@oomol-lab/open-flow 0.1.0-beta.74 → 0.1.0-beta.76

package/dist/common/flow-semantics.js

@@ -3973,6 +3973,9 @@ function hasRetiredRef(value) {
 }
 //#endregion
 //#region src/decision/common/decision.ts
+function isDecisionExecutor(executor) {
+	return executor.kind === "decision";
+}
 var decisionLimits = {
 	choice: 255,
 	score: 10
@@ -3995,7 +3998,7 @@ function limitDecisionQuestions(questions) {
 }
 /** Loading an oversized task also updates its previously generated output schemas. */
 function limitDecisionTask(task) {
-	if (task.executor.kind !== "decision") return task;
+	if (!isDecisionExecutor(task.executor)) return task;
 	const original = task.executor.questions;
 	const questions = limitDecisionQuestions(original);
 	if (questions === original) return task;
@@ -4120,7 +4123,7 @@ function decisionTask(questions = [defaultDecisionQuestion()], name = "AI Decisi
 }
 function decisionTaskIssues(task) {
 	task = limitDecisionTask(task);
-	if (task.executor.kind !== "decision") return [];
+	if (!isDecisionExecutor(task.executor)) return [];
 	const expected = decisionTask(task.executor.questions, task.name);
 	return [...decisionQuestionIssues(task.executor.questions), ...!dequal(task.inputs, expected.inputs) || !dequal(task.outputs, expected.outputs) ? [{
 		field: "ports",
@@ -4128,422 +4131,67 @@ function decisionTaskIssues(task) {
 	}] : []];
 }
 //#endregion
-//#region src/openapi/common/openapi.ts
-var methods = [
-	"get",
-	"put",
-	"post",
-	"delete",
-	"options",
-	"head",
-	"patch",
-	"trace"
-];
-function object$1(value) {
-	if (value == null || typeof value != "object" || Array.isArray(value)) throw new Error("Expected an OpenAPI object.");
-	return value;
-}
-function httpUrl(value, base) {
-	const url = new URL(value, base);
-	if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash) throw new Error("An HTTP(S) URL without credentials or fragment is required.");
-	return url.href;
+//#region ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/util.js
+function getEnumValues(entries) {
+	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
+	return Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
 }
-function parseOpenApi(value) {
-	const doc = object$1(value);
-	if (typeof doc.openapi != "string" || !/^3\.[01]\.\d+$/.test(doc.openapi)) throw new Error("Only OpenAPI 3.0 and 3.1 JSON documents are supported.");
-	object$1(doc.paths);
-	return doc;
+function joinValues(array, separator = "|") {
+	return array.map((val) => stringifyPrimitive(val)).join(separator);
 }
-function pointer(doc, ref) {
-	if (!ref.startsWith("#/")) throw new Error("External OpenAPI references are not supported.");
-	let value = doc;
-	for (const key of decodeURIComponent(ref.slice(2)).split("/").map((part) => part.replace(/~1/g, "/").replace(/~0/g, "~"))) {
-		const source = object$1(value);
-		if (!Object.hasOwn(source, key)) throw new Error("An OpenAPI reference is missing.");
-		value = source[key];
-	}
+function jsonStringifyReplacer(_, value) {
+	if (typeof value === "bigint") return value.toString();
 	return value;
 }
-function resolved(doc, value) {
-	let result = object$1(value);
-	const seen = /* @__PURE__ */ new Set();
-	while (typeof result.$ref == "string") {
-		if (seen.has(result.$ref)) throw new Error("Circular non-schema reference is unsupported.");
-		seen.add(result.$ref);
-		const { $ref, ...siblings } = result;
-		result = {
-			...object$1(pointer(doc, $ref)),
-			...siblings
-		};
-	}
-	return result;
-}
-function operation(doc, path, method) {
-	const item = resolved(doc, object$1(doc.paths)[path]);
-	if (!methods.includes(method) || item[method] == null) throw new Error("The selected operation is no longer available.");
-	return {
-		item,
-		op: object$1(item[method])
-	};
-}
-function servers(value, path, method) {
-	const doc = parseOpenApi(value);
-	const { item, op } = operation(doc, path, method);
-	const entries = op.servers ?? item.servers ?? doc.servers;
-	if (!Array.isArray(entries) || entries.length == 0) return [{ url: "/" }];
-	return entries.map(object$1);
-}
-function snapshot(documentValue, path, method) {
-	const doc = parseOpenApi(documentValue);
-	const { item, op } = operation(doc, path, method);
-	const security = op.security ?? doc.security ?? [];
-	const result = {
-		openapi: doc.openapi,
-		paths: { [path]: {
-			[method]: op,
-			...item.parameters == null ? {} : { parameters: item.parameters }
-		} },
-		servers: servers(doc, path, method),
-		security
-	};
-	const visited = /* @__PURE__ */ new Set();
-	function copy(ref) {
-		if (visited.has(ref)) return;
-		visited.add(ref);
-		const value = pointer(doc, ref);
-		const keys = decodeURIComponent(ref.slice(2)).split("/").map((part) => part.replace(/~1/g, "/").replace(/~0/g, "~"));
-		if (keys.some((key) => [
-			"__proto__",
-			"constructor",
-			"prototype"
-		].includes(key))) throw new Error("Unsupported reference key.");
-		let target = result;
-		for (const key of keys.slice(0, -1)) {
-			if (!Object.hasOwn(target, key)) target[key] = {};
-			target = object$1(target[key]);
-		}
-		target[keys.at(-1)] = structuredClone(value);
-		visit(value);
+var Cached = class {
+	constructor(getter) {
+		this._getter = getter;
+		this._value = void 0;
 	}
-	function visit(value) {
-		if (value == null || typeof value != "object") return;
-		if (Array.isArray(value)) {
-			value.forEach(visit);
-			return;
+	get value() {
+		const getter = this._getter;
+		if (getter !== void 0) {
+			this._value = getter();
+			this._getter = void 0;
 		}
-		if (typeof object$1(value).$ref == "string") copy(object$1(value).$ref);
-		for (const [key, child] of Object.entries(value)) if (![
-			"example",
-			"examples",
-			"default"
-		].includes(key)) visit(child);
+		return this._value;
 	}
-	visit(result);
-	for (const entry of security) for (const name of Object.keys(object$1(entry))) copy(`#/components/securitySchemes/${name.replace(/~/g, "~0").replace(/\//g, "~1")}`);
-	return structuredClone(result);
+};
+function cached(getter) {
+	return new Cached(getter);
 }
-function schema$1(doc, schemaValue) {
-	const defs = {};
-	const ids = /* @__PURE__ */ new Map();
-	function convert(value) {
-		if (typeof value == "boolean") return value;
-		const source = object$1(value);
-		if (source.format == "binary" || source.$dynamicRef != null || source.$id != null) throw new Error("Binary and dynamically scoped schemas are unsupported.");
-		const result = {};
-		for (const [key, child] of Object.entries(source)) {
-			if ([
-				"nullable",
-				"example",
-				"xml",
-				"discriminator",
-				"__proto__"
-			].includes(key)) continue;
-			if (key == "$ref") {
-				if (typeof child != "string") throw new Error("Invalid schema reference.");
-				let id = ids.get(child);
-				if (id == null) {
-					id = `s${ids.size}`;
-					ids.set(child, id);
-					defs[id] = convert(pointer(doc, child));
-				}
-				result.$ref = `#/$defs/${id}`;
-			} else if ([
-				"properties",
-				"patternProperties",
-				"$defs",
-				"definitions",
-				"dependentSchemas"
-			].includes(key)) result[key] = Object.fromEntries(Object.entries(object$1(child)).map(([name, childSchema]) => [name, convert(childSchema)]));
-			else if ([
-				"allOf",
-				"anyOf",
-				"oneOf",
-				"prefixItems"
-			].includes(key)) {
-				if (!Array.isArray(child)) throw new Error("Invalid schema composition.");
-				result[key] = child.map(convert);
-			} else if ([
-				"items",
-				"additionalProperties",
-				"not",
-				"if",
-				"then",
-				"else",
-				"contains",
-				"propertyNames",
-				"unevaluatedProperties"
-			].includes(key)) result[key] = convert(child);
-			else result[key] = child;
-		}
-		if (source.nullable === true) return { anyOf: [result, { type: "null" }] };
-		for (const key of ["minimum", "maximum"]) {
-			const exclusive = key == "minimum" ? "exclusiveMinimum" : "exclusiveMaximum";
-			if (typeof result[exclusive] == "boolean") {
-				if (result[exclusive] && typeof result[key] == "number") {
-					result[exclusive] = result[key];
-					delete result[key];
-				} else delete result[exclusive];
-			}
-		}
-		return result;
-	}
-	let converted = convert(schemaValue);
-	if (typeof converted == "object" && converted != null && typeof object$1(converted).$ref == "string") {
-		const id = String(object$1(converted).$ref).slice(8);
-		const { $ref: _ref, ...siblings } = object$1(converted);
-		converted = {
-			...object$1(defs[id]),
-			...siblings
-		};
-	}
-	if (typeof converted == "boolean") return converted;
-	return {
-		$schema: "https://json-schema.org/draft/2020-12/schema",
-		...object$1(converted),
-		...Object.keys(defs).length ? { $defs: defs } : {}
-	};
+function nullish(input) {
+	return input === null || input === void 0;
 }
-function parameters(config) {
-	const doc = parseOpenApi(config.document);
-	const { item, op } = operation(doc, config.path, config.method);
-	const entries = /* @__PURE__ */ new Map();
-	for (const value of [...item.parameters ?? [], ...op.parameters ?? []]) {
-		const p = resolved(doc, value);
-		if (![
-			"path",
-			"query",
-			"header"
-		].includes(String(p.in)) || typeof p.name != "string" || p.content != null) throw new Error("Only schema-based path, query and header parameters are supported.");
-		if (p.allowReserved === true) throw new Error("allowReserved parameters are unsupported.");
-		if ((p.style ?? (p.in == "query" ? "form" : "simple")) != (p.in == "query" ? "form" : "simple")) throw new Error("Only form query and simple path/header serialization are supported.");
-		entries.set(`${p.in}.${p.in == "header" ? p.name.toLowerCase() : p.name}`, p);
-	}
-	return [...entries.values()];
+function cleanRegex(source) {
+	const start = source.startsWith("^") ? 1 : 0;
+	const end = source.endsWith("$") ? source.length - 1 : source.length;
+	return source.slice(start, end);
 }
-function jsonContent(doc, value) {
-	const content = resolved(doc, value);
-	const media = object$1(content.content);
-	const mediaType = media["application/json"] != null ? "application/json" : Object.keys(media).find((key) => /^application\/.+\+json$/.test(key));
-	const json = mediaType == null ? void 0 : media[mediaType];
-	if (json == null) throw new Error("Only JSON request and response bodies are supported.");
-	return {
-		schema: schema$1(doc, object$1(json).schema ?? {}),
-		required: content.required === true,
-		mediaType
-	};
+function floatSafeRemainder(val, step) {
+	const ratio = val / step;
+	const roundedRatio = Math.round(ratio);
+	const tolerance = 4 * Number.EPSILON * Math.max(Math.abs(ratio), 1);
+	if (Math.abs(ratio - roundedRatio) < tolerance) return 0;
+	return ratio - roundedRatio;
 }
-function authHandles(auth) {
-	return auth.flatMap((scheme) => scheme.type == "basic" ? [`auth.${scheme.id}.username`, `auth.${scheme.id}.password`] : [`auth.${scheme.id}.token`]);
-}
-function openApiTask(config, name = "OpenAPI") {
-	if (!config.path) return {
-		name,
-		executor: config,
-		inputs: [],
-		outputs: []
-	};
-	const doc = parseOpenApi(config.document);
-	const { op } = operation(doc, config.path, config.method);
-	const params = parameters(config);
-	const inputs = params.map((p) => {
-		const jsonSchema = schema$1(doc, p.schema ?? {});
-		const defaultValue = typeof jsonSchema == "boolean" ? void 0 : object$1(jsonSchema).default;
-		return {
-			handle: `${p.in}.${p.name}`,
-			jsonSchema,
-			nullable: p.required !== true && p.in != "path" || matchesSchema(null, jsonSchema),
-			...typeof p.description == "string" ? { description: p.description } : {},
-			...defaultValue === void 0 ? {} : { value: defaultValue }
-		};
-	});
-	if (op.requestBody != null) {
-		if (config.method == "get" || config.method == "head") throw new Error("GET and HEAD request bodies are unsupported.");
-		const body = jsonContent(doc, op.requestBody);
-		inputs.push({
-			handle: "body",
-			jsonSchema: body.schema,
-			nullable: !body.required || matchesSchema(null, body.schema)
-		});
-	}
-	const occupied = new Set(params.map((p) => `${p.in}.${p.in == "header" ? String(p.name).toLowerCase() : p.name}`));
-	for (const auth of config.auth) {
-		const location = auth.type == "apiKey" ? `${auth.in}.${auth.in == "header" ? auth.name?.toLowerCase() : auth.name}` : "header.authorization";
-		if (occupied.has(location)) throw new Error("Authentication conflicts with a parameter or another security scheme.");
-		if (auth.type == "apiKey" && (!auth.name || !["header", "query"].includes(auth.in ?? ""))) throw new Error("API Key requires a name and location.");
-		occupied.add(location);
-	}
-	inputs.push(...authHandles(config.auth).map((handle) => ({
-		handle,
-		jsonSchema: { type: "string" },
-		nullable: false
-	})));
-	const responses = object$1(op.responses);
-	const schemas = [];
-	for (const [status, response] of Object.entries(responses)) if (/^2\d\d$|^2XX$/.test(status) || status == "default") {
-		const r = resolved(doc, response);
-		if (r.content == null) schemas.push({ type: "null" });
-		else {
-			jsonContent(doc, r);
-			for (const [mediaType, media] of Object.entries(object$1(r.content))) if (/^application\/(json|.+\+json)$/.test(mediaType)) schemas.push(schema$1(doc, object$1(media).schema ?? {}));
-		}
-	}
-	if (!schemas.length) throw new Error("A successful JSON response definition is required.");
-	return {
-		name,
-		executor: config,
-		inputs,
-		outputs: [
-			{
-				handle: "body",
-				jsonSchema: schemas.length == 1 ? schemas[0] : {
-					$schema: "https://json-schema.org/draft/2020-12/schema",
-					anyOf: schemas.map((s, index) => inlineSchema(s, index))
-				},
-				nullable: config.method == "head" || schemas.some((item) => matchesSchema(null, item))
-			},
-			{
-				handle: "statusCode",
-				jsonSchema: { type: "integer" },
-				nullable: false
-			},
-			{
-				handle: "headers",
-				jsonSchema: {
-					type: "object",
-					additionalProperties: { type: "string" }
-				},
-				nullable: false
-			}
-		]
-	};
-}
-function inlineSchema(value, index) {
-	if (Array.isArray(value)) return value.map((item) => inlineSchema(item, index));
-	if (value == null || typeof value != "object") return value;
-	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, key == "$ref" && typeof child == "string" && child.startsWith("#/") ? `#/anyOf/${index}/${child.slice(2)}` : inlineSchema(child, index)]));
-}
-/** The canvas validator and property panel share the same configuration contract. */
-function openApiFieldIssues(task) {
-	if (task.executor.kind != "openapi") return [];
-	const config = task.executor;
-	let field = "sourceUrl";
-	try {
-		if (!config.sourceUrl.trim()) return [{
-			field,
-			message: "Enter an OpenAPI JSON document URL."
-		}];
-		httpUrl(config.sourceUrl);
-		field = "operation";
-		if (!config.path) return [{
-			field,
-			message: "Select an OpenAPI operation."
-		}];
-		field = "serverUrl";
-		httpUrl(config.serverUrl);
-		if (new URL(config.serverUrl).search) throw new Error("Server URLs must not contain a query string.");
-		field = "operation";
-		if (!dequal(config.document, snapshot(config.document, config.path, config.method))) return [{
-			field,
-			message: "Save only the selected operation and its dependencies."
-		}];
-		const expected = openApiTask(config, task.name);
-		if (!dequal(expected.inputs, task.inputs) || !dequal(expected.outputs, task.outputs)) return [{
-			field,
-			message: "OpenAPI ports must match the saved operation."
-		}];
-		return [];
-	} catch (error) {
-		return [{
-			field,
-			message: error.message
-		}];
-	}
-}
-function openApiIssues(task) {
-	return openApiFieldIssues(task).map((issue) => issue.message);
-}
-//#endregion
-//#region ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/util.js
-function getEnumValues(entries) {
-	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
-	return Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
-}
-function joinValues(array, separator = "|") {
-	return array.map((val) => stringifyPrimitive(val)).join(separator);
-}
-function jsonStringifyReplacer(_, value) {
-	if (typeof value === "bigint") return value.toString();
-	return value;
-}
-var Cached = class {
-	constructor(getter) {
-		this._getter = getter;
-		this._value = void 0;
-	}
-	get value() {
-		const getter = this._getter;
-		if (getter !== void 0) {
-			this._value = getter();
-			this._getter = void 0;
-		}
-		return this._value;
-	}
-};
-function cached(getter) {
-	return new Cached(getter);
-}
-function nullish(input) {
-	return input === null || input === void 0;
-}
-function cleanRegex(source) {
-	const start = source.startsWith("^") ? 1 : 0;
-	const end = source.endsWith("$") ? source.length - 1 : source.length;
-	return source.slice(start, end);
-}
-function floatSafeRemainder(val, step) {
-	const ratio = val / step;
-	const roundedRatio = Math.round(ratio);
-	const tolerance = 4 * Number.EPSILON * Math.max(Math.abs(ratio), 1);
-	if (Math.abs(ratio - roundedRatio) < tolerance) return 0;
-	return ratio - roundedRatio;
-}
-var EVALUATING = /* @__PURE__*/ Symbol("evaluating");
-function defineLazy(object, key, getter) {
-	let value = void 0;
-	Object.defineProperty(object, key, {
-		get() {
-			if (value === EVALUATING) return;
-			if (value === void 0) {
-				value = EVALUATING;
-				value = getter();
-			}
-			return value;
-		},
-		set(v) {
-			Object.defineProperty(object, key, { value: v });
-		},
-		configurable: true
-	});
+var EVALUATING = /* @__PURE__*/ Symbol("evaluating");
+function defineLazy(object, key, getter) {
+	let value = void 0;
+	Object.defineProperty(object, key, {
+		get() {
+			if (value === EVALUATING) return;
+			if (value === void 0) {
+				value = EVALUATING;
+				value = getter();
+			}
+			return value;
+		},
+		set(v) {
+			Object.defineProperty(object, key, { value: v });
+		},
+		configurable: true
+	});
 }
 function assignProp(target, prop, value) {
 	Object.defineProperty(target, prop, {
@@ -9823,7 +9471,7 @@ var ZodObject = /*@__PURE__*/ $constructor("ZodObject", (inst, def) => {
 		return required(ZodNonOptional, this, args[0]);
 	}
 });
-function object(shape, params) {
+function object$1(shape, params) {
 	return new ZodObject({
 		type: "object",
 		shape: shape ?? {},
@@ -10120,101 +9768,599 @@ function lazy(getter) {
 		getter
 	});
 }
-var ZodCustom = /*@__PURE__*/ $constructor("ZodCustom", (inst, def) => {
-	$ZodCustom.init(inst, def);
-	ZodType.init(inst, def);
-	inst._zod.processJSONSchema = (ctx, json, params) => customProcessor(inst, ctx, json, params);
-});
-function refine(fn, _params = {}) {
-	return /* @__PURE__ */ _refine(ZodCustom, fn, _params);
+var ZodCustom = /*@__PURE__*/ $constructor("ZodCustom", (inst, def) => {
+	$ZodCustom.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => customProcessor(inst, ctx, json, params);
+});
+function refine(fn, _params = {}) {
+	return /* @__PURE__ */ _refine(ZodCustom, fn, _params);
+}
+function superRefine(fn, params) {
+	return /* @__PURE__ */ _superRefine(fn, params);
+}
+function json$1(params) {
+	const jsonSchema = lazy(() => {
+		return union([
+			string(params),
+			number(),
+			boolean(),
+			_null(),
+			array(jsonSchema),
+			record$1(string(), jsonSchema)
+		]);
+	});
+	return jsonSchema;
+}
+function preprocess(fn, schema) {
+	return new ZodPreprocess({
+		type: "pipe",
+		in: transform(fn),
+		out: schema
+	});
+}
+//#endregion
+//#region ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/iso.js
+function datetime(params) {
+	return /* @__PURE__ */ _isoDateTime(ZodISODateTime, params);
+}
+//#endregion
+//#region src/http/common/headers.ts
+/** Header names are case-insensitive; never silently combine duplicate business fields. */
+function httpHeaderNameIssue(name, names) {
+	if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) return "invalid";
+	if (names.some((candidate) => candidate.toLowerCase() === name.toLowerCase())) return "duplicate";
+}
+//#endregion
+//#region src/http/common/hosts.ts
+/** Hosts of a Code `http` Capability: lowercase DNS names or IPv4 addresses; `*.example.com` matches subdomains only. */
+var httpHostPattern = /^(?:\*\.)?(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** Wildcards must name a registrable suffix, so `*.com` is rejected. */
+function isHttpHost(value) {
+	return httpHostPattern.test(value) && (!value.startsWith("*.") || value.slice(2).includes("."));
+}
+//#endregion
+//#region src/http/common/httpRequest.ts
+var parameterSchema = strictObject({
+	mode: _enum(["fields", "object"]).default("fields"),
+	names: array(string()).default([])
+});
+var httpRequestConfigSchema = strictObject({
+	method: _enum([
+		"GET",
+		"POST",
+		"PUT",
+		"PATCH",
+		"DELETE",
+		"HEAD",
+		"OPTIONS"
+	]).default("GET"),
+	query: parameterSchema.default({
+		mode: "fields",
+		names: []
+	}),
+	headers: parameterSchema.default({
+		mode: "fields",
+		names: []
+	}),
+	bodyFormat: _enum([
+		"none",
+		"json",
+		"text",
+		"form"
+	]).default("none"),
+	authentication: union([
+		strictObject({ type: literal("none") }),
+		strictObject({ type: _enum(["bearer", "basic"]) }),
+		strictObject({
+			type: literal("apiKey"),
+			name: string(),
+			in: _enum(["header", "query"])
+		})
+	]).default({ type: "none" }),
+	responseFormat: _enum([
+		"auto",
+		"json",
+		"text"
+	]).default("auto"),
+	statusPolicy: _enum(["success", "all"]).default("success")
+});
+var httpRequestExecutorSchema = httpRequestConfigSchema.extend({ kind: literal("http-request") });
+var scalarSchema = { type: [
+	"string",
+	"number",
+	"boolean"
+] };
+var queryValueSchema = { anyOf: [scalarSchema, {
+	type: "array",
+	items: scalarSchema
+}] };
+var httpHeaderSchema = {
+	type: "object",
+	additionalProperties: { type: "string" }
+};
+var httpQuerySchema = {
+	type: "object",
+	additionalProperties: queryValueSchema
+};
+function httpAuthHandles(config) {
+	return config.authentication.type == "none" ? [] : config.authentication.type == "basic" ? ["auth.username", "auth.password"] : ["auth.token"];
+}
+function retain(ports, old) {
+	const remaining = new Map(ports.map((port) => [port.handle, port]));
+	return [...old.flatMap((item) => {
+		if ("group" in item) return [item];
+		const next = remaining.get(item.handle);
+		if (next == null) return [];
+		remaining.delete(item.handle);
+		return [dequal(item.jsonSchema, next.jsonSchema) && item.nullable == next.nullable ? item : next];
+	}), ...remaining.values()];
+}
+function httpRequestTask(config = httpRequestConfigSchema.parse({}), name = "HTTP Request", previous) {
+	const inputs = [{
+		handle: "url",
+		jsonSchema: { type: "string" },
+		nullable: false
+	}];
+	for (const group of ["query", "headers"]) if (config[group].mode == "object") inputs.push({
+		handle: group,
+		jsonSchema: group == "query" ? httpQuerySchema : httpHeaderSchema,
+		nullable: true
+	});
+	else for (const parameterName of config[group].names.filter((value) => value.trim())) inputs.push({
+		handle: `${group == "query" ? "query" : "header"}.${parameterName}`,
+		jsonSchema: group == "query" ? queryValueSchema : { type: "string" },
+		nullable: true
+	});
+	if (config.bodyFormat != "none") inputs.push({
+		handle: "body",
+		jsonSchema: config.bodyFormat == "json" ? {} : config.bodyFormat == "text" ? { type: "string" } : httpQuerySchema,
+		nullable: config.bodyFormat == "json"
+	});
+	inputs.push(...httpAuthHandles(config).map((handle) => ({
+		handle,
+		jsonSchema: { type: "string" },
+		nullable: false
+	})));
+	const outputs = [
+		{
+			handle: "body",
+			jsonSchema: config.responseFormat == "text" ? { type: "string" } : {},
+			nullable: true
+		},
+		{
+			handle: "statusCode",
+			jsonSchema: { type: "integer" },
+			nullable: false
+		},
+		{
+			handle: "headers",
+			jsonSchema: httpHeaderSchema,
+			nullable: false
+		}
+	];
+	return {
+		name,
+		executor: {
+			...config,
+			kind: "http-request"
+		},
+		inputs: retain(inputs, previous?.inputs ?? []),
+		outputs: retain(outputs, previous?.outputs ?? [])
+	};
+}
+function httpRequestIssues(config) {
+	const issues = [];
+	if (["GET", "HEAD"].includes(config.method) && config.bodyFormat != "none") issues.push({
+		field: "bodyFormat",
+		code: "bodyUnsupported",
+		message: "GET and HEAD do not support a request body."
+	});
+	for (const group of ["query", "headers"]) {
+		if (config[group].mode != "fields") continue;
+		const seen = /* @__PURE__ */ new Set();
+		for (const [index, name] of config[group].names.entries()) {
+			const key = group == "headers" ? name.toLowerCase() : name;
+			if (!name.trim() || seen.has(key)) issues.push({
+				field: group,
+				index,
+				code: "parameterNamesInvalid",
+				message: "Parameter names must be nonempty and unique."
+			});
+			seen.add(key);
+			if (group == "headers" && httpHeaderNameIssue(name, []) === "invalid") issues.push({
+				field: group,
+				index,
+				code: "headerNameInvalid",
+				message: "Invalid HTTP header name."
+			});
+		}
+	}
+	const auth = config.authentication;
+	if (auth.type != "none") {
+		const group = auth.type == "apiKey" && auth.in == "query" ? "query" : "headers";
+		const name = auth.type == "apiKey" ? auth.name : "authorization";
+		if (!name.trim()) issues.push({
+			field: "authentication",
+			code: "keyNameRequired",
+			message: "API Key requires a name."
+		});
+		if (group == "headers" && name.trim() && httpHeaderNameIssue(name, []) === "invalid") issues.push({
+			field: "authentication",
+			code: "headerNameInvalid",
+			message: "Invalid authentication header name."
+		});
+		if (config[group].mode == "fields" && config[group].names.some((item) => group == "headers" ? item.toLowerCase() == name.toLowerCase() : item == name)) issues.push({
+			field: "authentication",
+			code: "authConflict",
+			message: "Authentication conflicts with a request parameter."
+		});
+	}
+	return issues;
+}
+function httpRequestUrl(value) {
+	if (typeof value != "string" || !value.trim()) throw new Error("A URL is required.");
+	const url = new URL(value);
+	if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) throw new Error("An HTTP(S) URL without credentials is required.");
+	return url;
+}
+//#endregion
+//#region src/openapi/common/openapi.ts
+var methods = [
+	"get",
+	"put",
+	"post",
+	"delete",
+	"options",
+	"head",
+	"patch",
+	"trace"
+];
+function object(value) {
+	if (value == null || typeof value != "object" || Array.isArray(value)) throw new Error("Expected an OpenAPI object.");
+	return value;
+}
+function httpUrl(value, base) {
+	const url = new URL(value, base);
+	if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash) throw new Error("An HTTP(S) URL without credentials or fragment is required.");
+	return url.href;
+}
+function parseOpenApi(value) {
+	const doc = object(value);
+	if (typeof doc.openapi != "string" || !/^3\.[01]\.\d+$/.test(doc.openapi)) throw new Error("Only OpenAPI 3.0 and 3.1 JSON documents are supported.");
+	object(doc.paths);
+	return doc;
+}
+function pointer(doc, ref) {
+	if (!ref.startsWith("#/")) throw new Error("External OpenAPI references are not supported.");
+	let value = doc;
+	for (const key of decodeURIComponent(ref.slice(2)).split("/").map((part) => part.replace(/~1/g, "/").replace(/~0/g, "~"))) {
+		const source = object(value);
+		if (!Object.hasOwn(source, key)) throw new Error("An OpenAPI reference is missing.");
+		value = source[key];
+	}
+	return value;
+}
+function resolved(doc, value) {
+	let result = object(value);
+	const seen = /* @__PURE__ */ new Set();
+	while (typeof result.$ref == "string") {
+		if (seen.has(result.$ref)) throw new Error("Circular non-schema reference is unsupported.");
+		seen.add(result.$ref);
+		const { $ref, ...siblings } = result;
+		result = {
+			...object(pointer(doc, $ref)),
+			...siblings
+		};
+	}
+	return result;
+}
+function operation(doc, path, method) {
+	const item = resolved(doc, object(doc.paths)[path]);
+	if (!methods.includes(method) || item[method] == null) throw new Error("The selected operation is no longer available.");
+	return {
+		item,
+		op: object(item[method])
+	};
+}
+function servers(value, path, method) {
+	const doc = parseOpenApi(value);
+	const { item, op } = operation(doc, path, method);
+	const entries = op.servers ?? item.servers ?? doc.servers;
+	if (!Array.isArray(entries) || entries.length == 0) return [{ url: "/" }];
+	return entries.map(object);
+}
+function snapshot(documentValue, path, method) {
+	const doc = parseOpenApi(documentValue);
+	const { item, op } = operation(doc, path, method);
+	const security = op.security ?? doc.security ?? [];
+	const result = {
+		openapi: doc.openapi,
+		paths: { [path]: {
+			[method]: op,
+			...item.parameters == null ? {} : { parameters: item.parameters }
+		} },
+		servers: servers(doc, path, method),
+		security
+	};
+	const visited = /* @__PURE__ */ new Set();
+	function copy(ref) {
+		if (visited.has(ref)) return;
+		visited.add(ref);
+		const value = pointer(doc, ref);
+		const keys = decodeURIComponent(ref.slice(2)).split("/").map((part) => part.replace(/~1/g, "/").replace(/~0/g, "~"));
+		if (keys.some((key) => [
+			"__proto__",
+			"constructor",
+			"prototype"
+		].includes(key))) throw new Error("Unsupported reference key.");
+		let target = result;
+		for (const key of keys.slice(0, -1)) {
+			if (!Object.hasOwn(target, key)) target[key] = {};
+			target = object(target[key]);
+		}
+		target[keys.at(-1)] = structuredClone(value);
+		visit(value);
+	}
+	function visit(value) {
+		if (value == null || typeof value != "object") return;
+		if (Array.isArray(value)) {
+			value.forEach(visit);
+			return;
+		}
+		if (typeof object(value).$ref == "string") copy(object(value).$ref);
+		for (const [key, child] of Object.entries(value)) if (![
+			"example",
+			"examples",
+			"default"
+		].includes(key)) visit(child);
+	}
+	visit(result);
+	for (const entry of security) for (const name of Object.keys(object(entry))) copy(`#/components/securitySchemes/${name.replace(/~/g, "~0").replace(/\//g, "~1")}`);
+	return structuredClone(result);
+}
+function schema$1(doc, schemaValue) {
+	const defs = {};
+	const ids = /* @__PURE__ */ new Map();
+	function convert(value) {
+		if (typeof value == "boolean") return value;
+		const source = object(value);
+		if (source.format == "binary" || source.$dynamicRef != null || source.$id != null) throw new Error("Binary and dynamically scoped schemas are unsupported.");
+		const result = {};
+		for (const [key, child] of Object.entries(source)) {
+			if ([
+				"nullable",
+				"example",
+				"xml",
+				"discriminator",
+				"__proto__"
+			].includes(key)) continue;
+			if (key == "$ref") {
+				if (typeof child != "string") throw new Error("Invalid schema reference.");
+				let id = ids.get(child);
+				if (id == null) {
+					id = `s${ids.size}`;
+					ids.set(child, id);
+					defs[id] = convert(pointer(doc, child));
+				}
+				result.$ref = `#/$defs/${id}`;
+			} else if ([
+				"properties",
+				"patternProperties",
+				"$defs",
+				"definitions",
+				"dependentSchemas"
+			].includes(key)) result[key] = Object.fromEntries(Object.entries(object(child)).map(([name, childSchema]) => [name, convert(childSchema)]));
+			else if ([
+				"allOf",
+				"anyOf",
+				"oneOf",
+				"prefixItems"
+			].includes(key)) {
+				if (!Array.isArray(child)) throw new Error("Invalid schema composition.");
+				result[key] = child.map(convert);
+			} else if ([
+				"items",
+				"additionalProperties",
+				"not",
+				"if",
+				"then",
+				"else",
+				"contains",
+				"propertyNames",
+				"unevaluatedProperties"
+			].includes(key)) result[key] = convert(child);
+			else result[key] = child;
+		}
+		if (source.nullable === true) return { anyOf: [result, { type: "null" }] };
+		for (const key of ["minimum", "maximum"]) {
+			const exclusive = key == "minimum" ? "exclusiveMinimum" : "exclusiveMaximum";
+			if (typeof result[exclusive] == "boolean") {
+				if (result[exclusive] && typeof result[key] == "number") {
+					result[exclusive] = result[key];
+					delete result[key];
+				} else delete result[exclusive];
+			}
+		}
+		return result;
+	}
+	let converted = convert(schemaValue);
+	if (typeof converted == "object" && converted != null && typeof object(converted).$ref == "string") {
+		const id = String(object(converted).$ref).slice(8);
+		const { $ref: _ref, ...siblings } = object(converted);
+		converted = {
+			...object(defs[id]),
+			...siblings
+		};
+	}
+	if (typeof converted == "boolean") return converted;
+	return {
+		$schema: "https://json-schema.org/draft/2020-12/schema",
+		...object(converted),
+		...Object.keys(defs).length ? { $defs: defs } : {}
+	};
+}
+function isOpenApiExecutor(executor) {
+	return executor.kind == "openapi";
+}
+function parameters(config) {
+	const doc = parseOpenApi(config.document);
+	const { item, op } = operation(doc, config.path, config.method);
+	const entries = /* @__PURE__ */ new Map();
+	for (const value of [...item.parameters ?? [], ...op.parameters ?? []]) {
+		const p = resolved(doc, value);
+		if (![
+			"path",
+			"query",
+			"header"
+		].includes(String(p.in)) || typeof p.name != "string" || p.content != null) throw new Error("Only schema-based path, query and header parameters are supported.");
+		if (p.allowReserved === true) throw new Error("allowReserved parameters are unsupported.");
+		if ((p.style ?? (p.in == "query" ? "form" : "simple")) != (p.in == "query" ? "form" : "simple")) throw new Error("Only form query and simple path/header serialization are supported.");
+		entries.set(`${p.in}.${p.in == "header" ? p.name.toLowerCase() : p.name}`, p);
+	}
+	return [...entries.values()];
+}
+function jsonContent(doc, value) {
+	const content = resolved(doc, value);
+	const media = object(content.content);
+	const mediaType = media["application/json"] != null ? "application/json" : Object.keys(media).find((key) => /^application\/.+\+json$/.test(key));
+	const json = mediaType == null ? void 0 : media[mediaType];
+	if (json == null) throw new Error("Only JSON request and response bodies are supported.");
+	return {
+		schema: schema$1(doc, object(json).schema ?? {}),
+		required: content.required === true,
+		mediaType
+	};
 }
-function superRefine(fn, params) {
-	return /* @__PURE__ */ _superRefine(fn, params);
+function authHandles(auth) {
+	return auth.flatMap((scheme) => scheme.type == "basic" ? [`auth.${scheme.id}.username`, `auth.${scheme.id}.password`] : [`auth.${scheme.id}.token`]);
 }
-function json$1(params) {
-	const jsonSchema = lazy(() => {
-		return union([
-			string(params),
-			number(),
-			boolean(),
-			_null(),
-			array(jsonSchema),
-			record$1(string(), jsonSchema)
-		]);
+function openApiTask(config, name = "OpenAPI") {
+	if (!config.path) return {
+		name,
+		executor: config,
+		inputs: [],
+		outputs: []
+	};
+	const doc = parseOpenApi(config.document);
+	const { op } = operation(doc, config.path, config.method);
+	const params = parameters(config);
+	const inputs = params.map((p) => {
+		const jsonSchema = schema$1(doc, p.schema ?? {});
+		const defaultValue = typeof jsonSchema == "boolean" ? void 0 : object(jsonSchema).default;
+		return {
+			handle: `${p.in}.${p.name}`,
+			jsonSchema,
+			nullable: p.required !== true && p.in != "path" || matchesSchema(null, jsonSchema),
+			...typeof p.description == "string" ? { description: p.description } : {},
+			...defaultValue === void 0 ? {} : { value: defaultValue }
+		};
 	});
-	return jsonSchema;
+	if (op.requestBody != null) {
+		if (config.method == "get" || config.method == "head") throw new Error("GET and HEAD request bodies are unsupported.");
+		const body = jsonContent(doc, op.requestBody);
+		inputs.push({
+			handle: "body",
+			jsonSchema: body.schema,
+			nullable: !body.required || matchesSchema(null, body.schema)
+		});
+	}
+	const occupied = new Set(params.map((p) => `${p.in}.${p.in == "header" ? String(p.name).toLowerCase() : p.name}`));
+	for (const auth of config.auth) {
+		const location = auth.type == "apiKey" ? `${auth.in}.${auth.in == "header" ? auth.name?.toLowerCase() : auth.name}` : "header.authorization";
+		if (occupied.has(location)) throw new Error("Authentication conflicts with a parameter or another security scheme.");
+		if (auth.type == "apiKey" && (!auth.name || !["header", "query"].includes(auth.in ?? ""))) throw new Error("API Key requires a name and location.");
+		occupied.add(location);
+	}
+	inputs.push(...authHandles(config.auth).map((handle) => ({
+		handle,
+		jsonSchema: { type: "string" },
+		nullable: false
+	})));
+	const responses = object(op.responses);
+	const schemas = [];
+	for (const [status, response] of Object.entries(responses)) if (/^2\d\d$|^2XX$/.test(status) || status == "default") {
+		const r = resolved(doc, response);
+		if (r.content == null) schemas.push({ type: "null" });
+		else {
+			jsonContent(doc, r);
+			for (const [mediaType, media] of Object.entries(object(r.content))) if (/^application\/(json|.+\+json)$/.test(mediaType)) schemas.push(schema$1(doc, object(media).schema ?? {}));
+		}
+	}
+	if (!schemas.length) throw new Error("A successful JSON response definition is required.");
+	return {
+		name,
+		executor: config,
+		inputs,
+		outputs: [
+			{
+				handle: "body",
+				jsonSchema: schemas.length == 1 ? schemas[0] : {
+					$schema: "https://json-schema.org/draft/2020-12/schema",
+					anyOf: schemas.map((s, index) => inlineSchema(s, index))
+				},
+				nullable: config.method == "head" || schemas.some((item) => matchesSchema(null, item))
+			},
+			{
+				handle: "statusCode",
+				jsonSchema: { type: "integer" },
+				nullable: false
+			},
+			{
+				handle: "headers",
+				jsonSchema: {
+					type: "object",
+					additionalProperties: { type: "string" }
+				},
+				nullable: false
+			}
+		]
+	};
 }
-function preprocess(fn, schema) {
-	return new ZodPreprocess({
-		type: "pipe",
-		in: transform(fn),
-		out: schema
-	});
+function inlineSchema(value, index) {
+	if (Array.isArray(value)) return value.map((item) => inlineSchema(item, index));
+	if (value == null || typeof value != "object") return value;
+	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, key == "$ref" && typeof child == "string" && child.startsWith("#/") ? `#/anyOf/${index}/${child.slice(2)}` : inlineSchema(child, index)]));
 }
-//#endregion
-//#region ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/iso.js
-function datetime(params) {
-	return /* @__PURE__ */ _isoDateTime(ZodISODateTime, params);
+/** The canvas validator and property panel share the same configuration contract. */
+function openApiFieldIssues(task) {
+	if (!isOpenApiExecutor(task.executor)) return [];
+	const config = task.executor;
+	let field = "sourceUrl";
+	try {
+		if (!config.sourceUrl.trim()) return [{
+			field,
+			message: "Enter an OpenAPI JSON document URL."
+		}];
+		httpUrl(config.sourceUrl);
+		field = "operation";
+		if (!config.path) return [{
+			field,
+			message: "Select an OpenAPI operation."
+		}];
+		field = "serverUrl";
+		httpUrl(config.serverUrl);
+		if (new URL(config.serverUrl).search) throw new Error("Server URLs must not contain a query string.");
+		field = "operation";
+		if (!dequal(config.document, snapshot(config.document, config.path, config.method))) return [{
+			field,
+			message: "Save only the selected operation and its dependencies."
+		}];
+		const expected = openApiTask(config, task.name);
+		if (!dequal(expected.inputs, task.inputs) || !dequal(expected.outputs, task.outputs)) return [{
+			field,
+			message: "OpenAPI ports must match the saved operation."
+		}];
+		return [];
+	} catch (error) {
+		return [{
+			field,
+			message: error.message
+		}];
+	}
 }
-//#endregion
-//#region src/workflow/common/workflow.ts
-var portSchema = object({
-	handle: string().min(1),
-	jsonSchema: json$1(),
-	nullable: boolean(),
-	description: string().optional()
-});
-strictObject({
-	inputs: array(portSchema).nullable(),
-	outputs: array(portSchema).nullable()
-});
-object({
-	version: literal(1),
-	flowId: string().min(1),
-	name: string(),
-	revisionId: string().min(1),
-	publicationId: string().min(1),
-	inputs: array(portSchema),
-	outputs: array(portSchema).nullable()
-});
-object({
-	version: literal(1),
-	direction: _enum(["incoming", "outgoing"]),
-	total: int().nonnegative(),
-	nextOffset: int().nonnegative().optional(),
-	references: array(object({
-		flowId: string(),
-		name: string().nullable(),
-		available: boolean(),
-		draft: boolean(),
-		live: object({
-			publicationId: string(),
-			enabled: boolean()
-		}).nullable()
-	}))
-});
-/** Workflow declarations share discovery across authoring, admission and resource indexing. */
-function nodeWorkflowReferences(node) {
-	if (node.kind != "task") return [];
-	if ("moduleId" in node.task) return (node.task.capabilities ?? []).flatMap((item, index) => item.kind == "workflow" ? [{
-		target: item,
-		path: `task/capabilities/${index}`,
-		tool: item.name
-	}] : []);
-	if (node.task.executor.kind == "workflow") return [{
-		target: {
-			...node.task.executor,
-			inputs: node.task.inputs.filter((port) => "handle" in port),
-			outputs: node.task.outputs.filter((port) => "handle" in port)
-		},
-		path: "task/executor"
-	}];
-	if (node.task.executor.kind == "agent") return node.task.executor.tools.flatMap((item, index) => item.kind == "workflow" ? [{
-		target: item,
-		path: `task/executor/tools/${index}`,
-		tool: item.name
-	}] : []);
-	return [];
+function openApiIssues(task) {
+	return openApiFieldIssues(task).map((issue) => issue.message);
 }
 //#endregion
 //#region src/flow/common/inputValue.ts
@@ -10233,6 +10379,7 @@ var retryNodeTypes = [
 	"code",
 	"connector",
 	"openapi",
+	"http-request",
 	"llm",
 	"decision"
 ];
@@ -10251,11 +10398,11 @@ function supportsNodeRetry(node) {
 }
 //#endregion
 //#region src/flow/common/triggerScheduleSchema.ts
-var triggerScheduleSchema = array(union([object({
+var triggerScheduleSchema = array(union([object$1({
 	type: literal("cron"),
 	expression: string(),
 	timezone: string()
-}), object({
+}), object$1({
 	type: literal("every"),
 	unit: _enum([
 		"day",
@@ -10349,11 +10496,6 @@ function workflowOutputsPort(outputs) {
 		nullable: false
 	};
 }
-/** Header names are case-insensitive; never silently combine duplicate business fields. */
-function webhookHeaderNameIssue(name, names) {
-	if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) return "invalid";
-	if (names.some((candidate) => candidate.toLowerCase() === name.toLowerCase())) return "duplicate";
-}
 /** Fixed inputs belong to the node, not author-supplied definitions. */
 var webhookResponseInputs = [
 	{
@@ -10384,7 +10526,7 @@ function webhookHeaderValues(source) {
 	const headers = {};
 	const names = [];
 	for (const [name, value] of Object.entries(source)) {
-		if (webhookHeaderNameIssue(name, names) != null) return;
+		if (httpHeaderNameIssue(name, names) != null) return;
 		if (typeof value !== "string" && typeof value !== "boolean" && !(typeof value === "number" && Number.isFinite(value))) return;
 		const text = String(value);
 		if ([...text].some((character) => character.charCodeAt(0) > 255 || /[\0\r\n]/.test(character))) return;
@@ -10401,7 +10543,7 @@ var text = string();
 var actionConnection = text.describe("Account selection: omit while unconfigured; use an account ID to select it; use \"\" to explicitly defer configuration. Deferred Actions fail if called; deferred Agent tools are excluded from the callable tool set. Not supported by Triggers.");
 var json = json$1();
 var strings = array(text);
-var port = object({
+var port = object$1({
 	description: text.optional(),
 	jsonSchema: json,
 	nullable: boolean(),
@@ -10409,25 +10551,25 @@ var port = object({
 });
 var workflowInputDefs = array(port.strict());
 var input = port.extend({ value: json.optional() });
-var group = object({
+var group = object$1({
 	collapsed: boolean().optional(),
 	group: text
 });
-var source = union([object({
+var source = union([object$1({
 	kind: literal("node"),
 	nodeId: text,
 	output: text,
 	system: literal(true).optional(),
 	field: text.optional()
-}), object({
+}), object$1({
 	kind: literal("binding"),
 	bindingId: text
 })]);
-var fixedInput = union([object({ kind: literal("unset") }), object({
+var fixedInput = union([object$1({ kind: literal("unset") }), object$1({
 	kind: literal("value"),
 	value: json
 })]);
-var mapping = union([fixedInput, object({
+var mapping = union([fixedInput, object$1({
 	kind: literal("sources"),
 	sources: array(source)
 })]);
@@ -10476,21 +10618,28 @@ var workflowCapabilitySchema = strictObject({
 	inputs: array(port),
 	outputs: array(port).nullable()
 });
-var capability = union([connectorCapabilitySchema, workflowCapabilitySchema]);
-var inline = object({
+var capability = union([
+	connectorCapabilitySchema,
+	workflowCapabilitySchema,
+	strictObject({
+		kind: literal("http"),
+		hosts: array(text.refine(isHttpHost, "Use a lowercase host name or IPv4 address, optionally prefixed by \"*.\" for subdomains.")).min(1).max(20).describe("Hosts Code may call with context.fetch. \"*.example.com\" matches subdomains only.")
+	})
+]);
+var inline = object$1({
 	...ports,
 	name: text,
 	moduleId: text,
 	capabilities: array(capability).optional()
 });
-var agentValue = union([object({
+var agentValue = union([object$1({
 	kind: literal("value"),
 	value: json
-}), object({
+}), object$1({
 	kind: literal("input"),
 	input: text
 })]);
-var agentInput$1 = union([agentValue, object({ kind: literal("model") })]);
+var agentInput$1 = union([agentValue, object$1({ kind: literal("model") })]);
 var agentToolFields = {
 	id: text,
 	name: text,
@@ -10498,7 +10647,7 @@ var agentToolFields = {
 	approval: boolean(),
 	inputs: array(input.extend({ source: agentInput$1 }))
 };
-var connectorAgentToolSchema = object({
+var connectorAgentToolSchema = object$1({
 	...agentToolFields,
 	kind: literal("connector").optional(),
 	action: text,
@@ -10531,24 +10680,24 @@ var decisionQuestion = discriminatedUnion("type", [
 		criteria: strings
 	})
 ]);
-var managedFields = object({
+var managedFields = object$1({
 	...ports,
 	name: text,
 	executor: union([
-		object({
+		object$1({
 			kind: literal("connector"),
 			action: text,
 			connectionId: actionConnection.optional(),
 			outputMode: literal("value").optional()
 		}),
-		object({
+		object$1({
 			kind: literal("openapi"),
 			sourceUrl: text,
 			method: text,
 			path: text,
 			serverUrl: text,
 			document: json,
-			auth: array(object({
+			auth: array(object$1({
 				id: text,
 				type: _enum([
 					"bearer",
@@ -10563,18 +10712,18 @@ var managedFields = object({
 			kind: literal("decision"),
 			questions: array(decisionQuestion)
 		}),
-		object({
+		object$1({
 			kind: literal("llm"),
 			mode: _enum(["chat", "json"])
 		}),
-		object({
+		object$1({
 			kind: literal("agent"),
 			code: boolean().optional(),
 			model: text,
 			prompt: text,
 			maxRounds: number(),
 			tools: array(union([workflowAgentToolSchema, connectorAgentToolSchema])),
-			notification: object({
+			notification: object$1({
 				action: text,
 				connectionId: actionConnection.optional(),
 				inputDefinitions: array(input),
@@ -10586,24 +10735,25 @@ var managedFields = object({
 			kind: literal("workflow"),
 			flowId: text,
 			revisionId: text
-		})
+		}),
+		httpRequestExecutorSchema
 	])
 });
 var managed = managedFields.transform(limitDecisionTask);
-var operand = union([object({
+var operand = union([object$1({
 	kind: literal("value"),
 	value: json.optional(),
 	jsonSchema: json.optional()
-}), object({
+}), object$1({
 	kind: literal("source"),
 	source
 })]);
 var condition = {
 	matchMode: _enum(["first", "all"]),
-	cases: array(object({
+	cases: array(object$1({
 		description: text.optional(),
 		output: text,
-		groups: array(object({ expressions: array(object({
+		groups: array(object$1({ expressions: array(object$1({
 			left: operand,
 			operator: _enum([
 				"!=",
@@ -10635,7 +10785,7 @@ var wait = {
 	inputDefinitions: array(input),
 	prompt: text
 };
-var webhookOptions = object({
+var webhookOptions = object$1({
 	allowedMethods: never().optional(),
 	allowedOrigins: strings.optional(),
 	noResponseBody: never().optional(),
@@ -10673,8 +10823,8 @@ var definition = {
 	outputs: array(port).refine((definitions) => new Set(definitions.map((output) => output.handle)).size === definitions.length, "Duplicate Trigger output handle."),
 	provider: text
 };
-var endpoint = object({
-	body: object({
+var endpoint = object$1({
+	body: object$1({
 		allowArray: boolean(),
 		allowEmpty: boolean(),
 		formats: array(_enum([
@@ -10723,19 +10873,19 @@ var node = union([
 		outputDefs: array(port.strict()),
 		outputMappings: inputs
 	}).omit({ inputs: true }),
-	object({
+	object$1({
 		...base,
 		inputs: record$1(text, never()),
 		kind: literal("condition"),
 		...condition
 	}),
-	object({
+	object$1({
 		...base,
 		inputs: unknown().transform(() => ({})).default({}),
 		kind: literal("value"),
 		values: array(input)
 	}),
-	object({
+	object$1({
 		...base,
 		kind: literal("task"),
 		task: union([inline, managed]),
@@ -10752,7 +10902,7 @@ var node = union([
 		...wait,
 		autoContinue: waitAutoContinueDraftSchema.optional()
 	}).omit({ timeoutMs: true }),
-	object({
+	object$1({
 		...trigger,
 		kind: literal("manual")
 	}),
@@ -10766,33 +10916,33 @@ var node = union([
 		kind: literal("error"),
 		sourceFlowIds: sourceFlowIds.optional()
 	}),
-	object({
+	object$1({
 		...trigger,
 		kind: literal("webhook"),
 		...webhook
 	}),
-	object({
+	object$1({
 		...trigger,
 		kind: literal("cron"),
 		cronTimes: triggerScheduleSchema
 	}),
-	object({
+	object$1({
 		...trigger,
 		kind: literal("poll"),
 		connectionId: text.min(1).optional(),
 		config: record$1(text, fixedInput),
-		definition: object({
+		definition: object$1({
 			...definition,
 			type: literal("poll")
 		}),
 		pollTimes: triggerScheduleSchema
 	}),
-	object({
+	object$1({
 		...trigger,
 		kind: literal("integration"),
 		connectionId: text.min(1).optional(),
 		config: record$1(text, fixedInput),
-		definition: object({
+		definition: object$1({
 			...definition,
 			type: literal("integration"),
 			endpoint
@@ -10819,7 +10969,7 @@ var authoringDefinitionSchemas = {
 		notification: true
 	}).strict()
 };
-var edge = object({
+var edge = object$1({
 	source: text,
 	target: text,
 	sourceHandle: text.optional()
@@ -10828,24 +10978,24 @@ var at = {
 	nodeId: text,
 	target: never().optional()
 };
-var graph = object({
+var graph = object$1({
 	nodes: record$1(text, node),
 	edges: array(edge).default([])
 });
-var binding = object({
+var binding = object$1({
 	kind: literal("variable"),
 	target: text
 });
-var module = object({
+var module = object$1({
 	name: text,
 	imports: strings,
 	source: text
 });
-var document = preprocess(normalizeDocument, object({
+var document = preprocess(normalizeDocument, object$1({
 	bindings: record$1(text, binding),
 	graph
 }));
-object({
+object$1({
 	modelVersion: union([
 		literal(2),
 		literal(4),
@@ -10855,7 +11005,8 @@ object({
 		literal(8),
 		literal(9),
 		literal(10),
-		literal(11)
+		literal(11),
+		literal(12)
 	]),
 	document,
 	modules: record$1(text, module)
@@ -10916,21 +11067,21 @@ var shapes = {
 	},
 	"graph.node.delete": at,
 	"graph.node.field.set": union([
-		object({
+		object$1({
 			...at,
 			kind: literal("graph.node.field.set"),
 			field: literal("retry"),
 			before: retryConfigurationSchema.optional(),
 			value: retryConfigurationSchema.optional()
 		}),
-		object({
+		object$1({
 			...at,
 			kind: literal("graph.node.field.set"),
 			field: literal("connectionId"),
 			before: text.min(1).optional(),
 			value: text.min(1).optional()
 		}),
-		object({
+		object$1({
 			...at,
 			kind: literal("graph.node.field.set"),
 			field: _enum([
@@ -10942,14 +11093,14 @@ var shapes = {
 			before: text.optional(),
 			value: text.optional()
 		}),
-		object({
+		object$1({
 			...at,
 			kind: literal("graph.node.field.set"),
 			field: literal("maxExecutions"),
 			before: number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
 			value: number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
 		}),
-		object({
+		object$1({
 			...at,
 			kind: literal("graph.node.field.set"),
 			field: literal("timeoutMs"),
@@ -10970,8 +11121,8 @@ var shapes = {
 	},
 	"graph.node.condition.set": {
 		...at,
-		before: object(condition),
-		value: object(condition)
+		before: object$1(condition),
+		value: object$1(condition)
 	},
 	"graph.node.values.set": {
 		...at,
@@ -10991,13 +11142,13 @@ var shapes = {
 	},
 	"graph.node.webhook.set": {
 		...at,
-		before: object(webhook),
-		value: object(webhook)
+		before: object$1(webhook),
+		value: object$1(webhook)
 	},
 	"graph.node.task.ports.set": {
 		...at,
-		before: object(ports),
-		value: object(ports)
+		before: object$1(ports),
+		value: object$1(ports)
 	},
 	"graph.node.task.name.set": {
 		...at,
@@ -11043,7 +11194,7 @@ var shapes = {
 		value: union([inline, managed])
 	}
 };
-array(union([...new Map(Object.entries(shapes).map(([kind, shape]) => [kind, shape instanceof ZodType ? shape : object({
+array(union([...new Map(Object.entries(shapes).map(([kind, shape]) => [kind, shape instanceof ZodType ? shape : object$1({
 	kind: literal(kind),
 	...shape
 })])).values()])).min(1);
@@ -11210,13 +11361,15 @@ function nodeSystemOutputPorts(node) {
 	} } : {};
 }
 //#endregion
+//#region src/flow/common/model.ts
+function portsByHandle(ports) {
+	return Object.fromEntries(ports.flatMap((port) => "handle" in port ? [[port.handle, port]] : []));
+}
+//#endregion
 //#region src/flow/common/change.ts
 function validVariableName(value) {
 	return value.length <= 256 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(value) && value.slice(0, 3).toUpperCase() != "OO_";
 }
-function portsByHandle(ports) {
-	return Object.fromEntries(ports.flatMap((port) => "handle" in port ? [[port.handle, port]] : []));
-}
 var workflowToolNamePattern = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
 function workflowToolNameIssue(name, otherNames = []) {
 	if (!workflowToolNamePattern.test(name)) return "invalid";
@@ -11232,6 +11385,8 @@ function decodeTaskCapabilities(value) {
 		if (workflowToolNameIssue(item.name, names)) throw new TypeError("Workflow tool names must be unique provider-compatible names.");
 		names.add(item.name);
 	}
+	const http = parsed.filter((item) => item.kind == "http");
+	if (http.length > 1 || http.some((item) => new Set(item.hosts).size != item.hosts.length)) throw new TypeError("Code declares HTTP hosts once, without duplicates.");
 	let connectorIndex = 0;
 	return parsed.map((item) => item.kind == "connector" ? connectors[connectorIndex++] : item);
 }
@@ -11360,6 +11515,31 @@ function isTriggerNode(node) {
 	].includes(node.kind);
 }
 //#endregion
+//#region src/flow/common/workflowReferences.ts
+/** Workflow declarations share discovery across authoring, admission and resource indexing. */
+function nodeWorkflowReferences(node) {
+	if (node.kind != "task") return [];
+	if ("moduleId" in node.task) return (node.task.capabilities ?? []).flatMap((item, index) => item.kind == "workflow" ? [{
+		target: item,
+		path: `task/capabilities/${index}`,
+		tool: item.name
+	}] : []);
+	if (node.task.executor.kind == "workflow") return [{
+		target: {
+			...node.task.executor,
+			inputs: node.task.inputs.filter((port) => "handle" in port),
+			outputs: node.task.outputs.filter((port) => "handle" in port)
+		},
+		path: "task/executor"
+	}];
+	if (node.task.executor.kind == "agent") return node.task.executor.tools.flatMap((item, index) => item.kind == "workflow" ? [{
+		target: item,
+		path: `task/executor/tools/${index}`,
+		tool: item.name
+	}] : []);
+	return [];
+}
+//#endregion
 //#region src/flow/common/promptTemplate.ts
 var promptReferencePattern = /\{\{\s*([^{}\s]+)\s*\}\}/g;
 function renderPrompt(template, input) {
@@ -11454,7 +11634,7 @@ function clearNodeConnections(graph, connectionId) {
 				return [id, node];
 			}
 			const capabilities = node.task.capabilities?.map((capability) => {
-				if (capability.kind == "workflow") return capability;
+				if (capability.kind == "workflow" || capability.kind == "http") return capability;
 				if (!("mode" in capability)) {
 					if ("action" in capability) {
 						const { connectionId: selected, ...rest } = capability;
@@ -11699,21 +11879,25 @@ function normalizeTriggerOutputs(trigger, outputs) {
 	return matchesTriggerOutputs(trigger, normalized) ? normalized : void 0;
 }
 //#endregion
-//#region src/execution/common/engineContract.ts
-var currentEngineContract = "open-flow-engine/v8";
+//#region src/runtime/common/engineContract.ts
+/** v9 is a single contract: the Node compatibility builtins, `context.fetch`, and no `context.egress`. */
+var currentEngineContract = "open-flow-engine/v9";
+/** The published v8 Node compatibility contract, retained for existing Publications and Runs. */
 var nodejsEngineContract = "open-flow-engine/v8/nodejs-compat-v1";
-var currentContract = {
+var platformSource = (contract) => `export const engineContract = ${JSON.stringify(contract)}
+export function identity(value) { return value }
+`;
+var v8Contract = {
 	workflowTools: true,
+	httpRequests: true,
 	waitAutoContinue: true,
 	webhookResponses: true,
 	platformExports: /* @__PURE__ */ new Set(["engineContract", "identity"]),
 	platformModule: "open-flow:platform",
-	platformSource: `export const engineContract = ${JSON.stringify(currentEngineContract)}
-export function identity(value) { return value }
-`
+	platformSource: platformSource("open-flow-engine/v8")
 };
 var nodejsContract = {
-	...currentContract,
+	...v8Contract,
 	builtinModules: new Set([
 		"assert",
 		"assert/strict",
@@ -11740,26 +11924,30 @@ var nodejsContract = {
 		"util",
 		"zlib"
 	].flatMap((name) => [name, `node:${name}`])),
-	platformSource: `export const engineContract = ${JSON.stringify(nodejsEngineContract)}
-export function identity(value) { return value }
-`
+	platformSource: platformSource(nodejsEngineContract)
+};
+var currentContract = {
+	...nodejsContract,
+	codeFetch: true,
+	platformSource: platformSource(currentEngineContract)
 };
 function findEngineContract(contract) {
-	if (contract == "open-flow-engine/v8") return currentContract;
+	if (contract == "open-flow-engine/v9") return currentContract;
+	if (contract == "open-flow-engine/v8") return v8Contract;
 	if (contract == "open-flow-engine/v8/nodejs-compat-v1") return nodejsContract;
 	if (contract == "open-flow-engine/v7" || contract == "open-flow-engine/v7/nodejs-compat-v1") return {
-		...contract.endsWith("/nodejs-compat-v1") ? nodejsContract : currentContract,
+		...contract.endsWith("/nodejs-compat-v1") ? nodejsContract : v8Contract,
 		workflowTools: false,
-		platformSource: `export const engineContract = ${JSON.stringify(contract)}\nexport function identity(value) { return value }\n`
+		httpRequests: false,
+		platformSource: platformSource(contract)
 	};
 	if (contract == "open-flow-engine/v6" || contract == "open-flow-engine/v6/nodejs-compat-v1") return {
-		...contract == "open-flow-engine/v6" ? currentContract : nodejsContract,
+		...contract == "open-flow-engine/v6" ? v8Contract : nodejsContract,
 		workflowTools: false,
+		httpRequests: false,
 		waitAutoContinue: false,
 		webhookResponses: false,
-		platformSource: `export const engineContract = ${JSON.stringify(contract)}
-export function identity(value) { return value }
-`
+		platformSource: platformSource(contract)
 	};
 }
 //#endregion
@@ -12442,7 +12630,7 @@ function webhookResponseDiagnostics(graph, triggerId, path = `/document/graph/no
 	if (headersSource == null) for (const [headers, location] of [[options.responseHeaders, `${path}/options/responseHeaders`], [headerOutputs, headersPath]]) {
 		const names = [];
 		for (const name of Object.keys(headers ?? {})) {
-			if (webhookHeaderNameIssue(name, names) != null) diagnostics.push(graphDiagnostic("trigger.webhook-response-header-name", "Use valid, unique HTTP header names.", location));
+			if (httpHeaderNameIssue(name, names) != null) diagnostics.push(graphDiagnostic("trigger.webhook-response-header-name", "Use valid, unique HTTP header names.", location));
 			names.push(name);
 		}
 	}
@@ -24746,12 +24934,47 @@ async function validateFlow(revision, engine) {
 			message,
 			path: `/document/graph/nodes/${nodeId}/task/executor`
 		});
-		if (task.executor.kind == "openapi") {
-			const handles = authHandles(task.executor.auth);
+		if (task.executor.kind == "http-request") {
+			for (const issue of httpRequestIssues(task.executor)) checked.diagnostics.push({
+				code: "http-request.config-invalid",
+				column: 0,
+				line: 1,
+				message: issue.message,
+				path: `/document/graph/nodes/${nodeId}/task/executor/${issue.field}`
+			});
+			if (node.inputs.url?.kind == "value") try {
+				httpRequestUrl(node.inputs.url.value);
+			} catch {
+				checked.diagnostics.push({
+					code: "http-request.url-invalid",
+					column: 0,
+					line: 1,
+					message: "Enter an HTTP(S) URL without embedded credentials.",
+					path: `/document/graph/nodes/${nodeId}/inputs/url`
+				});
+			}
+			if (task.executor.bodyFormat != "none" && (node.inputs.body == null || node.inputs.body.kind == "unset")) checked.diagnostics.push({
+				code: "http-request.body-required",
+				column: 0,
+				line: 1,
+				message: "Set or bind the request body; JSON null is an explicit value.",
+				path: `/document/graph/nodes/${nodeId}/inputs/body`
+			});
+			const expected = httpRequestTask(task.executor);
+			if (!dequal(httpPortContracts(task.inputs), httpPortContracts(expected.inputs)) || !dequal(httpPortContracts(task.outputs), httpPortContracts(expected.outputs))) checked.diagnostics.push({
+				code: "http-request.ports-invalid",
+				column: 0,
+				line: 1,
+				message: "HTTP Request ports must match its configuration.",
+				path: `/document/graph/nodes/${nodeId}/task`
+			});
+		}
+		if (task.executor.kind == "openapi" || task.executor.kind == "http-request") {
+			const handles = task.executor.kind == "openapi" ? authHandles(task.executor.auth) : httpAuthHandles(task.executor);
 			for (const handle of handles) {
 				const mapping = node.inputs[handle];
 				if (mapping?.kind != "sources" || mapping.sources.length == 0) checked.diagnostics.push({
-					code: "openapi.auth-source",
+					code: `${task.executor.kind}.auth-source`,
 					column: 0,
 					line: 1,
 					message: "Authentication requires a deployment variable or upstream output.",
@@ -24837,9 +25060,16 @@ function runRevision(revision, triggerId) {
 		}
 	};
 }
+var httpPortContracts = (ports) => ports.filter((port) => "handle" in port).map(({ handle, jsonSchema, nullable }) => ({
+	handle,
+	jsonSchema,
+	nullable
+})).toSorted((a, b) => a.handle.localeCompare(b.handle));
 async function prepareFlow(revision, engineContract, triggerId) {
 	const engine = findEngineContract(engineContract);
 	if (engine == null) return { kind: "engine-unsupported" };
+	if (!engine.httpRequests && Object.values(revision.document.graph.nodes).some((node) => node.kind == "task" && "executor" in node.task && node.task.executor.kind == "http-request")) return { kind: "engine-unsupported" };
+	if (!engine.codeFetch && Object.values(revision.document.graph.nodes).some((node) => node.kind == "task" && "moduleId" in node.task && node.task.capabilities?.some((item) => item.kind == "http"))) return { kind: "engine-unsupported" };
 	if (!engine.workflowTools && Object.values(revision.document.graph.nodes).some((node) => nodeWorkflowReferences(node).some((ref) => ref.tool != null))) return { kind: "engine-unsupported" };
 	if (triggerId != null) {
 		const trigger = revision.document.graph.nodes[triggerId];