@nanobpm/nano-workforce 0.138.2 → 0.139.0

package/pages/delivery-graphs/staged.mount.js

@@ -22,9 +22,16 @@
 const DEFAULT_STAGED_URL = "app/api/delivery-graph/staged";
 // The operator dispatch door: POST { digest } → launches the staged graph engine-natively (#460).
 const DEFAULT_DISPATCH_URL = "app/api/actions/delivery-graph/dispatch";
+// The operator dismiss door: POST { digest } → discards a staged proposal as noise, flipping it to the
+// terminal `dismissed` status so it drops off the staged list (#520). Launches nothing.
+const DEFAULT_DISMISS_URL = "app/api/actions/delivery-graph/dismiss";
 // The read-only DI preview door: recompiles a staged proposal's BPMN (with diagram interchange) so its
 // generated diagram can be rendered in the host explorer BEFORE dispatch. No deploy, no dispatch.
 const DEFAULT_PROPOSAL_BPMN_URL = "app/api/actions/delivery-graph/proposal-bpmn";
+// The save-to-library door: POST { name, digest } → copies this staged proposal's already-stored graph
+// into the reusable library (issue #523, save-from-digest → source `from-staged`). Persists a library
+// entry; it never dispatches or re-stages, so the #460 operator boundary holds.
+const DEFAULT_SAVE_LIBRARY_URL = "app/api/actions/delivery-graph/library/save";
 
 // How often the list re-polls the read door so a freshly-staged (or just-dispatched) proposal appears
 // (or drops off) without a manual refresh — mirrors the 5s cadence the old declarative grid used.
@@ -42,6 +49,13 @@ const DISPATCH_CONFIRM =
   "node (it merges PRs / publishes packages) will run. Clicking Dispatch IS the approval, " +
   "content-addressed to exactly the graph you previewed.";
 
+// The confirm shown before a dismiss — dismissing is a terminal discard: the proposal drops off the
+// staged list for good (it can be re-staged only by recompiling). It launches nothing, so this is a
+// lighter acknowledgement than Dispatch, but still a one-way action the operator confirms.
+const DISMISS_CONFIRM =
+  "Dismiss this staged delivery graph? It is discarded as noise and drops off the staged list — this " +
+  "launches nothing, but to bring it back you must recompile/re-stage it.";
+
 /** Escape untrusted strings before they touch innerHTML. */
 function esc(value) {
   return String(value ?? "").replace(
@@ -76,6 +90,8 @@ function renderProposal(p) {
     <div class="actions">
       <button class="btn btn-ghost" type="button" data-preview-di="${esc(p.digest)}">Preview generated DI</button>
       <button class="btn btn-primary" type="button" data-dispatch="${esc(p.digest)}">Dispatch</button>
+      <button class="btn btn-ghost" type="button" data-save-library="${esc(p.digest)}" data-title="${esc(p.title ?? "")}">Save to library</button>
+      <button class="btn btn-ghost" type="button" data-dismiss="${esc(p.digest)}">Dismiss</button>
     </div>
   </section>`;
 }
@@ -95,10 +111,24 @@ function renderList(proposals) {
   return header + proposals.map(renderProposal).join("");
 }
 
+// Only attach the guard secret when the resolved door URL is SAME-ORIGIN. The staged/dispatch/dismiss/
+// proposal-bpmn/save-library door URLs can be overridden (e.g. via the standalone `?staged=` /
+// `?dispatch=` / `?proposal-bpmn=` query params) to a full `https://…` URL on a foreign origin; sending
+// `x-hook-secret` there would exfiltrate the shared guard secret to an arbitrary host. A cross-origin
+// (or unparseable, or non-browser) target therefore gets no secret.
+function isSameOrigin(url) {
+  try {
+    if (typeof window === "undefined" || !window.location) return false;
+    return new URL(url, window.location.href).origin === window.location.origin;
+  } catch (_e) {
+    return false;
+  }
+}
+
 /**
  * Mount the staged-proposals list into `host`.
  * @param {Element|null} host — the element to render into (or null → look up #delivery-graphs-staged-root).
- * @param {{stagedUrl?:string, dispatchUrl?:string, proposalBpmnUrl?:string, hookSecret?:string, refreshMs?:number}} [config]
+ * @param {{stagedUrl?:string, dispatchUrl?:string, dismissUrl?:string, proposalBpmnUrl?:string, saveLibraryUrl?:string, hookSecret?:string, refreshMs?:number}} [config]
  */
 export function mountStagedProposals(host, config = {}) {
   const isElement = host != null && host.nodeType === 1 && typeof host.innerHTML === "string";
@@ -107,11 +137,13 @@ export function mountStagedProposals(host, config = {}) {
 
   const stagedUrl = config.stagedUrl ?? DEFAULT_STAGED_URL;
   const dispatchUrl = config.dispatchUrl ?? DEFAULT_DISPATCH_URL;
+  const dismissUrl = config.dismissUrl ?? DEFAULT_DISMISS_URL;
   const proposalBpmnUrl = config.proposalBpmnUrl ?? DEFAULT_PROPOSAL_BPMN_URL;
+  const saveLibraryUrl = config.saveLibraryUrl ?? DEFAULT_SAVE_LIBRARY_URL;
   const refreshMs = typeof config.refreshMs === "number" && config.refreshMs > 0 ? config.refreshMs : DEFAULT_REFRESH_MS;
-  const headers = () => ({
+  const headers = (url) => ({
     "content-type": "application/json",
-    ...(config.hookSecret ? { "x-hook-secret": config.hookSecret } : {}),
+    ...(config.hookSecret && isSameOrigin(url) ? { "x-hook-secret": config.hookSecret } : {}),
   });
 
   root.innerHTML = `<div class="dg">
@@ -149,7 +181,7 @@ export function mountStagedProposals(host, config = {}) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
     try {
-      const res = await fetch(url, { ...init, headers: headers(), signal: controller.signal });
+      const res = await fetch(url, { ...init, headers: headers(url), signal: controller.signal });
       let body = {};
       try {
         body = await res.json();
@@ -254,6 +286,67 @@ export function mountStagedProposals(host, config = {}) {
     }
   }
 
+  // "Dismiss": the operator's discard (#520). Confirm (dismiss is a one-way drop off the staged list),
+  // then POST the digest to the dismiss door; on success the proposal flips to `dismissed` and drops off
+  // the list on the next poll — refresh immediately so the operator sees it leave. Launches nothing.
+  async function doDismiss(digest) {
+    const staged = typeof digest === "string" ? digest.trim() : "";
+    if (staged === "") return;
+    if (typeof window !== "undefined" && typeof window.confirm === "function" && !window.confirm(DISMISS_CONFIRM)) {
+      return;
+    }
+    busy(true);
+    setStatus("Dismissing…");
+    try {
+      const { status, body } = await post(dismissUrl, { digest: staged });
+      if ((status === 200 || status === 202) && body.ok) {
+        setStatus("\u2713 Dismissed — the proposal is off the staged list.", "ok");
+        await refresh();
+      } else {
+        setStatus(body && body.error ? body.error : "Dismiss failed.", "err");
+      }
+    } catch (err) {
+      setStatus(err && err.message ? err.message : "Dismiss request failed.", "err");
+    } finally {
+      busy(false);
+    }
+  }
+
+  // "Save to library": copy this staged proposal's already-stored graph into the reusable library
+  // (issue #523, save-from-digest → source `from-staged`). Prompt the operator for the entry name
+  // (defaulting to the proposal title — its slug/short-hash derive the library id, so re-saving the
+  // same name upserts), then POST { name, digest } to the save door. This persists a library entry
+  // only — it never dispatches or re-stages, so the operator boundary the staged view enforces (#460)
+  // is untouched.
+  async function doSaveToLibrary(digest, defaultName) {
+    const staged = typeof digest === "string" ? digest.trim() : "";
+    if (staged === "") return;
+    let name = defaultName ? String(defaultName) : "";
+    if (typeof window !== "undefined" && typeof window.prompt === "function") {
+      const entered = window.prompt("Save to library as (name):", name);
+      if (entered === null) return; // operator cancelled
+      name = entered;
+    }
+    if (name.trim() === "") {
+      setStatus("A library entry needs a non-blank name.", "err");
+      return;
+    }
+    busy(true);
+    setStatus("Saving to library…");
+    try {
+      const { status, body } = await post(saveLibraryUrl, { name: name.trim(), digest: staged });
+      if (status === 200 && body.ok) {
+        setStatus("\u2713 Saved to the library \u2014 reuse it from the Library view.", "ok");
+      } else {
+        setStatus(body && body.error ? body.error : "Save to library failed.", "err");
+      }
+    } catch (err) {
+      setStatus(err && err.message ? err.message : "Save-to-library request failed.", "err");
+    } finally {
+      busy(false);
+    }
+  }
+
   listEl.addEventListener("click", (ev) => {
     const previewBtn = ev.target && ev.target.closest ? ev.target.closest("[data-preview-di]") : null;
     if (previewBtn) {
@@ -265,6 +358,18 @@ export function mountStagedProposals(host, config = {}) {
     if (dispatchBtn) {
       ev.preventDefault();
       doDispatch(dispatchBtn.getAttribute("data-dispatch"));
+      return;
+    }
+    const saveLibraryBtn = ev.target && ev.target.closest ? ev.target.closest("[data-save-library]") : null;
+    if (saveLibraryBtn) {
+      ev.preventDefault();
+      doSaveToLibrary(saveLibraryBtn.getAttribute("data-save-library"), saveLibraryBtn.getAttribute("data-title"));
+      return;
+    }
+    const dismissBtn = ev.target && ev.target.closest ? ev.target.closest("[data-dismiss]") : null;
+    if (dismissBtn) {
+      ev.preventDefault();
+      doDismiss(dismissBtn.getAttribute("data-dismiss"));
     }
   });
 

package/pages/delivery-graphs/standalone.html

@@ -13,7 +13,7 @@
     <!--
       Standalone shell (phone / direct link). Loads the SAME ./mount.js the console App-View embed uses,
       so the standalone and embedded views render identically. Endpoints default to the current origin;
-      override the preview/dispatch endpoints via ?preview= / ?dispatch=. For a secured deployment, pass
+      override the preview/stage/import endpoints via ?preview= / ?stage= / ?import=. For a secured deployment, pass
       the guard secret via the URL fragment #secret= (sent as x-hook-secret) — NOT the query string, so
       it never leaks via server access logs, browser history, or the Referer header. The fragment is
       stripped from the address bar immediately after it is read.
@@ -31,6 +31,7 @@
       mountDeliveryGraphs(document.getElementById("delivery-graphs-root"), {
         previewUrl: params.get("preview") ?? undefined,
         stageUrl: params.get("stage") ?? undefined,
+        importUrl: params.get("import") ?? undefined,
         hookSecret,
       });
     </script>

package/pages/delivery-graphs.page.json

@@ -94,6 +94,16 @@
         "fill": true
       }
     },
+    {
+      "type": "appView",
+      "id": "delivery-graphs-library",
+      "props": {
+        "title": "Library",
+        "embed": "./delivery-graphs/library-embed.html",
+        "standalone": "./delivery-graphs/library-standalone.html",
+        "fill": true
+      }
+    },
     {
       "type": "dataGrid",
       "id": "delivery-graphs-inflight",
@@ -120,10 +130,12 @@
         "columns": [
           { "field": "title", "template": "{{title}}", "header": "Graph", "subtitleField": "run_key", "truncate": true, "width": "28%", "link": { "kind": "page", "page": "delivery-graph-detail", "keyField": "run_key" } },
           { "field": "status", "header": "Status", "link": { "kind": "processExplorer", "keyField": "process_key" } },
+          { "field": "process_key", "header": "Instance", "width": "9rem", "truncate": true, "link": { "kind": "processExplorer", "keyField": "process_key" } },
           { "field": "phase", "header": "Phase", "truncate": true, "width": "26%" },
           { "field": "node_count", "header": "Nodes" },
           { "field": "human_node_count", "header": "Human" },
           { "field": "side_effect_count", "header": "Side effects" },
+          { "field": "created_at", "header": "Dispatched", "width": "9rem", "format": "datetime" },
           { "field": "updated_at", "header": "Updated", "width": "9rem", "format": "datetime" }
         ],
         "detail": {
@@ -132,7 +144,18 @@
             { "field": "digest", "label": "Digest" },
             { "field": "phase_node_id", "label": "Parked node" }
           ]
-        }
+        },
+        "rowActions": [
+          {
+            "label": "Save to library",
+            "confirm": "Save this dispatched delivery graph to the reusable library? Its stored graph is copied into the Library (source: from-dispatched) so it can be reused later.",
+            "showWhenField": "title",
+            "action": {
+              "path": "/app/api/actions/delivery-graph/library/save",
+              "body": { "name": "{{row.title}}", "digest": "{{row.digest}}" }
+            }
+          }
+        ]
       }
     }
   ]

package/scripts/pages-contract.test.ts

@@ -407,3 +407,53 @@ test("issue #386: the human-facing Delivery Graphs surface is wired (nav tab, pa
     "overview delivery-graphs section must link its item to delivery-graph-detail by run_key",
   );
 });
+
+test("issue #521: the Delivery Graphs History tab surfaces dispatch time + the instance key", async () => {
+  // The in-flight grid's History tab (`delivery-graphs-inflight`) is where a completed/failed run is
+  // reviewed after the fact. It must surface WHEN the run was dispatched (`created_at`, stamped at
+  // dispatch) and its engine instance key (`process_key`) as a first-class, Explorer-linked cell —
+  // not just the `updated_at` last-touch. Grid columns are shared across the In-flight/History/All
+  // tabs (the renderer has no per-tab column override — tabs carry only `label`+`filter`), so pinning
+  // the columns on the grid that owns the History tab is what surfaces them on History.
+  const page = JSON.parse(readFileSync(`${ROOT}pages/delivery-graphs.page.json`, "utf8"));
+  const grid = (page.nodes ?? []).find(
+    (n: Json) => n.type === "dataGrid" && n.id === "delivery-graphs-inflight",
+  );
+  assert(grid, "delivery-graphs page must have the `delivery-graphs-inflight` grid");
+
+  // The History tab must exist (this is the tab whose columns we are pinning).
+  const history = (grid.props?.tabs ?? []).find((t: Json) => t.label === "History");
+  assert(history, "the delivery-graphs-inflight grid must have a History tab");
+
+  const columns: Json[] = grid.props?.columns ?? [];
+
+  // Dispatched: the dispatch time, formatted as a datetime, distinct from the `updated_at` "Updated".
+  const dispatched = columns.find((c: Json) => c.field === "created_at");
+  assert(dispatched, "History tab must expose a `created_at` column (dispatch time)");
+  assert(
+    dispatched.header === "Dispatched",
+    "the `created_at` column must be headed \"Dispatched\"",
+  );
+  assert(
+    dispatched.format === "datetime",
+    "the `created_at` (Dispatched) column must be formatted as a datetime",
+  );
+
+  // Instance: an explicit cell carrying `process_key`, deep-linked to the Explorer via the same
+  // `processExplorer` link kind used by the Status column, keyed on `process_key`.
+  const instance = columns.find(
+    (c: Json) => c.field === "process_key" && c.link?.kind === "processExplorer",
+  );
+  assert(
+    instance,
+    "History tab must expose an explicit Instance cell on `process_key` with a processExplorer link",
+  );
+  assert(
+    instance.header === "Instance",
+    "the `process_key` cell must be headed \"Instance\"",
+  );
+  assert(
+    instance.link?.keyField === "process_key",
+    "the Instance cell's processExplorer link must key on `process_key`",
+  );
+});

package/test/delivery-graphs-import.test.ts

@@ -0,0 +1,92 @@
+// Contract guard for the filesystem IMPORT wiring on the Delivery Graphs compose App-View (issue #524,
+// epic #519 S5). The Import control is ADDED into the PRE-EXISTING compose mount (pages/delivery-graphs/
+// mount.js — the one #523 reshaped), alongside #523's inbound reuse-fill seam. It must: render an
+// `<input type=file accept=.json>`, read the picked file's text client-side, POST it to the
+// importToLibrary door (base-relative, App-View #279 resolution class), route a successful import back
+// through #523's SINGLE `fillComposer()` seam (no second inbound fill path), and render path-qualified
+// compile errors inline on a 400. This test pins that wiring so it can't silently regress.
+import { test } from "node:test";
+import { assert } from "#test-assert";
+import { readFileSync } from "node:fs";
+
+const ROOT = decodeURIComponent(new URL("../", import.meta.url).pathname);
+const DIR = `${ROOT}pages/delivery-graphs`;
+const MOUNT_JS = readFileSync(`${DIR}/mount.js`, "utf8");
+const CSS = readFileSync(`${DIR}/delivery-graphs.css`, "utf8");
+const EMBED_HTML = readFileSync(`${DIR}/embed.html`, "utf8");
+const STANDALONE_HTML = readFileSync(`${DIR}/standalone.html`, "utf8");
+
+// Pull the string default out of `const <name> = config.<name> ?? <CONST>;` (a module const).
+function defaultUrl(name: string): string {
+  const m = MOUNT_JS.match(new RegExp(`${name}\\s*=\\s*config\\.\\w+\\s*\\?\\?\\s*(\\w+);`));
+  assert(m, `mount.js must default ${name} from config with a fallback constant`);
+  const constM = MOUNT_JS.match(new RegExp(`const ${m![1]}\\s*=\\s*"([^"]*)"`));
+  assert(constM, `mount.js must declare the ${m![1]} fallback as a string literal`);
+  return constM![1];
+}
+
+test("#524: the compose mount renders a file-input Import control accepting .json", () => {
+  assert(/id="dg-import"/.test(MOUNT_JS), "mount.js must render an Import file input with id=dg-import");
+  assert(/type="file"/.test(MOUNT_JS), "the Import control must be an <input type=file>");
+  assert(/accept="[^"]*\.json[^"]*"/.test(MOUNT_JS), "the Import file input must accept .json files");
+});
+
+test("#524: Import wires the importToLibrary door (base-relative), reading the file text client-side", () => {
+  const importUrl = defaultUrl("importUrl");
+  assert(
+    importUrl.endsWith("actions/delivery-graph/library/import"),
+    `importUrl default "${importUrl}" must hit the importToLibrary door`,
+  );
+  assert(!importUrl.startsWith("/"), `default importUrl "${importUrl}" must be base-relative (App-View #279 resolution class)`);
+  // The file's text is read CLIENT-SIDE and POSTed as graphJson to the import door.
+  assert(/\.text\(\)/.test(MOUNT_JS), "mount.js must read the selected file's text client-side via File.text()");
+  assert(/post\(importUrl,\s*\{\s*graphJson:/.test(MOUNT_JS), "the Import handler must POST the file text as graphJson to the import door");
+  // The <input> must actually be WIRED to the handler: without a change listener that invokes
+  // importFile(), the door + handler could stay intact while Import is inert (every other assertion
+  // here still green). Pin the change→importFile wiring so removing the listener fails the suite.
+  assert(
+    /addEventListener\(\s*["']change["'][\s\S]{0,200}?importFile\(/.test(MOUNT_JS),
+    "the Import file input's change listener must invoke importFile() so picking a file triggers an import",
+  );
+});
+
+test("#524: a successful import routes through #523's single fillComposer() seam", () => {
+  // #523 owns the inbound fill seam; #524 builds on it rather than adding a second inbound fill path.
+  assert(/function fillComposer\(/.test(MOUNT_JS), "the #523 fillComposer() seam must still be present");
+  const importHandler = MOUNT_JS.slice(MOUNT_JS.indexOf("async function importFile"));
+  assert(importHandler.length > 0, "mount.js must define the importFile handler");
+  assert(/fillComposer\(text\b/.test(importHandler), "a successful import must route the imported text through the fillComposer() seam");
+});
+
+test("#524: an import failure renders the door's path-qualified compile errors inline", () => {
+  const importHandler = MOUNT_JS.slice(MOUNT_JS.indexOf("async function importFile"));
+  assert(
+    /renderErrors\(body\.error,\s*body\.errors\)/.test(importHandler),
+    "an import 400 must render the door's path-qualified errors inline",
+  );
+});
+
+test("#524: both shells forward importUrl into the mount (embed via cfg, standalone via ?import=)", () => {
+  // The mount resolves `config.importUrl ?? DEFAULT_IMPORT_URL`, so the default-URL guard above passes
+  // even if a shell drops the `importUrl` forwarding entirely — silently breaking embedded custom
+  // deployments and the standalone `?import=` override. Pin BOTH forwardings, exactly as the shells
+  // already forward previewUrl/stageUrl.
+  assert(
+    /importUrl:\s*cfg\.importUrl/.test(EMBED_HTML),
+    "embed.html must forward the console-injected importUrl (importUrl: cfg.importUrl) into the mount",
+  );
+  assert(
+    /importUrl:\s*params\.get\("import"\)/.test(STANDALONE_HTML),
+    "standalone.html must forward the ?import= override (importUrl: params.get(\"import\")) into the mount",
+  );
+  // mount.js must actually read config.importUrl (not hard-code the default), so the forwarding matters.
+  assert(
+    /const importUrl\s*=\s*config\.importUrl\s*\?\?/.test(MOUNT_JS),
+    "mount.js must resolve importUrl from config.importUrl with a fallback default",
+  );
+});
+
+test("#524: the native file input is visually hidden and the label reads as a button", () => {
+  assert(/\.dg-import-input/.test(CSS), "the CSS must style the Import file input");
+  assert(/clip:\s*rect\(0,\s*0,\s*0,\s*0\)/.test(CSS), "the native file input must be visually hidden (the label is the button)");
+});

package/test/delivery-graphs-library-embed.test.ts

@@ -0,0 +1,148 @@
+// Contract guard for the reusable delivery-graph LIBRARY App-View (issue #523, epic #519 S4).
+//
+// The Library surface (pages/delivery-graphs/library.*) LISTS saved library entries (the `listLibrary`
+// door) and, per row, offers Reuse (load the saved graph back into the compose textarea `#dg-json`) and
+// Delete (the `deleteLibraryEntry` door). Reuse crosses the App-View iframe boundary: it drives the
+// compose mount's NEW inbound fill seam over the shared `deliveryGraph.compose.fill` host-bridge
+// message. Plus a Save-to-library affordance on the staged App-View (save-from-digest) and a
+// Save-to-library row action on the dispatched/history grid. This test pins that wiring so it cannot
+// silently regress: the sidecars mount the same module, the door defaults are base-relative (the #279
+// App-View resolution class), Reuse posts the ONE shared fill message, Delete hits the per-entry door,
+// the compose mount adds the inbound fill listener, and the page carries the new Library App-View node.
+import { test } from "node:test";
+import { assert, assertEquals, assertStringIncludes } from "#test-assert";
+import { readFileSync } from "node:fs";
+import { DG_COMPOSE_FILL_MESSAGE } from "../pages/delivery-graphs/mount.js";
+
+const ROOT = decodeURIComponent(new URL("../", import.meta.url).pathname);
+const DIR = `${ROOT}pages/delivery-graphs`;
+const LIBRARY_JS = readFileSync(`${DIR}/library.mount.js`, "utf8");
+const COMPOSE_JS = readFileSync(`${DIR}/mount.js`, "utf8");
+const STAGED_JS = readFileSync(`${DIR}/staged.mount.js`, "utf8");
+const EMBED_HTML = readFileSync(`${DIR}/library-embed.html`, "utf8");
+const STANDALONE_HTML = readFileSync(`${DIR}/library-standalone.html`, "utf8");
+const PAGE_JSON = readFileSync(`${ROOT}pages/delivery-graphs.page.json`, "utf8");
+
+// Pull the string default out of `const <name> = config.<field> ?? <CONST>;` (or a module const).
+function defaultUrl(src: string, name: string): string {
+  const m = src.match(new RegExp(`${name}\\s*=\\s*config\\.\\w+\\s*\\?\\?\\s*(\\w+);`));
+  assert(m, `mount must default ${name} from config with a fallback constant`);
+  const constM = src.match(new RegExp(`const ${m![1]}\\s*=\\s*"([^"]*)"`));
+  assert(constM, `mount must declare the ${m![1]} fallback as a string literal`);
+  return constM![1];
+}
+
+test("#523: the Library App-View mounts the same module standalone and embedded", () => {
+  assert(/mountDeliveryGraphLibrary/.test(LIBRARY_JS), "library.mount.js must export mountDeliveryGraphLibrary");
+  for (const [file, html] of [["library-embed.html", EMBED_HTML], ["library-standalone.html", STANDALONE_HTML]] as const) {
+    assert(
+      /import \{ mountDeliveryGraphLibrary \} from "\.\/library\.mount\.js"/.test(html),
+      `${file} must import mountDeliveryGraphLibrary from ./library.mount.js`,
+    );
+    assert(/mountDeliveryGraphLibrary\(/.test(html), `${file} must call mountDeliveryGraphLibrary`);
+  }
+});
+
+test("#523: the page binds the Library node to the library App-View sidecars", () => {
+  const page = JSON.parse(PAGE_JSON) as { nodes: Array<Record<string, any>> };
+  const library = page.nodes.find((n) => n.id === "delivery-graphs-library");
+  assert(library, "the page must carry the delivery-graphs-library node");
+  assert(library?.type === "appView", "delivery-graphs-library must be an appView (#523)");
+  assert(library?.props?.embed === "./delivery-graphs/library-embed.html", "it embeds the library embed sidecar");
+  assert(library?.props?.standalone === "./delivery-graphs/library-standalone.html", "it has the library standalone sidecar");
+});
+
+test("#523/#279: the Library list door default is base-relative and hits the listLibrary door", () => {
+  const url = defaultUrl(LIBRARY_JS, "libraryUrl");
+  assert(url.endsWith("delivery-graph/library"), `libraryUrl default "${url}" must hit the listLibrary door`);
+  assert(!url.startsWith("/"), `default libraryUrl "${url}" must be base-relative (App-View #279 resolution class)`);
+  // The list read consumes the door's `entries` array (one row per saved entry).
+  assert(/body\.entries/.test(LIBRARY_JS), "library.mount.js must render one row per `entries[]` item the listLibrary door returns");
+});
+
+test("#523: Reuse drives the compose fill seam over the shared host-bridge message", () => {
+  // Reuse loads the saved graph back into the SEPARATE compose App-View, so it posts the ONE shared
+  // fill message (its type imported from ./mount.js, never re-declared) UP over the App-View boundary.
+  assert(
+    /import \{ DG_COMPOSE_FILL_MESSAGE \} from "\.\/mount\.js"/.test(LIBRARY_JS),
+    "library.mount.js must import DG_COMPOSE_FILL_MESSAGE from ./mount.js (the ONE source of truth for the fill message type)",
+  );
+  assert(/data-reuse=/.test(LIBRARY_JS), "library.mount.js must render a per-row Reuse affordance carrying the entry id");
+  assert(/postMessage\(/.test(LIBRARY_JS), "Reuse must post the fill message across the App-View boundary");
+  assert(/type:\s*DG_COMPOSE_FILL_MESSAGE/.test(LIBRARY_JS), "the Reuse message must carry the shared DG_COMPOSE_FILL_MESSAGE type");
+  assert(/graphJson:\s*entry\.graph/.test(LIBRARY_JS), "the Reuse message must carry the saved entry's graph JSON");
+});
+
+test("#523: Delete hits the per-entry deleteLibraryEntry door", () => {
+  assert(/data-delete=/.test(LIBRARY_JS), "library.mount.js must render a per-row Delete affordance carrying the entry id");
+  // The delete door is the per-entry path under the list door: DELETE .../delivery-graph/library/<id>.
+  assert(/method:\s*"DELETE"/.test(LIBRARY_JS), "Delete must issue an HTTP DELETE to the deleteLibraryEntry door");
+  assert(/encodeURIComponent\(/.test(LIBRARY_JS), "the delete path must URL-encode the entry id it appends to the library door");
+});
+
+test("#523: the compose mount exposes an INBOUND reuse-fill seam (message → #dg-json)", () => {
+  // The compose mount previously had NO inbound prefill — its #dg-json was set only by Load-example /
+  // typing. S4 adds a same-origin message listener that fills #dg-json through a single fillComposer seam.
+  assert(/export const DG_COMPOSE_FILL_MESSAGE\s*=/.test(COMPOSE_JS), "mount.js must export the DG_COMPOSE_FILL_MESSAGE fill-message type");
+  // Pin the actual wire value the imported const carries: this is the cross-App-View host-bridge
+  // message type the Library/compose sidecars agree on, so a silent change to the string is a
+  // breaking wire-contract change and the compose mount must declare exactly that literal.
+  assertEquals(DG_COMPOSE_FILL_MESSAGE, "nano-delivery-graph-compose-fill", "the shared fill-message type must be the pinned wire-contract string");
+  assertStringIncludes(COMPOSE_JS, `"${DG_COMPOSE_FILL_MESSAGE}"`, "mount.js must declare the fill-message type as the pinned string literal");
+  assert(/function fillComposer\(/.test(COMPOSE_JS), "mount.js must define the single fillComposer seam every fill routes through");
+  assert(/addEventListener\("message"/.test(COMPOSE_JS), "mount.js must register an inbound `message` listener for the fill seam");
+  assert(/data\.type !== DG_COMPOSE_FILL_MESSAGE/.test(COMPOSE_JS), "the listener must gate on the shared fill-message type");
+  assert(/jsonEl\.value = graphJson/.test(COMPOSE_JS), "fillComposer must load the graph JSON into the #dg-json textarea");
+  // Same-origin guard: a foreign origin must not be able to drive the fill.
+  assert(/ev\.origin !== window\.location\.origin/.test(COMPOSE_JS), "the fill listener must reject cross-origin messages");
+});
+
+test("#523: Save-to-library on the staged App-View posts save-from-digest", () => {
+  const url = defaultUrl(STAGED_JS, "saveLibraryUrl");
+  assert(url.endsWith("actions/delivery-graph/library/save"), `saveLibraryUrl default "${url}" must hit the saveToLibrary door`);
+  assert(!url.startsWith("/"), `default saveLibraryUrl "${url}" must be base-relative (App-View #279 resolution class)`);
+  assert(/data-save-library=/.test(STAGED_JS), "staged.mount.js must render a per-row Save-to-library affordance carrying the digest");
+  // Save-from-digest: it posts { name, digest } — it must NOT compile or stage a raw graph (the #460
+  // operator boundary the staged view enforces stays intact).
+  assert(/post\(saveLibraryUrl,\s*\{\s*name:[^}]*digest:/.test(STAGED_JS), "Save-to-library must POST { name, digest } (save-from-digest) to the save door");
+});
+
+test("#523: Save-to-library is offered on a dispatched/history grid row (save-from-dispatched)", () => {
+  const page = JSON.parse(PAGE_JSON) as { nodes: Array<Record<string, any>> };
+  const grid = page.nodes.find((n) => n.id === "delivery-graphs-inflight");
+  assert(grid, "the page must carry the delivery-graphs-inflight grid");
+  const action = (grid?.props?.rowActions ?? []).find((a: Record<string, any>) => a.label === "Save to library");
+  assert(action, "the in-flight grid must offer a `Save to library` row action");
+  assert(
+    action?.action?.path === "/app/api/actions/delivery-graph/library/save",
+    "the Save-to-library row action must post to the saveToLibrary door",
+  );
+  assert(
+    action?.action?.body?.digest === "{{row.digest}}" && action?.action?.body?.name === "{{row.title}}",
+    "the Save-to-library row action must save-from-digest, naming the entry from the run title",
+  );
+});
+test("#523: the x-hook-secret guard is gated on a same-origin door (no cross-origin secret exfil)", () => {
+  // A `?library=` / `?staged=` / `?preview=` override can point a door at a full `https://…` URL on a
+  // FOREIGN origin. The shared guard secret must NEVER ride along to an arbitrary host, so each mount
+  // attaches `x-hook-secret` only when the resolved door URL is same-origin.
+  for (const [name, src] of [
+    ["library.mount.js", LIBRARY_JS],
+    ["mount.js", COMPOSE_JS],
+    ["staged.mount.js", STAGED_JS],
+  ] as const) {
+    assert(/function isSameOrigin\(url\)/.test(src), `${name} must define an isSameOrigin(url) guard`);
+    assert(
+      /new URL\(url,\s*window\.location\.href\)\.origin === window\.location\.origin/.test(src),
+      `${name} isSameOrigin must compare the resolved URL origin against window.location.origin`,
+    );
+    assert(
+      /config\.hookSecret && isSameOrigin\(url\)\s*\?\s*\{\s*"x-hook-secret"/.test(src),
+      `${name} must attach x-hook-secret ONLY when hookSecret is set AND the door URL is same-origin`,
+    );
+    assert(
+      /headers:\s*headers\(url\)/.test(src),
+      `${name} must thread the request URL into headers(url) so the secret gate sees the target origin`,
+    );
+  }
+});

package/test/delivery-graphs-library-export.test.ts

@@ -0,0 +1,62 @@
+// Contract guard for the delivery-graph LIBRARY Export affordance (issue #525, epic #519 S6).
+//
+// Export is a purely client-side Blob download of a saved library entry's stored graph JSON as
+// `<name>.deliverygraph.json` — no backend door. It builds directly on the S4 Library App-View (#523,
+// `pages/delivery-graphs/library.mount.js`): each rendered library entry gains an Export button
+// alongside Reuse/Delete. This test pins BOTH halves so the affordance cannot silently regress:
+//   • a behavioural guard on the pure, DOM-free `buildDeliveryGraphExport()` helper — it "builds a
+//     download from the entry's graph JSON": the download contents are the entry's stored graph
+//     verbatim and the filename is the sanitised name + `.deliverygraph.json`; and
+//   • a source guard that the mount renders the per-row Export control and assembles the Blob download
+//     (createObjectURL → anchor.download → revokeObjectURL) from that helper.
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import { readFileSync } from "node:fs";
+import { buildDeliveryGraphExport, DELIVERY_GRAPH_EXPORT_SUFFIX } from "../pages/delivery-graphs/library.mount.js";
+
+const ROOT = decodeURIComponent(new URL("../", import.meta.url).pathname);
+const LIBRARY_JS = readFileSync(`${ROOT}pages/delivery-graphs/library.mount.js`, "utf8");
+
+test("#525: the export filename suffix is the pinned .deliverygraph.json contract", () => {
+  assertEquals(DELIVERY_GRAPH_EXPORT_SUFFIX, ".deliverygraph.json");
+});
+
+test("#525: buildDeliveryGraphExport downloads the entry's stored graph JSON verbatim", () => {
+  const graph = '{"nodes":[{"id":"a"}],"edges":[]}';
+  const out = buildDeliveryGraphExport({ id: "lib-1", name: "Onboarding", graph });
+  // "builds a download from the entry's graph JSON": bytes are the stored graph, unmodified.
+  assertEquals(out.contents, graph, "export contents must be the entry's stored graph JSON, byte-for-byte");
+  assertEquals(out.mime, "application/json", "an exported delivery graph is application/json");
+  assertEquals(out.filename, `Onboarding${DELIVERY_GRAPH_EXPORT_SUFFIX}`, "filename is <name>.deliverygraph.json");
+});
+
+test("#525: the export filename sanitises unsafe characters in the entry name", () => {
+  const out = buildDeliveryGraphExport({ id: "lib-2", name: "My Graph / v2: final!", graph: "{}" });
+  assertEquals(out.filename, `My-Graph-v2-final${DELIVERY_GRAPH_EXPORT_SUFFIX}`);
+  // No path separators, and never a leading-dot hidden file.
+  assert(!out.filename.includes("/") && !out.filename.includes("\\"), "filename must carry no path separators");
+  assert(!out.filename.startsWith("."), "filename must not be a hidden dotfile");
+});
+
+test("#525: an unnamed entry falls back to a stable id-derived filename", () => {
+  const named = buildDeliveryGraphExport({ id: "lib-3", name: "   ", graph: "{}" });
+  assertEquals(named.filename, `delivery-graph-lib-3${DELIVERY_GRAPH_EXPORT_SUFFIX}`, "blank name falls back to the entry id");
+  const anon = buildDeliveryGraphExport({ graph: "{}" });
+  assertEquals(anon.filename, `delivery-graph${DELIVERY_GRAPH_EXPORT_SUFFIX}`, "no name and no id falls back to a constant");
+});
+
+test("#525: an entry with no stored graph yields empty contents (nothing to download)", () => {
+  assertEquals(buildDeliveryGraphExport({ id: "x", name: "n" }).contents, "");
+  assertEquals(buildDeliveryGraphExport({ id: "x", name: "n", graph: 42 as unknown as string }).contents, "");
+});
+
+test("#525: the Library mount renders a per-row Export control wired to a Blob download", () => {
+  assert(/data-export=/.test(LIBRARY_JS), "library.mount.js must render a per-row Export affordance carrying the entry id");
+  assert(/closest\("\[data-export\]"\)/.test(LIBRARY_JS), "the list click handler must route the Export button");
+  assert(/buildDeliveryGraphExport\(entry\)/.test(LIBRARY_JS), "Export must assemble the download from buildDeliveryGraphExport(entry)");
+  // The actual client-side download mechanics: Blob → object URL → anchor download → revoke.
+  assert(/new Blob\(\[contents\]/.test(LIBRARY_JS), "Export must build a Blob from the entry's graph contents");
+  assert(/URL\.createObjectURL\(/.test(LIBRARY_JS), "Export must create an object URL for the download");
+  assert(/\.download = filename/.test(LIBRARY_JS), "Export must set the anchor download filename");
+  assert(/URL\.revokeObjectURL\(/.test(LIBRARY_JS), "Export must revoke the object URL after triggering the download");
+});

package/test/delivery-graphs-staged-embed.test.ts

@@ -75,3 +75,12 @@ test("#460/#511: Dispatch is the operator's launch — posts the digest to the d
   assert(!/graphJson/.test(MOUNT_JS), "staged.mount.js must NOT submit pasted graph JSON (it only lists+dispatches staged proposals)");
   assert(!/approvalToken/.test(MOUNT_JS), "staged.mount.js must NOT carry the removed replayable approvalToken");
 });
+
+test("#520: Dismiss is the operator's discard — posts the digest to the dismiss door, behind a confirm, and launches nothing", () => {
+  const url = defaultUrl("dismissUrl");
+  assert(url.endsWith("actions/delivery-graph/dismiss"), `dismissUrl default "${url}" must hit the dismissProposal door`);
+  assert(!url.startsWith("/"), `default dismissUrl "${url}" must be base-relative (App-View #279 resolution class)`);
+  assert(/data-dismiss=/.test(MOUNT_JS), "staged.mount.js must render a per-row Dismiss affordance carrying the digest");
+  // Dismiss is a one-way discard off the staged list — confirm before it drops the proposal.
+  assert(/window\.confirm\(DISMISS_CONFIRM\)/.test(MOUNT_JS), "staged.mount.js must confirm before dismissing (a one-way discard off the staged list)");
+});