@nodetool-ai/websocket 0.7.0-rc.22 → 0.8.1

package/dist/lib/applications-service.d.ts

@@ -0,0 +1,173 @@
+/**
+ * Application service — the business logic behind both transports.
+ *
+ * The tRPC `applications` router and the `/api/applications` REST routes are
+ * two doors onto these functions, so an app looks the same whichever one a
+ * client comes through. Errors are raised with `throwApiError`, which the REST
+ * layer maps back to a status code.
+ */
+import { z } from "zod";
+import { type ApplicationDocument } from "@nodetool-ai/app-runtime";
+import { Application, Workflow } from "@nodetool-ai/models";
+import { type ApplicationBundleSchema, type ApplicationListItem, type ApplicationReleaseResponse, type ApplicationResponse, type CreateApplicationInput, type ImportApplicationBundleInput } from "@nodetool-ai/protocol/api-schemas/applications.js";
+export declare const listApplicationsInput: z.ZodObject<{
+    projectId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const applicationIdInput: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const updateApplicationInput: z.ZodIntersection<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    document: z.ZodOptional<z.ZodObject<{
+        schemaVersion: z.ZodNumber;
+        ui: z.ZodObject<{
+            root: z.ZodObject<{
+                props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strip>;
+            content: z.ZodArray<z.ZodUnknown>;
+            zones: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnknown>>>;
+        }, z.core.$loose>;
+        operations: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            workflowId: z.ZodString;
+            workflowVersion: z.ZodOptional<z.ZodNumber>;
+            target: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                kind: z.ZodLiteral<"workflow">;
+                workflowId: z.ZodString;
+                workflowVersion: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"script">;
+                scriptId: z.ZodString;
+                scriptVersion: z.ZodNumber;
+            }, z.core.$strip>]>>;
+            inputs: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                from: z.ZodLiteral<"widget">;
+            }, z.core.$strip>, z.ZodObject<{
+                from: z.ZodLiteral<"variable">;
+                variableId: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                from: z.ZodLiteral<"constant">;
+                value: z.ZodOptional<z.ZodUnknown>;
+            }, z.core.$strip>, z.ZodObject<{
+                from: z.ZodLiteral<"resource">;
+                resourceBindingId: z.ZodString;
+            }, z.core.$strip>]>>>;
+            outputs: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                to: z.ZodLiteral<"display">;
+            }, z.core.$strip>, z.ZodObject<{
+                to: z.ZodLiteral<"variable">;
+                variableId: z.ZodString;
+            }, z.core.$strip>]>>>;
+            policy: z.ZodDefault<z.ZodEnum<{
+                parallel: "parallel";
+                queue: "queue";
+                replace: "replace";
+            }>>;
+            timeoutMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>>;
+        resources: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            kind: z.ZodEnum<{
+                asset: "asset";
+                sketch: "sketch";
+                storyboard: "storyboard";
+                timeline: "timeline";
+            }>;
+            scope: z.ZodObject<{
+                projectId: z.ZodOptional<z.ZodString>;
+                fixedId: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            operations: z.ZodArray<z.ZodEnum<{
+                create: "create";
+                delete: "delete";
+                read: "read";
+                update: "update";
+            }>>;
+        }, z.core.$strip>>>;
+        variables: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            type: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                type: z.ZodString;
+                optional: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>>;
+            default: z.ZodOptional<z.ZodUnknown>;
+            scope: z.ZodEnum<{
+                instance: "instance";
+                user: "user";
+            }>;
+            persist: z.ZodBoolean;
+        }, z.core.$strip>>>;
+        theme: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodString;
+    baseUpdatedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+export type UpdateApplicationInput = z.infer<typeof updateApplicationInput>;
+export declare function toListItem(app: Application): ApplicationListItem;
+export declare function loadOwnedApplication(userId: string | null, id: string): Promise<Application>;
+/**
+ * Build a small, deterministic first screen for workflows that predate the
+ * standalone application document. The widgets intentionally bind by node ID
+ * and let the shared runtime derive their type and defaults from the graph.
+ * That keeps this service independent of the web editor's input-kind catalog
+ * while making the result runnable as soon as it is opened.
+ */
+export declare function scaffoldDocumentFromWorkflow(workflowId: string, workflow: Workflow): ApplicationDocument;
+export declare function listApplications(userId: string, projectId?: string): Promise<ApplicationListItem[]>;
+export declare function getApplication(userId: string, id: string): Promise<ApplicationResponse>;
+export declare function createApplication(userId: string, input: CreateApplicationInput): Promise<ApplicationResponse>;
+export declare function updateApplication(userId: string, input: UpdateApplicationInput): Promise<ApplicationResponse>;
+/**
+ * Delete the app together with its versions, ledger and budget.
+ *
+ * `Application.delete` is the cascade: the child tables carry no owner check
+ * of their own, so leaving a row behind hands it to whoever next claims this
+ * id — an id a client is free to name.
+ */
+export declare function deleteApplication(userId: string, id: string): Promise<{
+    ok: true;
+}>;
+/**
+ * Export an app as an {@link ApplicationBundle}: the document plus the full
+ * graph of every workflow its operations bind, with the operations rewritten
+ * to bundle-local keys.
+ *
+ * With `released`, the bundle carries the released snapshot and the graphs the
+ * release pinned, so a published app exports reproducibly; otherwise it carries
+ * the draft and the workflows' live graphs. A workflow an operation binds but
+ * that no longer exists is left out — the operation keeps its raw id, so the
+ * broken link stays visible instead of silently disappearing.
+ */
+export declare function exportApplicationBundle(userId: string, id: string, options?: {
+    released?: boolean;
+}): Promise<ApplicationBundleSchema>;
+/**
+ * Import an {@link ApplicationBundle}: create a workflow row per carried
+ * workflow, then the application with its operations pointing at the new ids.
+ *
+ * Workflows are written first so the app never references a row that does not
+ * exist yet.
+ *
+ * **Dedupe rule.** A carried workflow that declares a `sourceId` gets a row id
+ * derived from that source and the importing user, so importing the same
+ * source twice lands on the same row: the second import reuses what the first
+ * created rather than duplicating it. That is what keeps two example apps
+ * binding the same template — Photo Studio and Concept Studio both bind Image
+ * Enhance — down to one workflow. A workflow with no `sourceId` (a
+ * hand-exported bundle) always gets a fresh id, so importing a colleague's app
+ * never silently attaches to a workflow you already have.
+ */
+export declare function importApplicationBundle(userId: string, input: ImportApplicationBundleInput): Promise<ApplicationResponse>;
+/**
+ * What a published app should run: the released snapshot's document, its
+ * version number and capabilities, plus the graph each operation is pinned to.
+ */
+export declare function releasedApplicationDocument(userId: string, id: string): Promise<ApplicationReleaseResponse | null>;
+//# sourceMappingURL=applications-service.d.ts.map

package/dist/lib/applications-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applications-service.d.ts","sourceRoot":"","sources":["../../src/lib/applications-service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAQL,KAAK,mBAAmB,EAGzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,WAAW,EAKX,QAAQ,EAMT,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAKL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EAClC,MAAM,mDAAmD,CAAC;AAK3D,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AAEH,eAAO,MAAM,kBAAkB;;iBAA+B,CAAC;AAE/D,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAElC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,mBAAmB,CAShE;AAOD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,WAAW,CAAC,CAOtB;AA4DD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,GACjB,mBAAmB,CAqJrB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAKhC;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,mBAAmB,CAAC,CAG9B;AAkCD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAkC9B;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA+B9B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAIvB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GACnC,OAAO,CAAC,uBAAuB,CAAC,CA+DlC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mBAAmB,CAAC,CAmE9B;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAI5C"}

package/dist/lib/applications-service.js

@@ -0,0 +1,491 @@
+/**
+ * Application service — the business logic behind both transports.
+ *
+ * The tRPC `applications` router and the `/api/applications` REST routes are
+ * two doors onto these functions, so an app looks the same whichever one a
+ * client comes through. Errors are raised with `throwApiError`, which the REST
+ * layer maps back to a status code.
+ */
+import { z } from "zod";
+import { applyBundle, bundleFromApplication, createEmptyDocument, operationTarget, parseApplicationBundle, parseApplicationDocument, pinScriptVersions } from "@nodetool-ai/app-runtime";
+import { Application, ApplicationIdInUseError, InvalidApplicationIdError, JsScript, JsScriptVersion, Workflow, createJsScriptResolver, createStableUuid, createTimeOrderedUuid, normalizeApplicationId, releasedApplicationRelease } from "@nodetool-ai/models";
+import { applicationBundle, applicationReleaseResponse, applicationResponse, patchApplicationInput } from "@nodetool-ai/protocol/api-schemas/applications.js";
+import { ApiErrorCode } from "../error-codes.js";
+import { throwApiError } from "../trpc/error-formatter.js";
+import { isRecord, isString } from "./wire-values.js";
+export const listApplicationsInput = z.object({
+    projectId: z.string().optional()
+});
+export const applicationIdInput = z.object({ id: z.string() });
+export const updateApplicationInput = patchApplicationInput.and(z.object({ id: z.string(), baseUpdatedAt: z.string().optional() }));
+export function toListItem(app) {
+    return {
+        id: app.id,
+        projectId: app.project_id,
+        name: app.name,
+        description: app.description,
+        operationCount: app.toDocument().operations.length,
+        updatedAt: app.updated_at
+    };
+}
+export async function loadOwnedApplication(userId, id) {
+    if (!userId)
+        throwApiError(ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+    const app = await Application.findById(id);
+    if (!app || app.user_id !== userId) {
+        throwApiError(ApiErrorCode.NOT_FOUND, "Application not found");
+    }
+    return app;
+}
+/**
+ * Import a legacy `workflow.app_doc` as an application document. The parser
+ * lifts a `{ version, data }` payload into one operation bound to the host
+ * workflow; widget bindings inside the UI keep their stored form and resolve
+ * against the live graph at runtime.
+ */
+async function documentFromWorkflow(workflowId, userId) {
+    const workflow = await Workflow.find(userId, workflowId);
+    if (!workflow) {
+        throwApiError(ApiErrorCode.NOT_FOUND, "Workflow not found");
+    }
+    // SAFETY: `app_doc` is a JSON column the `Workflow` model does not declare.
+    const raw = workflow.app_doc;
+    const parsed = raw
+        ? parseApplicationDocument(isString(raw) ? JSON.parse(raw) : raw, { hostWorkflowId: workflowId })
+        : null;
+    if (parsed)
+        return parsed;
+    return scaffoldDocumentFromWorkflow(workflowId, workflow);
+}
+const workflowNodes = (workflow) => workflow.graph.nodes.flatMap((raw) => {
+    if (!isRecord(raw) || !isString(raw.id) || !isString(raw.type)) {
+        return [];
+    }
+    return [
+        {
+            id: raw.id,
+            type: raw.type,
+            data: isRecord(raw.data) ? raw.data : undefined
+        }
+    ];
+});
+const nodeLabel = (node) => isString(node.data?.name) && node.data.name.length > 0
+    ? node.data.name
+    : node.id;
+const isWorkflowInput = (node) => node.type.startsWith("nodetool.input.");
+const isWorkflowOutput = (node) => node.type.startsWith("nodetool.output.") ||
+    node.type === "nodetool.workflows.base_node.Preview";
+/**
+ * Build a small, deterministic first screen for workflows that predate the
+ * standalone application document. The widgets intentionally bind by node ID
+ * and let the shared runtime derive their type and defaults from the graph.
+ * That keeps this service independent of the web editor's input-kind catalog
+ * while making the result runnable as soon as it is opened.
+ */
+export function scaffoldDocumentFromWorkflow(workflowId, workflow) {
+    const document = createEmptyDocument(workflow.name);
+    const operationId = "main";
+    const nodes = workflowNodes(workflow);
+    const inputs = nodes.filter(isWorkflowInput);
+    const outputs = nodes.filter(isWorkflowOutput);
+    const binding = (kind, nodeId) => {
+        if (kind === "execution") {
+            return `op:${operationId}/exec#${nodeId}`;
+        }
+        return `op:${operationId}/${kind === "input" ? "in" : "out"}:${nodeId}`;
+    };
+    const content = [
+        {
+            type: "Heading",
+            props: { id: "workflow-title", text: workflow.name || "Workflow app", level: "1" }
+        },
+        {
+            type: "Text",
+            props: {
+                id: "workflow-description",
+                text: "This app was created from your workflow. Review the inputs, then run it."
+            }
+        },
+        {
+            type: "Container",
+            props: {
+                id: "workflow-inputs",
+                title: "Inputs",
+                content: inputs.length > 0
+                    ? inputs.map((node) => ({
+                        type: "WorkflowInput",
+                        props: {
+                            id: `workflow-input-${node.id}`,
+                            binding: binding("input", node.id),
+                            label: nodeLabel(node),
+                            events: []
+                        }
+                    }))
+                    : [
+                        {
+                            type: "Text",
+                            props: {
+                                id: "workflow-no-inputs",
+                                text: "This workflow has no Input nodes."
+                            }
+                        }
+                    ]
+            }
+        },
+        {
+            type: "Button",
+            props: {
+                id: "workflow-run",
+                label: "Run workflow",
+                variant: "contained",
+                color: "primary",
+                events: [
+                    { trigger: "click", kind: "run", operationId, key: "", value: "" }
+                ],
+                disabledWhen: {
+                    binding: binding("execution", "running"),
+                    op: "notEmpty"
+                }
+            }
+        },
+        {
+            type: "Button",
+            props: {
+                id: "workflow-cancel",
+                label: "Cancel run",
+                variant: "outlined",
+                color: "warning",
+                events: [
+                    { trigger: "click", kind: "cancel", operationId, key: "", value: "" }
+                ],
+                visibleWhen: {
+                    binding: binding("execution", "running"),
+                    op: "notEmpty"
+                }
+            }
+        },
+        {
+            type: "Container",
+            props: {
+                id: "workflow-results",
+                title: "Results",
+                content: [
+                    {
+                        type: "Progress",
+                        props: {
+                            id: "workflow-progress",
+                            binding: binding("execution", "progress"),
+                            label: "Running…"
+                        }
+                    },
+                    {
+                        type: "Alert",
+                        props: {
+                            id: "workflow-error",
+                            binding: binding("execution", "error"),
+                            title: "The workflow failed",
+                            text: "",
+                            severity: "error",
+                            visibleWhen: {
+                                binding: binding("execution", "error"),
+                                op: "notEmpty"
+                            }
+                        }
+                    },
+                    ...(outputs.length > 0
+                        ? outputs.map((node) => ({
+                            type: "Output",
+                            props: {
+                                id: `workflow-output-${node.id}`,
+                                binding: binding("output", node.id),
+                                placeholder: `${nodeLabel(node)} will appear here`,
+                                download: true,
+                                filename: ""
+                            }
+                        }))
+                        : [
+                            {
+                                type: "Text",
+                                props: {
+                                    id: "workflow-no-outputs",
+                                    text: "This workflow has no Output nodes. Add one to display a result."
+                                }
+                            }
+                        ])
+                ]
+            }
+        }
+    ];
+    document.ui = { root: { props: {} }, content, zones: {} };
+    document.operations = [
+        {
+            id: operationId,
+            name: "Run",
+            workflowId,
+            inputs: {},
+            outputs: {},
+            policy: "replace"
+        }
+    ];
+    return document;
+}
+export async function listApplications(userId, projectId) {
+    const apps = projectId
+        ? await Application.listByProject(projectId, userId)
+        : await Application.listByUser(userId);
+    return apps.map(toListItem);
+}
+export async function getApplication(userId, id) {
+    const app = await loadOwnedApplication(userId, id);
+    return applicationResponse.parse(app.toResponse());
+}
+/**
+ * Create the row, mapping the model's id errors onto API errors.
+ *
+ * Ids are global: an app the caller does not own occupies its id just as much
+ * as one they do, and the row it names is reported the same way a missing one
+ * is — the caller learns their id was refused, not who holds it.
+ */
+async function insertApplication(userId, data) {
+    try {
+        return await Application.createUnique(data);
+    }
+    catch (error) {
+        if (error instanceof InvalidApplicationIdError) {
+            throwApiError(ApiErrorCode.INVALID_INPUT, "Invalid application id");
+        }
+        if (error instanceof ApplicationIdInUseError) {
+            // The id was taken between the caller's existence check and this insert.
+            // Answer exactly as that check would have: the owner gets their app back
+            // so a retried create stays idempotent, and everyone else gets the same
+            // answer a missing id gets. Reporting "already exists" here would make
+            // the losing side of the race the one place that reveals an id is held.
+            const existing = isString(data.id) ? await Application.findById(data.id) : null;
+            if (existing && existing.user_id === userId)
+                return existing;
+            throwApiError(ApiErrorCode.NOT_FOUND, "Application not found");
+        }
+        throw error;
+    }
+}
+export async function createApplication(userId, input) {
+    let id;
+    if (input.id) {
+        try {
+            id = normalizeApplicationId(input.id);
+        }
+        catch {
+            throwApiError(ApiErrorCode.INVALID_INPUT, "Invalid application id");
+        }
+        // Creating over an existing id is idempotent for its owner — a retried
+        // create returns the same app — and refused for everyone else. The id must
+        // never be reused, because the app's versions, ledger and budget are keyed
+        // on it and a deleted app's children could otherwise be inherited.
+        const existing = await Application.findById(id);
+        if (existing) {
+            if (existing.user_id !== userId) {
+                throwApiError(ApiErrorCode.NOT_FOUND, "Application not found");
+            }
+            return applicationResponse.parse(existing.toResponse());
+        }
+    }
+    const document = input.document ??
+        (input.fromWorkflowId
+            ? await documentFromWorkflow(input.fromWorkflowId, userId)
+            : createEmptyDocument());
+    const app = await insertApplication(userId, {
+        id,
+        user_id: userId,
+        project_id: input.projectId,
+        name: input.name,
+        description: input.description,
+        document: JSON.stringify(document)
+    });
+    return applicationResponse.parse(app.toResponse());
+}
+export async function updateApplication(userId, input) {
+    const app = await loadOwnedApplication(userId, input.id);
+    // CAS on updated_at so the conflict check and the write are atomic.
+    const expectedUpdatedAt = input.baseUpdatedAt ?? app.updated_at;
+    if (input.baseUpdatedAt && app.updated_at !== input.baseUpdatedAt) {
+        throwApiError(ApiErrorCode.ALREADY_EXISTS, "Application was modified since last read (optimistic concurrency conflict)");
+    }
+    const fields = {};
+    if (input.name !== undefined)
+        fields.name = input.name;
+    if (input.description !== undefined)
+        fields.description = input.description;
+    if (input.document !== undefined) {
+        fields.document = JSON.stringify(input.document);
+    }
+    const updated = await Application.updateFieldsIfUnchanged(input.id, expectedUpdatedAt, fields);
+    if (!updated) {
+        throwApiError(ApiErrorCode.ALREADY_EXISTS, "Application was modified since last read (optimistic concurrency conflict)");
+    }
+    return applicationResponse.parse(updated.toResponse());
+}
+/**
+ * Delete the app together with its versions, ledger and budget.
+ *
+ * `Application.delete` is the cascade: the child tables carry no owner check
+ * of their own, so leaving a row behind hands it to whoever next claims this
+ * id — an id a client is free to name.
+ */
+export async function deleteApplication(userId, id) {
+    const app = await loadOwnedApplication(userId, id);
+    await app.delete();
+    return { ok: true };
+}
+/**
+ * Export an app as an {@link ApplicationBundle}: the document plus the full
+ * graph of every workflow its operations bind, with the operations rewritten
+ * to bundle-local keys.
+ *
+ * With `released`, the bundle carries the released snapshot and the graphs the
+ * release pinned, so a published app exports reproducibly; otherwise it carries
+ * the draft and the workflows' live graphs. A workflow an operation binds but
+ * that no longer exists is left out — the operation keeps its raw id, so the
+ * broken link stays visible instead of silently disappearing.
+ */
+export async function exportApplicationBundle(userId, id, options = {}) {
+    const app = await loadOwnedApplication(userId, id);
+    const release = options.released
+        ? await releasedApplicationRelease(id, userId)
+        : null;
+    if (options.released && !release) {
+        throwApiError(ApiErrorCode.NOT_FOUND, "Application has no released version");
+    }
+    const document = release ? release.document : app.toDocument();
+    const pinned = new Map((release?.workflows ?? []).map((entry) => [entry.workflowId, entry]));
+    const sources = [];
+    const scriptSources = [];
+    const seen = new Set();
+    const seenScripts = new Set();
+    for (const operation of document.operations) {
+        const target = operationTarget(operation);
+        if (target.kind === "script") {
+            if (seenScripts.has(target.scriptId))
+                continue;
+            seenScripts.add(target.scriptId);
+            // The pinned version is what the app runs, so that is what ships — not
+            // whatever the script has drifted to since.
+            const resolved = await createJsScriptResolver().resolve({ id: target.scriptId, version: target.scriptVersion }, userId);
+            // A script the operation pins but the install no longer has is left out,
+            // the way a missing workflow is: the broken link stays visible.
+            if (!resolved)
+                continue;
+            scriptSources.push({
+                scriptId: target.scriptId,
+                name: resolved.name,
+                document: resolved.document,
+                sourceId: target.scriptId,
+                version: target.scriptVersion
+            });
+            continue;
+        }
+        if (seen.has(operation.workflowId))
+            continue;
+        seen.add(operation.workflowId);
+        const pin = pinned.get(operation.workflowId);
+        const workflow = await Workflow.find(userId, operation.workflowId);
+        const graph = pin?.graph ?? workflow?.getGraph();
+        if (!graph)
+            continue;
+        sources.push({
+            workflowId: operation.workflowId,
+            name: workflow?.name ?? operation.name,
+            description: workflow?.description ?? "",
+            graph,
+            version: pin?.version ?? null,
+            graphHash: pin?.graphHash ?? null
+        });
+    }
+    return applicationBundle.parse(bundleFromApplication({ name: app.name, description: app.description, document }, sources, scriptSources));
+}
+/**
+ * Import an {@link ApplicationBundle}: create a workflow row per carried
+ * workflow, then the application with its operations pointing at the new ids.
+ *
+ * Workflows are written first so the app never references a row that does not
+ * exist yet.
+ *
+ * **Dedupe rule.** A carried workflow that declares a `sourceId` gets a row id
+ * derived from that source and the importing user, so importing the same
+ * source twice lands on the same row: the second import reuses what the first
+ * created rather than duplicating it. That is what keeps two example apps
+ * binding the same template — Photo Studio and Concept Studio both bind Image
+ * Enhance — down to one workflow. A workflow with no `sourceId` (a
+ * hand-exported bundle) always gets a fresh id, so importing a colleague's app
+ * never silently attaches to a workflow you already have.
+ */
+export async function importApplicationBundle(userId, input) {
+    const bundle = parseApplicationBundle(input.bundle);
+    if (!bundle) {
+        throwApiError(ApiErrorCode.INVALID_INPUT, "Invalid application bundle");
+    }
+    const result = applyBundle(bundle, {
+        newWorkflowId: (workflow) => workflow.sourceId
+            ? createStableUuid(userId, workflow.sourceId)
+            : createTimeOrderedUuid(),
+        newScriptId: (script) => script.sourceId
+            ? createStableUuid(userId, script.sourceId)
+            : createTimeOrderedUuid()
+    });
+    for (const workflow of result.workflows) {
+        if (workflow.sourceId && (await Workflow.find(userId, workflow.id))) {
+            continue;
+        }
+        await Workflow.create({
+            id: workflow.id,
+            user_id: userId,
+            name: workflow.name,
+            description: workflow.description ?? "",
+            access: "private",
+            graph: workflow.graph
+        });
+    }
+    // A script row has its own version numbering, so the number the export
+    // pinned means nothing here: every carried script is snapshotted and the
+    // operations are re-pinned to the version this install created.
+    const scriptVersions = new Map();
+    for (const script of result.scripts) {
+        const existing = await JsScript.findById(script.id);
+        const row = existing && existing.user_id === userId
+            ? existing
+            : new JsScript({
+                id: script.id,
+                user_id: userId,
+                project_id: input.projectId,
+                name: script.name,
+                document: JSON.stringify(script.document)
+            });
+        if (row !== existing)
+            await row.save();
+        const version = await JsScriptVersion.snapshot(row, {
+            saveType: "manual",
+            name: `Imported with ${result.app.name}`
+        });
+        scriptVersions.set(script.id, version.version);
+    }
+    const document = scriptVersions.size > 0
+        ? pinScriptVersions(result.app.document, scriptVersions)
+        : result.app.document;
+    const app = await insertApplication(userId, {
+        user_id: userId,
+        project_id: input.projectId,
+        name: result.app.name,
+        description: result.app.description,
+        document: JSON.stringify(document)
+    });
+    return applicationResponse.parse(app.toResponse());
+}
+/**
+ * What a published app should run: the released snapshot's document, its
+ * version number and capabilities, plus the graph each operation is pinned to.
+ */
+export async function releasedApplicationDocument(userId, id) {
+    await loadOwnedApplication(userId, id);
+    const release = await releasedApplicationRelease(id, userId);
+    return release ? applicationReleaseResponse.parse(release) : null;
+}
+//# sourceMappingURL=applications-service.js.map