@oomol-lab/open-flow 0.1.0-beta.50 → 0.1.0-beta.52

package/dist/common/flow-encoding.js

@@ -1,3 +1,12 @@
+//#region src/openapi/common/authBindings.ts
+/** Never allow credentials to enter a Revision as literal node inputs. */
+function assertOpenApiAuthBindings(document) {
+	for (const graph of [document.graph, ...Object.values(document.subflows).map((subflow) => subflow.graph)]) for (const node of Object.values(graph.nodes)) {
+		if (node.kind != "task" || node.taskId == null || document.tasks[node.taskId]?.executor.kind != "openapi") continue;
+		for (const [handle, mapping] of Object.entries(node.inputs)) if (handle.startsWith("auth.") && (mapping.kind == "value" || mapping.kind == "sources" && mapping.sources.some((source) => source.kind == "flow"))) throw new TypeError("OpenAPI authentication accepts deployment variables and upstream outputs only.");
+	}
+}
+//#endregion
 //#region ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
 	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
@@ -5709,6 +5718,24 @@ var managed = object({
 			action: text,
 			connectionId: text.optional()
 		}),
+		object({
+			kind: literal("openapi"),
+			sourceUrl: text,
+			method: text,
+			path: text,
+			serverUrl: text,
+			document: json,
+			auth: array(object({
+				id: text,
+				type: _enum([
+					"bearer",
+					"basic",
+					"apiKey"
+				]),
+				name: text.optional(),
+				in: _enum(["header", "query"]).optional()
+			}))
+		}),
 		object({
 			kind: literal("llm"),
 			mode: _enum(["chat", "json"])
@@ -5825,6 +5852,7 @@ var endpoint = object({
 	])),
 	successStatus: number()
 });
+var sourceFlowIds = array(text.min(1)).refine((ids) => new Set(ids).size === ids.length, "Duplicate source Flow ID.");
 var trigger = {
 	name: text,
 	description: text.optional(),
@@ -5882,6 +5910,11 @@ var node = union([
 		...trigger,
 		kind: literal("manual")
 	}),
+	strictObject({
+		...trigger,
+		kind: literal("error"),
+		sourceFlowIds: sourceFlowIds.optional()
+	}),
 	object({
 		...trigger,
 		kind: literal("webhook"),
@@ -5953,7 +5986,11 @@ var document = object({
 	tasks: record$1(text, managed)
 });
 var revision = object({
-	modelVersion: union([literal(2), literal(4)]),
+	modelVersion: union([
+		literal(2),
+		literal(4),
+		literal(5)
+	]),
 	document,
 	modules: record$1(text, module)
 });
@@ -6113,7 +6150,7 @@ function repairRevisionEnvelope(value) {
 	checkJsonDepth(value);
 	const envelopeSource = record(value);
 	if (envelopeSource.kind != "open-flow-flow-revision" || envelopeSource.version != 1) throw new TypeError("The value is not an Open Flow Revision envelope.");
-	if (typeof envelopeSource.modelVersion == "number" && envelopeSource.modelVersion > 4) throw new TypeError("The Flow model is newer than this package.");
+	if (typeof envelopeSource.modelVersion == "number" && envelopeSource.modelVersion > 5) throw new TypeError("The Flow model is newer than this package.");
 	const sourceDocument = record(envelopeSource.modelVersion == 1 || envelopeSource.modelVersion == 2 ? upgradeLegacyDocument(envelopeSource.document) : envelopeSource.document);
 	const bindings = record(sourceDocument.bindings);
 	const sourceGraph = repairGraph(sourceDocument.graph, bindings);
@@ -6126,7 +6163,7 @@ function repairRevisionEnvelope(value) {
 		return result.success ? [[id, result.data]] : [];
 	}));
 	return decodeRevisionContent({
-		modelVersion: 4,
+		modelVersion: 5,
 		document: {
 			bindings: repairedEntries(sourceDocument.bindings, binding),
 			graph: sourceGraph,
@@ -6142,7 +6179,10 @@ function decodeFlowDocument(value) {
 }
 function decodeRevisionContent(value) {
 	checkJsonDepth(value);
-	return revision.parse(value);
+	const content = revision.parse(value);
+	checkErrorModelVersion(content);
+	assertOpenApiAuthBindings(content.document);
+	return content;
 }
 function decodeRevisionEnvelope(value) {
 	checkJsonDepth(value);
@@ -6152,6 +6192,8 @@ function decodeRevisionEnvelope(value) {
 		document: upgradeLegacyDocument(revisionSource.document)
 	} : value;
 	const content = envelope.parse(candidate);
+	checkErrorModelVersion(content);
+	assertOpenApiAuthBindings(content.document);
 	return {
 		modelVersion: content.modelVersion,
 		document: content.document,
@@ -6159,6 +6201,11 @@ function decodeRevisionEnvelope(value) {
 	};
 }
 var shapes = {
+	"graph.trigger.sources.set": {
+		nodeId: text,
+		before: sourceFlowIds.optional(),
+		value: sourceFlowIds.optional()
+	},
 	"binding.create": {
 		bindingId: text,
 		binding
@@ -6312,6 +6359,11 @@ var shapes = {
 		before: text.optional(),
 		value: text.optional()
 	},
+	"task.openapi.set": {
+		taskId: text,
+		before: managed,
+		value: managed
+	},
 	"task.agent.set": {
 		taskId: text,
 		before: managed,
@@ -6332,6 +6384,9 @@ array(union([...new Map(Object.entries(shapes).map(([kind, shape]) => [kind, sha
 	kind: literal(kind),
 	...shape
 })])).values()])).min(1);
+function checkErrorModelVersion(content) {
+	if (content.modelVersion < 5 && [content.document.graph, ...Object.values(content.document.subflows).map((item) => item.graph)].some((item) => Object.values(item.nodes).some((itemNode) => itemNode.kind == "error"))) throw new TypeError("Error workflows require Flow model version 5.");
+}
 //#endregion
 //#region src/flow/common/encoding.ts
 var encoder = new TextEncoder();
@@ -6606,6 +6661,10 @@ function canonicalTriggerNode(trigger) {
 		name: trigger.name
 	});
 	switch (trigger.kind) {
+		case "error": return {
+			...common(trigger.kind),
+			...trigger.sourceFlowIds == null ? {} : { sourceFlowIds: [...trigger.sourceFlowIds] }
+		};
 		case "manual": return common(trigger.kind);
 		case "webhook": return {
 			...common(trigger.kind),
@@ -6705,7 +6764,7 @@ function revisionRepairKind(bytes) {
 		return;
 	}
 	const source = value;
-	return typeof source.modelVersion == "number" && source.modelVersion < 4 ? "upgrade" : "repair";
+	return typeof source.modelVersion == "number" && source.modelVersion < 5 ? "upgrade" : "repair";
 }
 function repairRevision(bytes) {
 	return repairRevisionEnvelope(revisionValue(bytes));