@oomol-lab/open-flow 0.1.0-beta.75 → 0.1.0-beta.76

package/dist/common/flow-authoring.js

@@ -2887,6 +2887,9 @@ function createSchemaComparer() {
 createSchemaComparer();
 //#endregion
 //#region src/decision/common/decision.ts
+function isDecisionExecutor(executor) {
+	return executor.kind === "decision";
+}
 var decisionLimits = {
 	choice: 255,
 	score: 10
@@ -2909,7 +2912,7 @@ function limitDecisionQuestions(questions) {
 }
 /** Loading an oversized task also updates its previously generated output schemas. */
 function limitDecisionTask(task) {
-	if (task.executor.kind !== "decision") return task;
+	if (!isDecisionExecutor(task.executor)) return task;
 	const original = task.executor.questions;
 	const questions = limitDecisionQuestions(original);
 	if (questions === original) return task;
@@ -3009,15 +3012,6 @@ function decisionTask(questions = [defaultDecisionQuestion()], name = "AI Decisi
 	};
 }
 //#endregion
-//#region src/http/common/authBindings.ts
-/** Never allow credentials to enter a Revision as literal node inputs. */
-function assertHttpAuthBindings(document) {
-	for (const node of Object.values(document.graph.nodes)) {
-		if (node.kind != "task" || !("executor" in node.task) || !["openapi", "http-request"].includes(node.task.executor.kind)) continue;
-		for (const [handle, mapping] of Object.entries(node.inputs)) if (handle.startsWith("auth.") && mapping.kind == "value") throw new TypeError("HTTP authentication accepts deployment variables and upstream outputs only.");
-	}
-}
-//#endregion
 //#region src/flow/common/inputValue.ts
 /** Converts explicit user values at authoring boundaries, never persisted legacy data. */
 function inputValues(values) {
@@ -8707,6 +8701,20 @@ function datetime(params) {
 	return /* @__PURE__ */ _isoDateTime(ZodISODateTime, params);
 }
 //#endregion
+//#region src/http/common/authBindings.ts
+/** Never allow credentials to enter a Revision as literal inputs of an OpenAPI or HTTP request node. */
+function assertHttpAuthBindings(inputs) {
+	for (const [handle, mapping] of Object.entries(inputs)) if (handle.startsWith("auth.") && mapping.kind == "value") throw new TypeError("HTTP authentication accepts deployment variables and upstream outputs only.");
+}
+//#endregion
+//#region src/http/common/hosts.ts
+/** Hosts of a Code `http` Capability: lowercase DNS names or IPv4 addresses; `*.example.com` matches subdomains only. */
+var httpHostPattern = /^(?:\*\.)?(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** Wildcards must name a registrable suffix, so `*.com` is rejected. */
+function isHttpHost(value) {
+	return httpHostPattern.test(value) && (!value.startsWith("*.") || value.slice(2).includes("."));
+}
+//#endregion
 //#region src/http/common/httpRequest.ts
 var parameterSchema = strictObject({
 	mode: _enum(["fields", "object"]).default("fields"),
@@ -8929,7 +8937,14 @@ var workflowCapabilitySchema = strictObject({
 	inputs: array(port),
 	outputs: array(port).nullable()
 });
-var capability = union([connectorCapabilitySchema, workflowCapabilitySchema]);
+var capability = union([
+	connectorCapabilitySchema,
+	workflowCapabilitySchema,
+	strictObject({
+		kind: literal("http"),
+		hosts: array(text.refine(isHttpHost, "Use a lowercase host name or IPv4 address, optionally prefixed by \"*.\" for subdomains.")).min(1).max(20).describe("Hosts Code may call with context.fetch. \"*.example.com\" matches subdomains only.")
+	})
+]);
 var inline = object({
 	...ports,
 	name: text,
@@ -9309,7 +9324,8 @@ var revision = object({
 		literal(8),
 		literal(9),
 		literal(10),
-		literal(11)
+		literal(11),
+		literal(12)
 	]),
 	document,
 	modules: record$1(text, module)
@@ -9340,7 +9356,7 @@ function decodeRevisionContent(value) {
 	checkJsonDepth(value);
 	const content = revision.parse(value);
 	checkModelVersion(content);
-	assertHttpAuthBindings(content.document);
+	assertDocumentHttpAuthBindings(content.document);
 	return content;
 }
 var shapes = {
@@ -9510,6 +9526,7 @@ array(union([...new Map(Object.entries(shapes).map(([kind, shape]) => [kind, sha
 	...shape
 })])).values()])).min(1);
 function checkModelVersion(content) {
+	if (content.modelVersion < 12 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && "moduleId" in candidateNode.task && candidateNode.task.capabilities?.some((item) => item.kind == "http"))) throw new TypeError("Code HTTP access requires Flow model version 12.");
 	if (content.modelVersion < 11 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && "executor" in candidateNode.task && candidateNode.task.executor.kind == "http-request")) throw new TypeError("HTTP Request requires Flow model version 11.");
 	if (content.modelVersion < 11 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && ("moduleId" in candidateNode.task ? candidateNode.task.capabilities?.some((item) => item.kind == "workflow") : candidateNode.task.executor.kind == "agent" && candidateNode.task.executor.tools.some((item) => item.kind == "workflow")))) throw new TypeError("Workflow tools require Flow model version 11.");
 	if (content.modelVersion < 10 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "webhook" && (candidateNode.options?.responseBody != null || candidateNode.options?.responseStatusCodeOutput != null || candidateNode.options?.responseHeadersSource != null || candidateNode.options?.responseHeaderOutputs != null))) throw new TypeError("Dynamic Webhook responses require Flow model version 10.");
@@ -9525,6 +9542,9 @@ function checkModelVersion(content) {
 	if (content.modelVersion < 6 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && "executor" in candidateNode.task)) throw new TypeError("Node-owned managed Tasks require Flow model version 6.");
 	if (content.modelVersion < 5 && Object.values(content.document.graph.nodes).some((itemNode) => itemNode.kind == "error")) throw new TypeError("Error workflows require Flow model version 5.");
 }
+function assertDocumentHttpAuthBindings(content) {
+	for (const graphNode of Object.values(content.graph.nodes)) if (graphNode.kind == "task" && "executor" in graphNode.task && ["openapi", "http-request"].includes(graphNode.task.executor.kind)) assertHttpAuthBindings(graphNode.inputs);
+}
 //#endregion
 //#region src/flow/common/condition.ts
 var unaryOperator = (operator) => operator.startsWith("is");
@@ -9603,6 +9623,8 @@ function decodeTaskCapabilities(value) {
 		if (workflowToolNameIssue(item.name, names)) throw new TypeError("Workflow tool names must be unique provider-compatible names.");
 		names.add(item.name);
 	}
+	const http = parsed.filter((item) => item.kind == "http");
+	if (http.length > 1 || http.some((item) => new Set(item.hosts).size != item.hosts.length)) throw new TypeError("Code declares HTTP hosts once, without duplicates.");
 	let connectorIndex = 0;
 	return parsed.map((item) => item.kind == "connector" ? connectors[connectorIndex++] : item);
 }
@@ -9733,10 +9755,10 @@ function isTriggerNode(node) {
 function upgradeDecodedRevisionContent(content) {
 	const graph = content.document.graph;
 	const hasManual = Object.values(graph.nodes).some((node) => node.kind == "manual");
-	if (!hasManual && content.modelVersion == 11) return content;
+	if (!hasManual && content.modelVersion == 12) return content;
 	return {
 		...content,
-		modelVersion: 11,
+		modelVersion: 12,
 		document: {
 			...content.document,
 			graph: hasManual ? {
@@ -9771,7 +9793,7 @@ function invalid(message) {
 	throw new FlowChangeError(message);
 }
 function applyFlowChanges(content, operations) {
-	const source = content.modelVersion != 11 || Object.values(content.document.graph.nodes).some((node) => node.kind == "manual") ? decodeRevisionContent(content) : content;
+	const source = content.modelVersion != 12 || Object.values(content.document.graph.nodes).some((node) => node.kind == "manual") ? decodeRevisionContent(content) : content;
 	const document = { ...source.document };
 	const modules = { ...source.modules };
 	for (const operation of operations) switch (operation.kind) {
@@ -10216,10 +10238,10 @@ function applyFlowChanges(content, operations) {
 			break;
 		}
 	}
-	assertHttpAuthBindings(document);
+	assertDocumentHttpAuthBindings(document);
 	return upgradeDecodedRevisionContent({
 		document,
-		modelVersion: 11,
+		modelVersion: 12,
 		modules
 	});
 }

package/dist/common/flow-change-schema.d.ts

@@ -1,6 +1,6 @@
 import type { ChangeOperation, FlowDocument, JsonValue, RevisionContent } from './flow-change.js';
 import { z } from 'zod';
-export declare const currentFlowModelVersion = 11;
+export declare const currentFlowModelVersion = 12;
 export declare const connectorCapabilitySchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"connector">;
     action: z.ZodString;
@@ -46,6 +46,10 @@ export declare const workflowCapabilitySchema: z.ZodObject<{
         handle: z.ZodString;
     }, z.core.$strip>>>;
 }, z.core.$strict>;
+export declare const httpCapabilitySchema: z.ZodObject<{
+    kind: z.ZodLiteral<"http">;
+    hosts: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
 export declare const agentToolFields: {
     id: z.ZodString;
     name: z.ZodString;
@@ -345,6 +349,9 @@ export declare const authoringDefinitionSchemas: {
             nullable: z.ZodBoolean;
             handle: z.ZodString;
         }, z.core.$strip>>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"http">;
+        hosts: z.ZodArray<z.ZodString>;
     }, z.core.$strict>]>>;
     connector: z.ZodObject<{
         action: z.ZodString;
@@ -474,3 +481,4 @@ export declare function parseOperation<Value>(candidate: unknown, index: number,
 export declare function decodeChangeOperation(candidate: unknown, index: number): ChangeOperation;
 export declare function decodeChangeOperations(value: unknown): readonly ChangeOperation[];
 export declare function changeOperationsSchema(kind?: string): JsonValue;
+export declare function assertDocumentHttpAuthBindings(content: FlowDocument): void;

package/dist/common/flow-change.d.ts

@@ -1,6 +1,6 @@
-import type { JsonValue, Port, PortDefinition } from '../index.js';
+import type { TriggerNode, TriggerSchedule } from './trigger-model.js';
+import type { CodeModule, ConnectorCapability, FixedInputValue, GraphNodeBase, InlineTaskDefinition, InputMapping, InputPort, JsonValue, ManagedTaskDefinitionOf, RetryConfiguration, Port, Source, TaskCapability, WorkflowCapability, WorkflowExecutor } from './flow-model.js';
 export { fixedInputValue, inputValue, inputValues } from './flow-input-value.js';
-import type { RetryConfiguration } from './flow-retry.js';
 import type { WebhookMethod } from './webhook-method.js';
 import { currentFlowModelVersion } from './flow-change-schema.js';
 export { changeOperationsSchema, currentFlowModelVersion, decodeChangeOperations } from './flow-change-schema.js';
@@ -9,56 +9,15 @@ export { supportsNodeRetry } from './flow-retry.js';
 export { nodeSystemOutputPorts, supportsNodeErrorHandling, nodeErrorSchema } from './flow-errorHandling.js';
 export type { NodeErrorData } from './flow-errorHandling.js';
 export type { WebhookMethod };
-export type { JsonValue, Port, PortDefinition } from '../index.js';
+export type { BindingSource, CodeModule, ConnectorAccessCapability, ConnectorActionCapability, ConnectorCapability, ConnectorPermissionCapability, FixedInputValue, Group, InlineTaskDefinition, InputMapping, InputPort, InputPortDefinition, InputValues, JsonValue, NodeSource, Port, PortDefinition, Source, TaskCapability, WorkflowCapability, } from './flow-model.js';
+export { portsByHandle } from './flow-model.js';
+export type { IntegrationBodyFormat, IntegrationEndpointDeclaration, IntegrationEndpointMethod, TriggerKeySnapshot, TriggerNode, TriggerSchedule, WebhookBodyField, WebhookOptions, } from './trigger-model.js';
 export { isSchemaKeyword } from './flow-schemaKeywords.js';
 export type { SchemaKeyword, SchemaMismatch } from './flow-schemaKeywords.js';
 export declare const resourceNameMaxLength = 80;
 export type ResourceNameIssue = 'controlCharacter' | 'empty' | 'specialCharacter' | 'tooLong';
 export declare function resourceNameIssue(value: string): ResourceNameIssue | undefined;
 export declare function validVariableName(value: string): boolean;
-export interface InputPortDefinition extends PortDefinition {
-    readonly value?: JsonValue;
-}
-export interface InputPort extends InputPortDefinition {
-    readonly handle: string;
-}
-export interface Group {
-    readonly collapsed?: boolean;
-    readonly group: string;
-}
-export declare function portsByHandle<Value extends Port>(ports: readonly (Value | Group)[]): Readonly<Record<string, Value>>;
-export interface NodeSource {
-    readonly system?: true;
-    readonly field?: string;
-    readonly kind: 'node';
-    readonly nodeId: string;
-    readonly output: string;
-}
-export interface BindingSource {
-    readonly bindingId: string;
-    readonly kind: 'binding';
-}
-export type FixedInputValue = {
-    readonly kind: 'unset';
-} | {
-    readonly kind: 'value';
-    readonly value: JsonValue;
-};
-export type InputValues = Readonly<Record<string, FixedInputValue>>;
-export type InputMapping = FixedInputValue | {
-    readonly kind: 'sources';
-    readonly sources: readonly (BindingSource | NodeSource)[];
-};
-interface GraphNodeBase {
-    readonly description?: string;
-    readonly icon?: string;
-    readonly inputs: Readonly<Record<string, InputMapping>>;
-    readonly name?: string;
-    readonly maxExecutions?: number;
-    readonly timeoutMs?: number;
-    readonly retry?: RetryConfiguration;
-    readonly onError?: 'stop' | 'error';
-}
 export interface ValueNode extends GraphNodeBase {
     readonly kind: 'value';
     readonly values: readonly InputPort[];
@@ -86,7 +45,6 @@ export interface ApprovalNode extends ResolutionNodeBase {
 }
 export type ResolutionNode = ApprovalNode | WaitNode;
 export type ConditionOperator = '!=' | '<' | '<=' | '==' | '>' | '>=' | 'contains' | 'endsWith' | 'hasKey' | 'hasValue' | 'isEmpty' | 'isFalse' | 'isNotEmpty' | 'isNotNull' | 'isNull' | 'isTrue' | 'notContains' | 'notHasKey' | 'notHasValue' | 'startsWith';
-export type Source = BindingSource | NodeSource;
 export type ConditionOperand = {
     readonly kind: 'value';
     readonly value?: JsonValue;
@@ -113,7 +71,7 @@ export interface ConditionNode extends GraphNodeBase {
     readonly matchMode: 'first' | 'all';
     readonly kind: 'condition';
 }
-export type ManagedTaskExecutor = import('./http-request.js').HttpRequestExecutor | import('./workflow.js').WorkflowExecutor | import('./decision.js').DecisionExecutor | import('./openapi.js').OpenApiExecutor | {
+export type ManagedTaskExecutor = import('./http-request.js').HttpRequestExecutor | WorkflowExecutor | import('./decision.js').DecisionExecutor | import('./openapi.js').OpenApiExecutor | {
     readonly kind: 'connector';
     readonly action: string;
     readonly connectionId?: string;
@@ -161,66 +119,16 @@ export interface AgentConnectorTool extends AgentToolBase {
     readonly action: string;
     readonly connectionId?: string;
 }
-export interface WorkflowCapability {
-    readonly kind: 'workflow';
-    readonly name: string;
-    readonly flowId: string;
-    readonly revisionId: string;
-    readonly inputs: readonly Port[];
-    readonly outputs: readonly Port[] | null;
-}
 export interface AgentWorkflowTool extends AgentToolBase, Omit<WorkflowCapability, 'inputs'> {
     readonly action?: never;
     readonly connectionId?: never;
 }
 export type AgentTool = AgentConnectorTool | AgentWorkflowTool;
-export type TaskCapability = ConnectorCapability | WorkflowCapability;
 export declare const workflowToolNamePattern: RegExp;
 export declare function workflowToolNameIssue(name: string, otherNames?: Iterable<string>): 'invalid' | 'duplicate' | undefined;
 export declare function decodeTaskCapabilities(value: unknown): readonly TaskCapability[];
-export interface ConnectorAccessCapability {
-    readonly actionHints?: readonly string[];
-    readonly connectionHints?: readonly {
-        readonly action: string;
-        readonly connectionId: string;
-        readonly alias?: string;
-    }[];
-    readonly kind: 'connector';
-}
-export interface ConnectorActionCapability {
-    readonly action: string;
-    readonly connections: readonly {
-        readonly connectionId: string;
-        readonly alias?: string;
-    }[];
-    readonly connectionId?: string;
-    readonly kind: 'connector';
-}
-export type ConnectorPermissionCapability = {
-    readonly kind: 'connector';
-    readonly mode: 'shared';
-} | {
-    readonly kind: 'connector';
-    readonly mode: 'independent';
-    readonly actions: readonly {
-        readonly action: string;
-        readonly connectionId?: string;
-    }[];
-};
-export type ConnectorCapability = ConnectorAccessCapability | ConnectorActionCapability | ConnectorPermissionCapability;
 export declare function decodeConnectorCapabilities(value: unknown): readonly ConnectorCapability[];
-interface TaskDefinitionBase {
-    readonly inputs: readonly (InputPort | Group)[];
-    readonly name: string;
-    readonly outputs: readonly (Port | Group)[];
-}
-export interface InlineTaskDefinition extends TaskDefinitionBase {
-    readonly capabilities?: readonly TaskCapability[];
-    readonly moduleId: string;
-}
-export interface ManagedTaskDefinition extends TaskDefinitionBase {
-    readonly executor: ManagedTaskExecutor;
-}
+export type ManagedTaskDefinition = ManagedTaskDefinitionOf<ManagedTaskExecutor>;
 export type TaskDefinition = InlineTaskDefinition | ManagedTaskDefinition;
 export interface TaskNode extends GraphNodeBase {
     readonly kind: 'task';
@@ -231,103 +139,6 @@ export interface Graph {
     readonly edges: readonly GraphEdge[];
     readonly nodes: Readonly<Record<string, GraphNode>>;
 }
-export type TriggerSchedule = {
-    readonly expression: string;
-    readonly timezone: string;
-    readonly type: 'cron';
-} | {
-    readonly type: 'every';
-    readonly unit: 'day' | 'hour' | 'minute' | 'month' | 'week';
-    readonly value: number;
-};
-interface TriggerKeySnapshotBase {
-    readonly configInputs: readonly (InputPort | Group)[];
-    readonly definitionVersion: number;
-    readonly description: string;
-    readonly displayName: string;
-    readonly key: string;
-    readonly name: string;
-    readonly outputs: readonly Port[];
-    readonly provider: string;
-}
-export type IntegrationEndpointMethod = 'DELETE' | 'GET' | 'HEAD' | 'PATCH' | 'POST' | 'PUT';
-export type IntegrationBodyFormat = 'form' | 'json' | 'multipart' | 'text';
-export interface IntegrationEndpointDeclaration {
-    readonly body: {
-        readonly allowArray: boolean;
-        readonly allowEmpty: boolean;
-        readonly formats: readonly IntegrationBodyFormat[];
-    };
-    readonly methods: readonly IntegrationEndpointMethod[];
-    readonly successStatus: number;
-}
-export type TriggerKeySnapshot = (TriggerKeySnapshotBase & {
-    readonly type: 'poll';
-}) | (TriggerKeySnapshotBase & {
-    readonly endpoint: IntegrationEndpointDeclaration;
-    readonly type: 'integration';
-});
-export interface WebhookBodyField extends InputPort {
-}
-export interface WebhookOptions {
-    readonly allowedOrigins?: readonly string[];
-    readonly responseBody?: {
-        readonly kind: 'workflow-outputs';
-        readonly output?: string;
-        readonly timeoutMs?: number;
-    } | {
-        readonly kind: 'webhook-response';
-        readonly nodeId?: string;
-        readonly timeoutMs?: number;
-    };
-    readonly responseData?: string;
-    readonly responseHeaders?: Readonly<Record<string, string>>;
-    readonly responseHeadersSource?: {
-        readonly kind: 'workflow-outputs';
-        readonly output?: string;
-    };
-    readonly responseHeaderOutputs?: Readonly<Record<string, string>>;
-    readonly responseStatusCode?: number;
-    readonly responseStatusCodeOutput?: string;
-}
-interface TriggerNodeBase {
-    readonly onError?: never;
-    readonly description?: string;
-    readonly icon?: string;
-    readonly name: string;
-}
-export type TriggerNode = (TriggerNodeBase & {
-    readonly kind: 'manual';
-}) | (TriggerNodeBase & {
-    readonly kind: 'start';
-    readonly inputDefs: readonly Port[];
-}) | (TriggerNodeBase & {
-    readonly kind: 'error';
-    readonly sourceFlowIds?: readonly string[];
-}) | (TriggerNodeBase & {
-    readonly bodyFields: readonly WebhookBodyField[];
-    readonly kind: 'webhook';
-    readonly method: WebhookMethod;
-    readonly options?: WebhookOptions;
-}) | (TriggerNodeBase & {
-    readonly cronTimes: readonly TriggerSchedule[];
-    readonly kind: 'cron';
-}) | (TriggerNodeBase & {
-    readonly connectionId?: string;
-    readonly config: InputValues;
-    readonly definition: TriggerKeySnapshot & {
-        readonly type: 'poll';
-    };
-    readonly kind: 'poll';
-    readonly pollTimes: readonly TriggerSchedule[];
-}) | (TriggerNodeBase & {
-    readonly connectionId?: string;
-    readonly config: InputValues;
-    readonly definition: TriggerKeySnapshot & {
-        readonly type: 'integration';
-    };
-    readonly kind: 'integration';
-});
 export interface OutputsNode extends Omit<GraphNodeBase, 'inputs'> {
     readonly kind: 'outputs';
     readonly outputDefs: readonly Port[];
@@ -347,11 +158,6 @@ export interface FlowDocument {
     }>>;
     readonly graph: Graph;
 }
-export interface CodeModule {
-    readonly imports: readonly string[];
-    readonly name: string;
-    readonly source: string;
-}
 export interface RevisionContent {
     readonly document: FlowDocument;
     readonly modelVersion: 2 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | typeof currentFlowModelVersion;

package/dist/common/flow-change.js

@@ -1,12 +1,3 @@
-//#region src/http/common/authBindings.ts
-/** Never allow credentials to enter a Revision as literal node inputs. */
-function assertHttpAuthBindings(document) {
-	for (const node of Object.values(document.graph.nodes)) {
-		if (node.kind != "task" || !("executor" in node.task) || !["openapi", "http-request"].includes(node.task.executor.kind)) continue;
-		for (const [handle, mapping] of Object.entries(node.inputs)) if (handle.startsWith("auth.") && mapping.kind == "value") throw new TypeError("HTTP authentication accepts deployment variables and upstream outputs only.");
-	}
-}
-//#endregion
 //#region src/flow/common/inputValue.ts
 /** An explicit clear suppresses the default; absent mappings still inherit it. */
 function inputValue(mapping, fallback) {
@@ -8691,6 +8682,9 @@ function isSchemaKeyword(value) {
 }
 //#endregion
 //#region src/decision/common/decision.ts
+function isDecisionExecutor(executor) {
+	return executor.kind === "decision";
+}
 var decisionLimits = {
 	choice: 255,
 	score: 10
@@ -8713,7 +8707,7 @@ function limitDecisionQuestions(questions) {
 }
 /** Loading an oversized task also updates its previously generated output schemas. */
 function limitDecisionTask(task) {
-	if (task.executor.kind !== "decision") return task;
+	if (!isDecisionExecutor(task.executor)) return task;
 	const original = task.executor.questions;
 	const questions = limitDecisionQuestions(original);
 	if (questions === original) return task;
@@ -8780,6 +8774,20 @@ function answerSchema(question) {
 	};
 }
 //#endregion
+//#region src/http/common/authBindings.ts
+/** Never allow credentials to enter a Revision as literal inputs of an OpenAPI or HTTP request node. */
+function assertHttpAuthBindings(inputs) {
+	for (const [handle, mapping] of Object.entries(inputs)) if (handle.startsWith("auth.") && mapping.kind == "value") throw new TypeError("HTTP authentication accepts deployment variables and upstream outputs only.");
+}
+//#endregion
+//#region src/http/common/hosts.ts
+/** Hosts of a Code `http` Capability: lowercase DNS names or IPv4 addresses; `*.example.com` matches subdomains only. */
+var httpHostPattern = /^(?:\*\.)?(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** Wildcards must name a registrable suffix, so `*.com` is rejected. */
+function isHttpHost(value) {
+	return httpHostPattern.test(value) && (!value.startsWith("*.") || value.slice(2).includes("."));
+}
+//#endregion
 //#region src/http/common/httpRequest.ts
 var parameterSchema = strictObject({
 	mode: _enum(["fields", "object"]).default("fields"),
@@ -8925,7 +8933,7 @@ var webhookResponseTimeout = {
 }).jsonSchema;
 //#endregion
 //#region src/flow/common/changeSchema.ts
-var currentFlowModelVersion = 11;
+var currentFlowModelVersion = 12;
 var text = string();
 var actionConnection = text.describe("Account selection: omit while unconfigured; use an account ID to select it; use \"\" to explicitly defer configuration. Deferred Actions fail if called; deferred Agent tools are excluded from the callable tool set. Not supported by Triggers.");
 var json = json$1();
@@ -9005,7 +9013,14 @@ var workflowCapabilitySchema = strictObject({
 	inputs: array(port),
 	outputs: array(port).nullable()
 });
-var capability = union([connectorCapabilitySchema, workflowCapabilitySchema]);
+var capability = union([
+	connectorCapabilitySchema,
+	workflowCapabilitySchema,
+	strictObject({
+		kind: literal("http"),
+		hosts: array(text.refine(isHttpHost, "Use a lowercase host name or IPv4 address, optionally prefixed by \"*.\" for subdomains.")).min(1).max(20).describe("Hosts Code may call with context.fetch. \"*.example.com\" matches subdomains only.")
+	})
+]);
 var inline = object({
 	...ports,
 	name: text,
@@ -9385,7 +9400,8 @@ var revision = object({
 		literal(8),
 		literal(9),
 		literal(10),
-		literal(11)
+		literal(11),
+		literal(12)
 	]),
 	document,
 	modules: record$1(text, module)
@@ -9416,7 +9432,7 @@ function decodeRevisionContent(value) {
 	checkJsonDepth(value);
 	const content = revision.parse(value);
 	checkModelVersion(content);
-	assertHttpAuthBindings(content.document);
+	assertDocumentHttpAuthBindings(content.document);
 	return content;
 }
 var shapes = {
@@ -9610,6 +9626,7 @@ function changeOperationsSchema(kind) {
 	return toJSONSchema(schema, { io: "input" });
 }
 function checkModelVersion(content) {
+	if (content.modelVersion < 12 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && "moduleId" in candidateNode.task && candidateNode.task.capabilities?.some((item) => item.kind == "http"))) throw new TypeError("Code HTTP access requires Flow model version 12.");
 	if (content.modelVersion < 11 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && "executor" in candidateNode.task && candidateNode.task.executor.kind == "http-request")) throw new TypeError("HTTP Request requires Flow model version 11.");
 	if (content.modelVersion < 11 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && ("moduleId" in candidateNode.task ? candidateNode.task.capabilities?.some((item) => item.kind == "workflow") : candidateNode.task.executor.kind == "agent" && candidateNode.task.executor.tools.some((item) => item.kind == "workflow")))) throw new TypeError("Workflow tools require Flow model version 11.");
 	if (content.modelVersion < 10 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "webhook" && (candidateNode.options?.responseBody != null || candidateNode.options?.responseStatusCodeOutput != null || candidateNode.options?.responseHeadersSource != null || candidateNode.options?.responseHeaderOutputs != null))) throw new TypeError("Dynamic Webhook responses require Flow model version 10.");
@@ -9625,6 +9642,9 @@ function checkModelVersion(content) {
 	if (content.modelVersion < 6 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && "executor" in candidateNode.task)) throw new TypeError("Node-owned managed Tasks require Flow model version 6.");
 	if (content.modelVersion < 5 && Object.values(content.document.graph.nodes).some((itemNode) => itemNode.kind == "error")) throw new TypeError("Error workflows require Flow model version 5.");
 }
+function assertDocumentHttpAuthBindings(content) {
+	for (const graphNode of Object.values(content.graph.nodes)) if (graphNode.kind == "task" && "executor" in graphNode.task && ["openapi", "http-request"].includes(graphNode.task.executor.kind)) assertHttpAuthBindings(graphNode.inputs);
+}
 //#endregion
 //#region src/flow/common/condition.ts
 var unaryOperator = (operator) => operator.startsWith("is");
@@ -9713,6 +9733,11 @@ function nodeSystemOutputPorts(node) {
 	} } : {};
 }
 //#endregion
+//#region src/flow/common/model.ts
+function portsByHandle(ports) {
+	return Object.fromEntries(ports.flatMap((port) => "handle" in port ? [[port.handle, port]] : []));
+}
+//#endregion
 //#region src/flow/common/change.ts
 var resourceNameMaxLength = 80;
 function resourceNameIssue(value) {
@@ -9728,9 +9753,6 @@ function resourceNameIssue(value) {
 function validVariableName(value) {
 	return value.length <= 256 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(value) && value.slice(0, 3).toUpperCase() != "OO_";
 }
-function portsByHandle(ports) {
-	return Object.fromEntries(ports.flatMap((port) => "handle" in port ? [[port.handle, port]] : []));
-}
 var workflowToolNamePattern = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
 function workflowToolNameIssue(name, otherNames = []) {
 	if (!workflowToolNamePattern.test(name)) return "invalid";
@@ -9746,6 +9768,8 @@ function decodeTaskCapabilities(value) {
 		if (workflowToolNameIssue(item.name, names)) throw new TypeError("Workflow tool names must be unique provider-compatible names.");
 		names.add(item.name);
 	}
+	const http = parsed.filter((item) => item.kind == "http");
+	if (http.length > 1 || http.some((item) => new Set(item.hosts).size != item.hosts.length)) throw new TypeError("Code declares HTTP hosts once, without duplicates.");
 	let connectorIndex = 0;
 	return parsed.map((item) => item.kind == "connector" ? connectors[connectorIndex++] : item);
 }
@@ -9881,10 +9905,10 @@ function upgradeRevisionContent(content) {
 function upgradeDecodedRevisionContent(content) {
 	const graph = content.document.graph;
 	const hasManual = Object.values(graph.nodes).some((node) => node.kind == "manual");
-	if (!hasManual && content.modelVersion == 11) return content;
+	if (!hasManual && content.modelVersion == 12) return content;
 	return {
 		...content,
-		modelVersion: 11,
+		modelVersion: 12,
 		document: {
 			...content.document,
 			graph: hasManual ? {
@@ -9931,7 +9955,7 @@ function invalid(message) {
 	throw new FlowChangeError(message);
 }
 function applyFlowChanges(content, operations) {
-	const source = content.modelVersion != 11 || Object.values(content.document.graph.nodes).some((node) => node.kind == "manual") ? decodeRevisionContent(content) : content;
+	const source = content.modelVersion != 12 || Object.values(content.document.graph.nodes).some((node) => node.kind == "manual") ? decodeRevisionContent(content) : content;
 	const document = { ...source.document };
 	const modules = { ...source.modules };
 	for (const operation of operations) switch (operation.kind) {
@@ -10376,10 +10400,10 @@ function applyFlowChanges(content, operations) {
 			break;
 		}
 	}
-	assertHttpAuthBindings(document);
+	assertDocumentHttpAuthBindings(document);
 	return upgradeDecodedRevisionContent({
 		document,
-		modelVersion: 11,
+		modelVersion: 12,
 		modules
 	});
 }