@oomol-lab/open-flow 0.1.0-beta.69 → 0.1.0-beta.70

package/dist/common/webhook-trigger.js

@@ -22,6 +22,133 @@ function dequal(foo, bar) {
 	return foo !== foo && bar !== bar;
 }
 //#endregion
+//#region src/base/common/json.ts
+function hasJsonShape(root) {
+	if (root === null || typeof root == "boolean" || typeof root == "string") return true;
+	if (typeof root == "number") return Number.isFinite(root);
+	if (typeof root != "object") return false;
+	const ancestors = /* @__PURE__ */ new Set();
+	const pending = [];
+	let value = root;
+	traversal: while (true) {
+		let keys;
+		let arrayLength;
+		if (Array.isArray(value)) {
+			arrayLength = value.length;
+			keys = Reflect.ownKeys(value);
+			if (keys.length != arrayLength + 1) return false;
+		} else {
+			const prototype = Reflect.getPrototypeOf(value);
+			if (prototype != Object.prototype && prototype != null) return false;
+			keys = Reflect.ownKeys(value);
+			arrayLength = void 0;
+		}
+		ancestors.add(value);
+		let index = 0;
+		while (true) {
+			if (index >= keys.length) {
+				ancestors.delete(value);
+				const parent = pending.pop();
+				if (parent === void 0) return true;
+				value = parent.value;
+				keys = parent.keys;
+				arrayLength = parent.arrayLength;
+				index = parent.index;
+				continue;
+			}
+			const key = keys[index++];
+			if (arrayLength !== void 0) {
+				if (key == "length") continue;
+				if (typeof key != "string") return false;
+				const arrayIndex = Number(key);
+				if (!Number.isSafeInteger(arrayIndex) || arrayIndex < 0 || arrayIndex >= arrayLength || String(arrayIndex) != key) return false;
+			} else if (typeof key != "string") return false;
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+			if (descriptor?.enumerable != true || !Object.hasOwn(descriptor, "value")) return false;
+			const child = descriptor.value;
+			if (child === null || typeof child == "boolean" || typeof child == "string") continue;
+			if (typeof child == "number") {
+				if (!Number.isFinite(child)) return false;
+				continue;
+			}
+			if (typeof child != "object" || ancestors.has(child)) return false;
+			pending.push({
+				value,
+				keys,
+				arrayLength,
+				index
+			});
+			value = child;
+			continue traversal;
+		}
+	}
+}
+function isJsonObject(value) {
+	try {
+		return value != null && typeof value == "object" && !Array.isArray(value) && hasJsonShape(value);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/flow/common/webhookResponse.ts
+var webhookResponseTimeout = {
+	defaultMs: 3e4,
+	minMs: 1e3,
+	maxMs: 6e4
+};
+function webhookResponseAllowsBody(status) {
+	return status !== 204 && status !== 205 && status !== 304;
+}
+var webhookHeadersPort = {
+	jsonSchema: {
+		type: "object",
+		additionalProperties: { type: [
+			"string",
+			"number",
+			"boolean"
+		] }
+	},
+	nullable: true
+};
+/** Header names are case-insensitive; never silently combine duplicate business fields. */
+function webhookHeaderNameIssue(name, names) {
+	if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) return "invalid";
+	if (names.some((candidate) => candidate.toLowerCase() === name.toLowerCase())) return "duplicate";
+}
+webhookHeadersPort.jsonSchema;
+function validWebhookStatus(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 200 && value <= 599 && webhookResponseAllowsBody(value);
+}
+/** Portable validation also runs in the isolated engine, which has no HTTP globals. */
+function webhookHeaderValues(source) {
+	if (source == null || typeof source !== "object" || Array.isArray(source)) return;
+	const headers = {};
+	const names = [];
+	for (const [name, value] of Object.entries(source)) {
+		if (webhookHeaderNameIssue(name, names) != null) return;
+		if (typeof value !== "string" && typeof value !== "boolean" && !(typeof value === "number" && Number.isFinite(value))) return;
+		const text = String(value);
+		if ([...text].some((character) => character.charCodeAt(0) > 255 || /[\0\r\n]/.test(character))) return;
+		names.push(name);
+		Object.defineProperty(headers, name, {
+			value: text,
+			enumerable: true,
+			configurable: true
+		});
+	}
+	return headers;
+}
+function encodeWebhookBody(value) {
+	return typeof value === "string" ? {
+		body: value,
+		contentType: "text/plain;charset=UTF-8"
+	} : {
+		body: JSON.stringify(value),
+		contentType: "application/json"
+	};
+}
+//#endregion
 //#region ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
 	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
@@ -1043,7 +1170,7 @@ function timeSource(args) {
 function time(args) {
 	return new RegExp(`^${timeSource(args)}$`);
 }
-function datetime(args) {
+function datetime$1(args) {
 	const opts = ["Z"];
 	if (args.offset) opts.push(`([+-](?:[01]\\d|2[0-3]):[0-5]\\d)`);
 	const qualified = `${timeSource({
@@ -1694,7 +1821,7 @@ var $ZodKSUID = /*@__PURE__*/ $constructor("$ZodKSUID", (inst, def) => {
 	$ZodStringFormat.init(inst, def);
 });
 var $ZodISODateTime = /*@__PURE__*/ $constructor("$ZodISODateTime", (inst, def) => {
-	def.pattern ?? (def.pattern = datetime(def));
+	def.pattern ?? (def.pattern = datetime$1(def));
 	$ZodStringFormat.init(inst, def);
 });
 var $ZodISODate = /*@__PURE__*/ $constructor("$ZodISODate", (inst, def) => {
@@ -5691,6 +5818,11 @@ function preprocess(fn, schema) {
 	});
 }
 //#endregion
+//#region ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/iso.js
+function datetime(params) {
+	return /* @__PURE__ */ _isoDateTime(ZodISODateTime, params);
+}
+//#endregion
 //#region src/decision/common/decision.ts
 var decisionLimits = {
 	choice: 255,
@@ -5810,6 +5942,32 @@ var triggerScheduleSchema = array(union([object({
 	value: number()
 })]));
 //#endregion
+//#region src/localization/common/timeZone.ts
+/** Validate a named timezone using the same runtime data used for date conversion. */
+function isTimeZone(value) {
+	try {
+		Intl.DateTimeFormat("en", { timeZone: value });
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/flow/common/wait.ts
+/** Drafts retain incomplete values; semantic validation gates publication and execution. */
+var waitAutoContinueDraftSchema = discriminatedUnion("kind", [strictObject({
+	kind: literal("after"),
+	durationMs: number().nullable()
+}), strictObject({
+	kind: literal("at"),
+	at: string(),
+	timezone: string().optional()
+})]);
+discriminatedUnion("kind", [waitAutoContinueDraftSchema.options[0].extend({ durationMs: number().int().positive().max(Number.MAX_SAFE_INTEGER) }), waitAutoContinueDraftSchema.options[1].extend({
+	at: datetime({ offset: true }),
+	timezone: string().refine(isTimeZone, "Select a valid IANA timezone.").optional()
+})]);
+//#endregion
 //#region src/flow/common/webhookMethod.ts
 var webhookMethods = [
 	"GET",
@@ -6048,9 +6206,24 @@ var webhookOptions = object({
 	allowedMethods: never().optional(),
 	allowedOrigins: strings.optional(),
 	noResponseBody: never().optional(),
+	responseBody: discriminatedUnion("kind", [strictObject({
+		kind: literal("workflow-outputs"),
+		output: text.optional(),
+		timeoutMs: number().int().min(webhookResponseTimeout.minMs).max(webhookResponseTimeout.maxMs).optional()
+	}), strictObject({
+		kind: literal("webhook-response"),
+		nodeId: text.optional(),
+		timeoutMs: number().int().min(webhookResponseTimeout.minMs).max(webhookResponseTimeout.maxMs).optional()
+	})]).optional(),
 	responseData: text.optional(),
 	responseHeaders: record$1(text, text).optional(),
-	responseStatusCode: number().int().min(200).max(599).optional()
+	responseHeadersSource: strictObject({
+		kind: literal("workflow-outputs"),
+		output: text.optional()
+	}).optional(),
+	responseHeaderOutputs: record$1(text, text).optional(),
+	responseStatusCode: number().int().min(200).max(599).optional(),
+	responseStatusCodeOutput: text.optional()
 });
 var webhook = {
 	bodyFields: array(input),
@@ -6105,6 +6278,12 @@ var base = {
 	onError: _enum(["stop", "error"]).optional()
 };
 var node = union([
+	strictObject({
+		...base,
+		kind: literal("webhook-response"),
+		retry: never().optional(),
+		onError: never().optional()
+	}),
 	strictObject({
 		...base,
 		kind: literal("outputs"),
@@ -6137,7 +6316,8 @@ var node = union([
 	strictObject({
 		...base,
 		kind: literal("wait"),
-		...wait
+		...wait,
+		autoContinue: waitAutoContinueDraftSchema.optional()
 	}).omit({ timeoutMs: true }),
 	object({
 		...trigger,
@@ -6224,7 +6404,8 @@ object({
 		literal(6),
 		literal(7),
 		literal(8),
-		literal(9)
+		literal(9),
+		literal(10)
 	]),
 	document,
 	modules: record$1(text, module)
@@ -6349,8 +6530,14 @@ var shapes = {
 	},
 	"graph.node.resolution.set": {
 		...at,
-		before: object(wait),
-		value: object(wait)
+		before: strictObject({
+			...wait,
+			autoContinue: waitAutoContinueDraftSchema.optional()
+		}),
+		value: strictObject({
+			...wait,
+			autoContinue: waitAutoContinueDraftSchema.optional()
+		})
 	},
 	"graph.node.webhook.set": {
 		...at,
@@ -9169,6 +9356,46 @@ createSchemaComparer();
 //#endregion
 //#region src/trigger/common/webhook.ts
 var maximumWebhookBodyBytes = 65536;
+/** Serialize only declared workflow business outputs, never node logs or execution metadata. */
+function webhookResponseBody(result, source) {
+	const value = workflowOutputValue(result, source.output);
+	if (value === void 0) return;
+	return encodeWebhookBody(value);
+}
+function webhookResponseStatusCode(result, output) {
+	const value = workflowOutputValue(result, output);
+	if (validWebhookStatus(value)) return value;
+}
+/** Project business headers before the HTTP layer applies its deployment-owned header policy. */
+function webhookResponseHeaders(result, options) {
+	const whole = options.responseHeadersSource;
+	const source = whole == null ? options.responseHeaders ?? {} : workflowOutputValue(result, whole.output);
+	if (!isJsonObject(source)) return;
+	const values = /* @__PURE__ */ new Map();
+	for (const [name, value] of Object.entries(source)) {
+		if (webhookHeaderNameIssue(name, [...values.values()].map((entry) => entry.name)) != null) return;
+		values.set(name.toLowerCase(), {
+			name,
+			value
+		});
+	}
+	if (whole == null) {
+		const names = [];
+		for (const [name, output] of Object.entries(options.responseHeaderOutputs ?? {})) {
+			if (webhookHeaderNameIssue(name, names) != null) return;
+			names.push(name);
+			values.set(name.toLowerCase(), {
+				name,
+				value: workflowOutputValue(result, output)
+			});
+		}
+	}
+	return webhookHeaderValues(Object.fromEntries([...values.values()].map(({ name, value }) => [name, value])));
+}
+function workflowOutputValue(result, output) {
+	if (!isJsonObject(result) || result.kind != "node-results" || !isJsonObject(result.outputs)) return;
+	return output == null ? result.outputs : Object.hasOwn(result.outputs, output) ? result.outputs[output] : void 0;
+}
 var endpointPattern = /^\/v1\/webhooks\/(endpoint_[0-9a-f]{32})$/;
 var encoder = new TextEncoder();
 function webhookEndpointId(url) {
@@ -9393,7 +9620,7 @@ var webhookConformanceCases = [
 				headers: {
 					"access-control-allow-credentials": null,
 					"content-security-policy": "default-src 'none'; frame-ancestors 'none'; sandbox",
-					"content-type": "text/plain;charset=UTF-8",
+					"content-type": "text/html",
 					"location": null,
 					"referrer-policy": "no-referrer",
 					"set-cookie": null,
@@ -9570,4 +9797,4 @@ var webhookConformanceCases = [
 	}
 ];
 //#endregion
-export { maximumWebhookBodyBytes, webhookConformanceCases, webhookEndpointId, webhookOccurrenceId, webhookSupportsBody };
+export { maximumWebhookBodyBytes, webhookConformanceCases, webhookEndpointId, webhookOccurrenceId, webhookResponseAllowsBody, webhookResponseBody, webhookResponseHeaders, webhookResponseStatusCode, webhookResponseTimeout, webhookSupportsBody };

package/dist/common/workflow.js

@@ -1043,7 +1043,7 @@ function timeSource(args) {
 function time$1(args) {
 	return new RegExp(`^${timeSource(args)}$`);
 }
-function datetime(args) {
+function datetime$1(args) {
 	const opts = ["Z"];
 	if (args.offset) opts.push(`([+-](?:[01]\\d|2[0-3]):[0-5]\\d)`);
 	const qualified = `${timeSource({
@@ -1694,7 +1694,7 @@ var $ZodKSUID = /*@__PURE__*/ $constructor("$ZodKSUID", (inst, def) => {
 	$ZodStringFormat.init(inst, def);
 });
 var $ZodISODateTime = /*@__PURE__*/ $constructor("$ZodISODateTime", (inst, def) => {
-	def.pattern ?? (def.pattern = datetime(def));
+	def.pattern ?? (def.pattern = datetime$1(def));
 	$ZodStringFormat.init(inst, def);
 });
 var $ZodISODate = /*@__PURE__*/ $constructor("$ZodISODate", (inst, def) => {
@@ -5691,6 +5691,11 @@ function preprocess(fn, schema) {
 	});
 }
 //#endregion
+//#region ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/iso.js
+function datetime(params) {
+	return /* @__PURE__ */ _isoDateTime(ZodISODateTime, params);
+}
+//#endregion
 //#region ../../node_modules/.bun/@cfworker+json-schema@4.1.1/node_modules/@cfworker/json-schema/dist/esm/deep-compare-strict.js
 function deepCompareStrict(a, b) {
 	const typeofa = typeof a;
@@ -6690,6 +6695,32 @@ var triggerScheduleSchema = array(union([object({
 	value: number()
 })]));
 //#endregion
+//#region src/localization/common/timeZone.ts
+/** Validate a named timezone using the same runtime data used for date conversion. */
+function isTimeZone(value) {
+	try {
+		Intl.DateTimeFormat("en", { timeZone: value });
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/flow/common/wait.ts
+/** Drafts retain incomplete values; semantic validation gates publication and execution. */
+var waitAutoContinueDraftSchema = discriminatedUnion("kind", [strictObject({
+	kind: literal("after"),
+	durationMs: number().nullable()
+}), strictObject({
+	kind: literal("at"),
+	at: string(),
+	timezone: string().optional()
+})]);
+discriminatedUnion("kind", [waitAutoContinueDraftSchema.options[0].extend({ durationMs: number().int().positive().max(Number.MAX_SAFE_INTEGER) }), waitAutoContinueDraftSchema.options[1].extend({
+	at: datetime({ offset: true }),
+	timezone: string().refine(isTimeZone, "Select a valid IANA timezone.").optional()
+})]);
+//#endregion
 //#region src/flow/common/webhookMethod.ts
 var webhookMethods = [
 	"GET",
@@ -6698,6 +6729,24 @@ var webhookMethods = [
 	"PATCH",
 	"DELETE"
 ];
+//#endregion
+//#region src/flow/common/webhookResponse.ts
+var webhookResponseTimeout = {
+	defaultMs: 3e4,
+	minMs: 1e3,
+	maxMs: 6e4
+};
+({
+	jsonSchema: {
+		type: "object",
+		additionalProperties: { type: [
+			"string",
+			"number",
+			"boolean"
+		] }
+	},
+	nullable: true
+}).jsonSchema;
 var text = string();
 var actionConnection = text.describe("Account selection: omit while unconfigured; use an account ID to select it; use \"\" to explicitly defer configuration. Deferred Actions fail if called; deferred Agent tools are excluded from the callable tool set. Not supported by Triggers.");
 var json = json$1();
@@ -6925,9 +6974,24 @@ var webhookOptions = object({
 	allowedMethods: never().optional(),
 	allowedOrigins: strings.optional(),
 	noResponseBody: never().optional(),
+	responseBody: discriminatedUnion("kind", [strictObject({
+		kind: literal("workflow-outputs"),
+		output: text.optional(),
+		timeoutMs: number().int().min(webhookResponseTimeout.minMs).max(webhookResponseTimeout.maxMs).optional()
+	}), strictObject({
+		kind: literal("webhook-response"),
+		nodeId: text.optional(),
+		timeoutMs: number().int().min(webhookResponseTimeout.minMs).max(webhookResponseTimeout.maxMs).optional()
+	})]).optional(),
 	responseData: text.optional(),
 	responseHeaders: record$1(text, text).optional(),
-	responseStatusCode: number().int().min(200).max(599).optional()
+	responseHeadersSource: strictObject({
+		kind: literal("workflow-outputs"),
+		output: text.optional()
+	}).optional(),
+	responseHeaderOutputs: record$1(text, text).optional(),
+	responseStatusCode: number().int().min(200).max(599).optional(),
+	responseStatusCodeOutput: text.optional()
 });
 var webhook = {
 	bodyFields: array(input),
@@ -6982,6 +7046,12 @@ var base = {
 	onError: _enum(["stop", "error"]).optional()
 };
 var node = union([
+	strictObject({
+		...base,
+		kind: literal("webhook-response"),
+		retry: never().optional(),
+		onError: never().optional()
+	}),
 	strictObject({
 		...base,
 		kind: literal("outputs"),
@@ -7014,7 +7084,8 @@ var node = union([
 	strictObject({
 		...base,
 		kind: literal("wait"),
-		...wait
+		...wait,
+		autoContinue: waitAutoContinueDraftSchema.optional()
 	}).omit({ timeoutMs: true }),
 	object({
 		...trigger,
@@ -7101,7 +7172,8 @@ object({
 		literal(6),
 		literal(7),
 		literal(8),
-		literal(9)
+		literal(9),
+		literal(10)
 	]),
 	document,
 	modules: record$1(text, module)
@@ -7226,8 +7298,14 @@ var shapes = {
 	},
 	"graph.node.resolution.set": {
 		...at,
-		before: object(wait),
-		value: object(wait)
+		before: strictObject({
+			...wait,
+			autoContinue: waitAutoContinueDraftSchema.optional()
+		}),
+		value: strictObject({
+			...wait,
+			autoContinue: waitAutoContinueDraftSchema.optional()
+		})
 	},
 	"graph.node.webhook.set": {
 		...at,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oomol-lab/open-flow",
-  "version": "0.1.0-beta.69",
+  "version": "0.1.0-beta.70",
   "description": "TypeScript contracts and Browser runtime for Open Flow.",
   "license": "Apache-2.0",
   "repository": {

package/skills/open-flow/references/flow-authoring.md

@@ -291,16 +291,16 @@ selection rules come from the selected node contract.
 
 For Connector Tasks, independent Code Actions, Agent tools and notifications, an omitted `connectionId` means unconfigured; `connectionId: ""` explicitly defers account configuration. Deferred selections pass account readiness checks but fail with `connector.connection-required` if invoked. Deferred Agent tools are excluded from the callable tool set. Provider Triggers still require a nonempty account ID. Public edits and portable exports preserve the empty string; clear the field to return to the unconfigured state.
 
-| Capability                      | Relevant schema and configuration                                                                                                  |
-| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
-| Provider read or write          | `connector`: discovered `action`, optional `connectionId`, named input bindings.                                                   |
-| Provider event                  | `poll` or `integration`: discovered `key`, Connection and any static inputs; polling also has a schedule.                          |
-| Manual, HTTP or scheduled entry | `start`, `webhook`, `cron`: workflow `inputDefs`, HTTP body fields, or schedule.                                                   |
-| Workflow failure handler        | `error`: published upstream Flows' automatic Run failures; not a node-level catch or a handler for manual Run failures.            |
-| Call another workflow           | `workflow`: select an owned published Flow ID; inputs and outputs derive from its saved contract. Use `node.refresh` to update it. |
-| Fixed HTTP operation            | `openapi`: an OpenAPI source, path and method; resolved authentication choices and ports appear in node details.                   |
-| Reusable constants              | `value`: named JSON values and optional output constraints.                                                                        |
-| Durable interaction             | `wait`, `approval`: prompt and named inputs; resume through the Run's Wait ID.                                                     |
+| Capability                      | Relevant schema and configuration                                                                                                                                                                                                   |
+| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Provider read or write          | `connector`: discovered `action`, optional `connectionId`, named input bindings.                                                                                                                                                    |
+| Provider event                  | `poll` or `integration`: discovered `key`, Connection and any static inputs; polling also has a schedule.                                                                                                                           |
+| Manual, HTTP or scheduled entry | `start`, `webhook`, `cron`: workflow `inputDefs`, HTTP body fields, or schedule.                                                                                                                                                    |
+| Workflow failure handler        | `error`: published upstream Flows' automatic Run failures; not a node-level catch or a handler for manual Run failures.                                                                                                             |
+| Call another workflow           | `workflow`: select an owned published Flow ID; inputs and outputs derive from its saved contract. Use `node.refresh` to update it.                                                                                                  |
+| Fixed HTTP operation            | `openapi`: an OpenAPI source, path and method; resolved authentication choices and ports appear in node details.                                                                                                                    |
+| Reusable constants              | `value`: named JSON values and optional output constraints.                                                                                                                                                                         |
+| Durable interaction             | `wait`, `approval`: prompt and named inputs; resume through the Run's Wait ID. Wait additionally supports optional `config.autoContinue` with `{kind:"after",durationMs:86400000}` or `{kind:"at",at:"2026-10-25T10:00:00+08:00"}`. |
 
 Connector and LLM services are configured on the Server. Missing capabilities
 should be described in terms of the required operation or event, without silently
@@ -340,6 +340,11 @@ Declare parameters on Start: `{"op":"node.add","as":"start","type":"start","name
 <!-- agentic:var flowCommand --> runs resolve RUN_ID WAIT_ID approve --json
 ```
 
+Only Wait supports automatic continuation. Omit `config.autoContinue` for manual waiting or clear
+`["config", "autoContinue"]` to disable it. Relative timing starts at each Wait registration;
+absolute timestamps require an offset. Optional `timezone` stores the editor zone; `at` remains the absolute instant. Server rejects deadlines at or beyond its seven-day expiry
+when registering the Wait. The first manual or automatic decision wins.
+
 A Wait or Approval suspends the existing Run. `run.waits` carries its Wait IDs;
 resolution uses `continue`, `approve` or `reject` as appropriate to that wait and
 the authorized decision. A client timeout also leaves the operation running.