanceScenarios:
   - id: WORKFLOW-HISTORY
     given: The tenant has workflow runs in queued, intermediate, refused, cancelled, failed, and succeeded states.
     when: An authorized reader filters and pages run history.
-    then: Results are tenant-scoped, ordered by queued time and run id descending, and paged with an opaque versioned cursor bound to tenant, filters, sort, and the first-page snapshot boundary, while malformed, foreign, or mismatched cursors are refused and payload absence never changes row positions.
+    then: Results are tenant-scoped, ordered by queued time and run id descending unless the reader asks for the ascending order, and paged at most 100 runs at a time with an opaque cursor bound to tenant, filters and sort, while malformed, foreign, or mismatched cursors are refused and payload absence never changes row positions.
   - id: WORKFLOW-NODE-HISTORY
     given: A run contains retries, branching, skipped nodes, child agents, and actions.
     when: An authorized reader opens the run.
@@ -221,7 +226,19 @@ acceptanceScenarios:
     given: A graph, mapping, input, output, fixture, retry policy, runtime, or lineage exceeds its declared bound.
     when: It is saved, published, simulated, or executed.
     then: The operation fails with a stable limit code before unbounded memory, storage, provider, or action work begins.
+  - id: WORKFLOWS-NOTIFY-RUN
+    given: A live workflow run started by a member reaches a terminal state, and the optional notifications module may or may not be composed.
+    when: The worker commits the terminal status.
+    then: With notifications.core composed, exactly one workflow-run-completed or workflow-run-failed notification is published after that commit, keyed by the run id, addressed to the member accountable for the run, and carrying no payload or evidence; without it, for a cancelled or simulated run, or when the publisher fails, the run settles unchanged and nothing is published.
   - id: WF-CLAIM-NARROW
     given: Two workspaces each own a queued live run.
     when: The worker polls for claimable work across tenants.
     then: The poll returns only the workspace id, run id, mode, status, lease expiry and queue time; the graph, actor, permission snapshot and payload ciphertext are unreadable on that connection, it cannot write, and each run is claimed exactly once under its own workspace.
+  - id: WORKFLOWS-HUMAN-APPROVAL
+    given: A published workflow revision carrying a human-approval node that requires a workspace role, and approvals.core composed.
+    when: A run reaches the node, an owner approves it, in a second run an owner rejects it, and in a third run nobody answers until the request's deadline passes.
+    then: The first run pauses with one pending request and resumes to completion after the approval; the second run fails with a stable code after the rejection; the third stays paused past the run duration bound and fails with a stable code at the request's deadline, withdrawing the pending request; a revision naming a role the workspace does not define, carrying a prompt or a label longer than a request title, or published while approvals.core is absent, is refused at publish time with a stable validation code; and a request resolved before the worker armed the wait still resumes its run rather than sleeping until the recheck.
+  - id: WORKFLOWS-DATA-CLASSES
+    given: Two workspaces hold workflow runs of several ages with node states, edge evidence and sealed payloads, one run still working, plus published workflows and a draft, and the platform has sealed the data class registry.
+    when: The platform sweeps, exports and erases the declared classes for one of them.
+    then: The sweep removes only that workspace's settled runs strictly older than the cutoff and at most the batch it was given, taking their node states, attempts, edges, events and sealed payloads with them while the working run stays; the export streams that workspace's runs with their nodes and edges, its audit trail in chain order, and its published workflows without their drafts, through the sink in keyset pages with the oldest and newest record time, answers no rows and no range for a workspace that holds none, and carries no payload ciphertext; the audit trail carries no sweep and no erasure; and erasing a subject removes the runs that account is the person behind in that workspace alone, including the ones a schedule or an agent started on its behalf, reporting a full batch as truncated.

package/modules/workflows/src/api/endpoints.ts

@@ -2,8 +2,10 @@ import {
 	defineEndpoint,
 	HttpProblem,
 	jsonResponse,
+	pageResponse,
 	problemResponse,
 	readJsonObject,
+	readPageQuery,
 	requiredInteger,
 	requiredString,
 } from '@flowdular/sdk/server';
@@ -17,10 +19,10 @@ import {
 import type {
 	JsonValue,
 	WorkflowExecutionOrigin,
-	WorkflowRunFilters,
 	WorkflowRunMode,
 	WorkflowRunStatus,
 	WorkflowSimulationFixture,
+	WorkflowSortDirection,
 } from '../domain/types.ts';
 import { WORKFLOW_LIMITS } from '../domain/types.ts';
 import { WORKFLOWS_PERMISSIONS } from '../acl/permissions.ts';
@@ -85,6 +87,65 @@ function optionalQuery(
 	return value;
 }
 
+/** The default page of a list screen; the ceiling is the interactive bound. */
+const LIST_PAGE_LIMIT = 50;
+const SEARCH_LIMIT = 120;
+
+interface ListOrder<Sort extends string> {
+	readonly sort: Sort;
+	readonly direction: WorkflowSortDirection;
+}
+
+/* `sort` and `direction` are the list's own vocabulary; anything else is the
+   caller's mistake rather than a fallback to the default order. */
+function readOrder<Sort extends string>(
+	url: URL,
+	allowed: readonly Sort[],
+	fallback: ListOrder<Sort>,
+): ListOrder<Sort> {
+	const sort = url.searchParams.get('sort');
+	const direction = url.searchParams.get('direction');
+	if (sort !== null && sort !== '' && !allowed.includes(sort as Sort)) {
+		throw new HttpProblem(
+			'INVALID_INPUT',
+			`sort must be one of ${allowed.join(', ')}.`,
+			400,
+		);
+	}
+	if (
+		direction !== null &&
+		direction !== '' &&
+		direction !== 'asc' &&
+		direction !== 'desc'
+	) {
+		throw new HttpProblem(
+			'INVALID_INPUT',
+			'direction must be asc or desc.',
+			400,
+		);
+	}
+	return {
+		sort: sort ? (sort as Sort) : fallback.sort,
+		direction: direction
+			? (direction as WorkflowSortDirection)
+			: fallback.direction,
+	};
+}
+
+/** The screen's search box, trimmed; whitespace alone asks for nothing. */
+function searchQuery(url: URL): string | undefined {
+	const value = url.searchParams.get('q')?.trim();
+	if (!value) return undefined;
+	if (value.length > SEARCH_LIMIT) {
+		throw new HttpProblem(
+			'INVALID_INPUT',
+			`q must contain at most ${SEARCH_LIMIT} characters.`,
+			400,
+		);
+	}
+	return value;
+}
+
 function requiredDescription(value: Record<string, unknown>): string {
 	const description = value.description;
 	if (typeof description !== 'string' || description.length > 2_000) {
@@ -274,12 +335,36 @@ export function createWorkflowsRoutes(
 		methods: ['GET'],
 		access: { kind: 'permission', permission: WORKFLOWS_PERMISSIONS.read },
 		resolveIdentity: endpointIdentityFromContext,
-		handler: async ({ octane }) =>
-			jsonResponse({
-				definitions: await (
+		handler: async ({ octane }) => {
+			try {
+				const url = new URL(octane.request.url);
+				const page = readPageQuery(url, {
+					maxLimit: WORKFLOW_LIMITS.maxInteractivePage,
+					defaultLimit: LIST_PAGE_LIMIT,
+				});
+				const status = optionalQuery(url, 'status', ['active', 'archived']);
+				const search = searchQuery(url);
+				const listed = await (
 					await runtime.service()
-				).list(principalFromContext(octane)!.tenantId),
-			}),
+				).listDefinitions(principalFromContext(octane)!.tenantId, {
+					...readOrder(url, ['name', 'updatedAt'], {
+						sort: 'name',
+						direction: 'asc',
+					}),
+					...(status ? { status: status as 'active' | 'archived' } : {}),
+					...(search ? { search } : {}),
+					limit: page.limit,
+					cursor: page.cursor,
+				});
+				return pageResponse({
+					items: listed.definitions,
+					limit: page.limit,
+					nextCursor: listed.nextCursor,
+				});
+			} catch (error) {
+				return failure(error);
+			}
+		},
 	});
 	const create = defineEndpoint({
 		id: 'workflows.definitions.create',
@@ -509,7 +594,10 @@ export function createWorkflowsRoutes(
 			try {
 				const principal = principalFromContext(octane)!;
 				const url = new URL(octane.request.url);
-				const rawLimit = optionalQuery(url, 'limit');
+				const page = readPageQuery(url, {
+					maxLimit: WORKFLOW_LIMITS.maxInteractivePage,
+					defaultLimit: LIST_PAGE_LIMIT,
+				});
 				const workflowId = optionalQuery(url, 'workflowId');
 				const mode = optionalQuery(url, 'mode', ['simulate', 'live']);
 				const status = optionalQuery(url, 'status', [
@@ -534,8 +622,14 @@ export function createWorkflowsRoutes(
 					'schedule',
 					'webhook',
 				]);
-				const cursor = optionalQuery(url, 'cursor');
-				const filters: WorkflowRunFilters = {
+				const search = searchQuery(url);
+				const listed = await (
+					await runtime.service()
+				).listRuns(principal.tenantId, {
+					...readOrder(url, ['queuedAt'], {
+						sort: 'queuedAt',
+						direction: 'desc',
+					}),
 					...(workflowId ? { workflowId } : {}),
 					...(mode ? { mode: mode as WorkflowRunMode } : {}),
 					...(status ? { status: status as WorkflowRunStatus } : {}),
@@ -545,12 +639,15 @@ export function createWorkflowsRoutes(
 					...(originKind
 						? { originKind: originKind as WorkflowExecutionOrigin['kind'] }
 						: {}),
-					...(rawLimit ? { limit: Number(rawLimit) } : {}),
-					...(cursor ? { cursor } : {}),
-				};
-				return jsonResponse(
-					await (await runtime.service()).listRuns(principal.tenantId, filters),
-				);
+					...(search ? { search } : {}),
+					limit: page.limit,
+					cursor: page.cursor,
+				});
+				return pageResponse({
+					items: listed.runs,
+					limit: page.limit,
+					nextCursor: listed.nextCursor,
+				});
 			} catch (error) {
 				return failure(error);
 			}
@@ -773,16 +870,25 @@ export function createWorkflowsRoutes(
 		handler: async ({ octane }) => {
 			try {
 				const url = new URL(octane.request.url);
-				const limit = Number(url.searchParams.get('limit') ?? '50');
-				return jsonResponse(
-					await (
-						await runtime.service()
-					).listAudit(
-						principalFromContext(octane)!.tenantId,
-						limit,
-						url.searchParams.get('cursor'),
-					),
-				);
+				const page = readPageQuery(url, {
+					maxLimit: WORKFLOW_LIMITS.maxInteractivePage,
+					defaultLimit: LIST_PAGE_LIMIT,
+				});
+				const listed = await (
+					await runtime.service()
+				).listAudit(principalFromContext(octane)!.tenantId, {
+					...readOrder(url, ['sequence', 'occurredAt'], {
+						sort: 'sequence',
+						direction: 'desc',
+					}),
+					limit: page.limit,
+					cursor: page.cursor,
+				});
+				return pageResponse({
+					items: listed.events,
+					limit: page.limit,
+					nextCursor: listed.nextCursor,
+				});
 			} catch (error) {
 				return failure(error);
 			}