@oomol-lab/open-flow 0.1.0-beta.75 → 0.1.0-beta.76

package/src/control/common/eventSources.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { eventSourceViewSchema } from '../../event-source/common/view.ts'
 
 const id = z.string().min(1).max(256)
 const eventType = z.string().regex(/^[a-z][a-z0-9_.:]{0,127}$/)
@@ -10,45 +11,17 @@ const eventSourceSchema = z.object({
   revision: z.int().positive(),
   name,
   provider: z.enum(['feishu', 'feishu_app_bot', 'slackbot', 'intercom', 'sentry', 'zoom', 'fireflies', 'jira']),
-  appId: id.nullable(),
-  workspaceId: id.optional(),
-  installationId: id.optional(),
-  organizationId: id.optional(),
-  projectId: id.optional(),
-  projectKey: id.optional(),
-  subscriptionStatus: z.enum(['idle', 'pending', 'ready', 'error']).optional(),
-  lastError: z.string().optional(),
-  signingSecretConfigured: z.boolean().optional(),
+  ...eventSourceViewSchema.shape,
   connectionId: id,
   teamId: id.nullable(),
   enabled: z.boolean(),
   eventTypes: z.array(eventType),
-  manageSubscriptions: z.boolean().nullable(),
-  verificationTokenConfigured: z.boolean().nullable(),
-  encryptKeyConfigured: z.boolean().nullable(),
   endpointUrl: z.string().nullable(),
-  verifiedAt: z.string().nullable(),
   lastReceivedAt: z.string().nullable(),
   updatedAt: z.string(),
   consumers: z.array(z.object({ flowId: id, flowName: z.string(), triggerNodeId: id })),
 })
 
-export const eventSourceViewSchema = eventSourceSchema.pick({
-  appId: true,
-  workspaceId: true,
-  installationId: true,
-  organizationId: true,
-  projectId: true,
-  projectKey: true,
-  subscriptionStatus: true,
-  lastError: true,
-  signingSecretConfigured: true,
-  manageSubscriptions: true,
-  verificationTokenConfigured: true,
-  encryptKeyConfigured: true,
-  verifiedAt: true,
-})
-
 export interface CreateFeishuEventSource {
   readonly kind?: 'feishu'
   readonly version: 1

package/src/control/common/triggerCatalog.ts

@@ -1,19 +1,12 @@
 import type { TriggerKeySnapshot } from '../../flow/common/change.ts'
 import type { UiLanguage } from '../../localization/common/languages.ts'
+import type { TriggerDisplay } from '../../trigger/providers/localization.ts'
 import type { TriggerKeySummary } from './api.ts'
 
 import { isUiLanguage } from '../../localization/common/languages.ts'
 import { exact, requiredFields, invalidResponse, record, string } from './decoding.ts'
 import { triggerKey } from './triggerDecoders.ts'
 
-export interface TriggerDisplay {
-  readonly configInputs: Readonly<Record<string, string>>
-  readonly configInputLabels: Readonly<Record<string, string>>
-  readonly displayName: string
-  readonly description: string
-  readonly outputs: Readonly<Record<string, string>>
-}
-
 export interface TriggerCatalog {
   readonly version: 3
   readonly locale: UiLanguage

package/src/decision/common/decision.ts

@@ -1,4 +1,4 @@
-import type { InputPort, JsonValue, ManagedTaskDefinition, Port } from '../../flow/common/change.ts'
+import type { InputPort, JsonValue, ManagedTaskDefinitionOf, Port, TaskExecutor } from '../../flow/common/model.ts'
 
 import { dequal } from 'dequal/lite'
 import { matchesSchema } from '../../flow/common/schema.ts'
@@ -18,6 +18,10 @@ export interface DecisionIssue {
   readonly message: string
 }
 
+function isDecisionExecutor(executor: TaskExecutor): executor is DecisionExecutor {
+  return executor.kind === 'decision'
+}
+
 export const decisionModel = 'typesafe/jev'
 export const decisionLimits = { choice: 255, score: 10 } as const
 
@@ -34,8 +38,8 @@ export function limitDecisionQuestions(questions: readonly DecisionQuestion[]):
 }
 
 /** Loading an oversized task also updates its previously generated output schemas. */
-export function limitDecisionTask(task: ManagedTaskDefinition): ManagedTaskDefinition {
-  if (task.executor.kind !== 'decision') return task
+export function limitDecisionTask<Task extends ManagedTaskDefinitionOf<TaskExecutor>>(task: Task): Task {
+  if (!isDecisionExecutor(task.executor)) return task
   const original = task.executor.questions
   const questions = limitDecisionQuestions(original)
   if (questions === original) return task
@@ -45,7 +49,8 @@ export function limitDecisionTask(task: ManagedTaskDefinition): ManagedTaskDefin
     if (index < 0 || original[index] === questions[index] || !dequal(port.jsonSchema, answerSchema(original[index]!))) return port
     return { ...port, jsonSchema: decisionAnswerSchema(questions[index]!) }
   })
-  return { ...task, executor: { ...task.executor, questions }, outputs }
+  // Only the decision executor and its derived outputs change, so the task keeps its own type.
+  return { ...task, executor: { ...task.executor, questions }, outputs } as Task
 }
 export const decisionStateSchema: JsonValue = { type: ['string', 'object', 'array'] }
 const probability: JsonValue = { type: 'number', minimum: 0, maximum: 1 }
@@ -102,7 +107,10 @@ function answerSchema(question: DecisionQuestion): JsonValue {
   return { type: 'object', properties, required: Object.keys(properties) }
 }
 
-export function decisionTask(questions: readonly DecisionQuestion[] = [defaultDecisionQuestion()], name = 'AI Decision'): ManagedTaskDefinition {
+export function decisionTask(
+  questions: readonly DecisionQuestion[] = [defaultDecisionQuestion()],
+  name = 'AI Decision',
+): ManagedTaskDefinitionOf<DecisionExecutor> {
   questions = limitDecisionQuestions(questions)
   const inputs: InputPort[] = [
     { handle: 'target', description: 'Text, object, or array to evaluate across all questions.', jsonSchema: decisionStateSchema, nullable: false },
@@ -111,9 +119,9 @@ export function decisionTask(questions: readonly DecisionQuestion[] = [defaultDe
   return { name, executor: { kind: 'decision', questions }, inputs, outputs }
 }
 
-export function decisionTaskIssues(task: ManagedTaskDefinition): readonly DecisionIssue[] {
+export function decisionTaskIssues(task: ManagedTaskDefinitionOf<TaskExecutor>): readonly DecisionIssue[] {
   task = limitDecisionTask(task)
-  if (task.executor.kind !== 'decision') return []
+  if (!isDecisionExecutor(task.executor)) return []
   const expected = decisionTask(task.executor.questions, task.name)
   return [
     ...decisionQuestionIssues(task.executor.questions),

package/src/event-source/common/definition.ts

@@ -1,4 +1,4 @@
-import type { JsonValue } from '../../flow/common/change.ts'
+import type { JsonValue } from '../../types/index.ts'
 
 export interface SourceConfiguration {
   readonly identity: string

package/src/event-source/common/index.ts

@@ -1,9 +1,9 @@
 import type { EventSourceDefinition, SourceConfiguration } from './definition.ts'
 
 import { z } from 'zod'
-import { eventSourceViewSchema } from '../../control/common/eventSources.ts'
 import catalog from './catalog.generated.json' with { type: 'json' }
 import { SourceIdentityError } from './definition.ts'
+import { eventSourceViewSchema } from './view.ts'
 
 export type {
   EventSourceDefinition,

package/src/event-source/common/view.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod'
+
+const id = z.string().min(1).max(256)
+
+/** Public projection of a source that Connector validates and Open Flow exposes unchanged. */
+export const eventSourceViewSchema = z.object({
+  appId: id.nullable(),
+  workspaceId: id.optional(),
+  installationId: id.optional(),
+  organizationId: id.optional(),
+  projectId: id.optional(),
+  projectKey: id.optional(),
+  subscriptionStatus: z.enum(['idle', 'pending', 'ready', 'error']).optional(),
+  lastError: z.string().optional(),
+  signingSecretConfigured: z.boolean().optional(),
+  manageSubscriptions: z.boolean().nullable(),
+  verificationTokenConfigured: z.boolean().nullable(),
+  encryptKeyConfigured: z.boolean().nullable(),
+  verifiedAt: z.string().nullable(),
+})

package/src/execution/common/checkpoint.ts

@@ -1,7 +1,7 @@
 import type { Graph, JsonValue } from '../../flow/common/change.ts'
+import type { AgentCheckpoint } from '../../runtime/common/runtime.ts'
 import type { DependenciesCheckpoint } from './dependencies.ts'
 import type { ExecutableNode } from './node-execution.ts'
-import type { AgentCheckpoint } from './runtime.ts'
 
 import { z } from 'zod'
 import { isTriggerNode } from '../../flow/common/change.ts'

package/src/execution/common/node-execution.ts

@@ -1,9 +1,9 @@
 import type { AgentConfig } from '../../flow/common/agent.ts'
 import type { Graph, GraphNode, InputMapping, InputPortDefinition, JsonValue, TriggerNode } from '../../flow/common/change.ts'
 import type { WebhookResponseSnapshot } from '../../flow/common/webhookResponse.ts'
+import type { AgentCheckpoint, AgentResult } from '../../runtime/common/runtime.ts'
 import type { FlowRunCheckpoint } from './checkpoint.ts'
 import type { Dependencies } from './dependencies.ts'
-import type { AgentCheckpoint, AgentResult } from './runtime.ts'
 import type { FlowRunOptions, SchedulerEvent, SchedulerFailure, TaskInvocation } from './scheduler.ts'
 
 import * as Effect from 'effect/Effect'

package/src/execution/common/scheduler.ts

@@ -2,10 +2,10 @@ import type { TaskCapability, Graph, JsonValue, WaitAction, WaitAutoContinue } f
 import type { NodeErrorData } from '../../flow/common/errorHandling.ts'
 import type { PreparedFlow } from '../../flow/common/semantics.ts'
 import type { WebhookResponseSnapshot } from '../../flow/common/webhookResponse.ts'
+import type { AgentCheckpoint } from '../../runtime/common/runtime.ts'
 import type { PreviousNode } from '../../types/index.ts'
 import type { FlowRunCheckpoint } from './checkpoint.ts'
 import type { ExecutableNode, NodeResult } from './node-execution.ts'
-import type { AgentCheckpoint } from './runtime.ts'
 
 import * as Cause from 'effect/Cause'
 import * as Clock from 'effect/Clock'

package/src/flow/common/change.ts

@@ -1,12 +1,27 @@
-import type { JsonValue, Port, PortDefinition } from '../../types/index.ts'
+import type { TriggerNode, TriggerSchedule } from '../../trigger/common/model.ts'
+import type {
+  CodeModule,
+  ConnectorCapability,
+  FixedInputValue,
+  GraphNodeBase,
+  InlineTaskDefinition,
+  InputMapping,
+  InputPort,
+  JsonValue,
+  ManagedTaskDefinitionOf,
+  RetryConfiguration,
+  Port,
+  Source,
+  TaskCapability,
+  WorkflowCapability,
+  WorkflowExecutor,
+} from './model.ts'
 
-import { assertHttpAuthBindings } from '../../http/common/authBindings.ts'
 export { fixedInputValue, inputValue, inputValues } from './inputValue.ts'
-import type { RetryConfiguration } from './retry.ts'
 import type { WebhookMethod } from './webhookMethod.ts'
 
 import { dequal } from 'dequal/lite'
-import { authoringDefinitionSchemas, currentFlowModelVersion, decodeRevisionContent } from './changeSchema.ts'
+import { assertDocumentHttpAuthBindings, authoringDefinitionSchemas, currentFlowModelVersion, decodeRevisionContent } from './changeSchema.ts'
 import { nodeInputMappings, setConditionInput } from './condition.ts'
 import { supportsNodeErrorHandling } from './errorHandling.ts'
 import { supportsNodeRetry } from './retry.ts'
@@ -18,7 +33,39 @@ export { nodeSystemOutputPorts, supportsNodeErrorHandling, nodeErrorSchema } fro
 export type { NodeErrorData } from './errorHandling.ts'
 export type { WebhookMethod }
 
-export type { JsonValue, Port, PortDefinition } from '../../types/index.ts'
+export type {
+  BindingSource,
+  CodeModule,
+  ConnectorAccessCapability,
+  ConnectorActionCapability,
+  ConnectorCapability,
+  ConnectorPermissionCapability,
+  FixedInputValue,
+  Group,
+  InlineTaskDefinition,
+  InputMapping,
+  InputPort,
+  InputPortDefinition,
+  InputValues,
+  JsonValue,
+  NodeSource,
+  Port,
+  PortDefinition,
+  Source,
+  TaskCapability,
+  WorkflowCapability,
+} from './model.ts'
+export { portsByHandle } from './model.ts'
+export type {
+  IntegrationBodyFormat,
+  IntegrationEndpointDeclaration,
+  IntegrationEndpointMethod,
+  TriggerKeySnapshot,
+  TriggerNode,
+  TriggerSchedule,
+  WebhookBodyField,
+  WebhookOptions,
+} from '../../trigger/common/model.ts'
 
 export { isSchemaKeyword } from './schemaKeywords.ts'
 export type { SchemaKeyword, SchemaMismatch } from './schemaKeywords.ts'
@@ -42,52 +89,6 @@ export function validVariableName(value: string): boolean {
   return value.length <= 256 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(value) && value.slice(0, 3).toUpperCase() != 'OO_'
 }
 
-export interface InputPortDefinition extends PortDefinition {
-  readonly value?: JsonValue
-}
-
-export interface InputPort extends InputPortDefinition {
-  readonly handle: string
-}
-
-export interface Group {
-  readonly collapsed?: boolean
-  readonly group: string
-}
-
-export function portsByHandle<Value extends Port>(ports: readonly (Value | Group)[]): Readonly<Record<string, Value>> {
-  return Object.fromEntries(ports.flatMap((port) => ('handle' in port ? [[port.handle, port]] : [])))
-}
-
-export interface NodeSource {
-  readonly system?: true
-  readonly field?: string
-  readonly kind: 'node'
-  readonly nodeId: string
-  readonly output: string
-}
-
-export interface BindingSource {
-  readonly bindingId: string
-  readonly kind: 'binding'
-}
-
-export type FixedInputValue = { readonly kind: 'unset' } | { readonly kind: 'value'; readonly value: JsonValue }
-export type InputValues = Readonly<Record<string, FixedInputValue>>
-
-export type InputMapping = FixedInputValue | { readonly kind: 'sources'; readonly sources: readonly (BindingSource | NodeSource)[] }
-
-interface GraphNodeBase {
-  readonly description?: string
-  readonly icon?: string
-  readonly inputs: Readonly<Record<string, InputMapping>>
-  readonly name?: string
-  readonly maxExecutions?: number
-  readonly timeoutMs?: number
-  readonly retry?: RetryConfiguration
-  readonly onError?: 'stop' | 'error'
-}
-
 export interface ValueNode extends GraphNodeBase {
   readonly kind: 'value'
   readonly values: readonly InputPort[]
@@ -138,8 +139,6 @@ export type ConditionOperator =
   | 'notHasValue'
   | 'startsWith'
 
-export type Source = BindingSource | NodeSource
-
 export type ConditionOperand =
   | { readonly kind: 'value'; readonly value?: JsonValue; readonly jsonSchema?: JsonValue }
   | { readonly kind: 'source'; readonly source: Source }
@@ -168,7 +167,7 @@ export interface ConditionNode extends GraphNodeBase {
 
 export type ManagedTaskExecutor =
   | import('../../http/common/httpRequest.ts').HttpRequestExecutor
-  | import('../../workflow/common/workflow.ts').WorkflowExecutor
+  | WorkflowExecutor
   | import('../../decision/common/decision.ts').DecisionExecutor
   | import('../../openapi/common/openapi.ts').OpenApiExecutor
   | { readonly kind: 'connector'; readonly action: string; readonly connectionId?: string; readonly outputMode?: 'value' }
@@ -205,23 +204,12 @@ export interface AgentConnectorTool extends AgentToolBase {
   readonly connectionId?: string
 }
 
-export interface WorkflowCapability {
-  readonly kind: 'workflow'
-  readonly name: string
-  readonly flowId: string
-  readonly revisionId: string
-  readonly inputs: readonly Port[]
-  readonly outputs: readonly Port[] | null
-}
-
 export interface AgentWorkflowTool extends AgentToolBase, Omit<WorkflowCapability, 'inputs'> {
   readonly action?: never
   readonly connectionId?: never
 }
 
 export type AgentTool = AgentConnectorTool | AgentWorkflowTool
-export type TaskCapability = ConnectorCapability | WorkflowCapability
-
 export const workflowToolNamePattern = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/
 
 export function workflowToolNameIssue(name: string, otherNames: Iterable<string> = []): 'invalid' | 'duplicate' | undefined {
@@ -239,33 +227,13 @@ export function decodeTaskCapabilities(value: unknown): readonly TaskCapability[
     if (workflowToolNameIssue(item.name, names)) throw new TypeError('Workflow tool names must be unique provider-compatible names.')
     names.add(item.name)
   }
+  const http = parsed.filter((item) => item.kind == 'http')
+  if (http.length > 1 || http.some((item) => new Set(item.hosts).size != item.hosts.length))
+    throw new TypeError('Code declares HTTP hosts once, without duplicates.')
   let connectorIndex = 0
   return parsed.map((item) => (item.kind == 'connector' ? connectors[connectorIndex++]! : item)) as readonly TaskCapability[]
 }
 
-export interface ConnectorAccessCapability {
-  readonly actionHints?: readonly string[]
-  readonly connectionHints?: readonly {
-    readonly action: string
-    readonly connectionId: string
-    readonly alias?: string
-  }[]
-  readonly kind: 'connector'
-}
-
-export interface ConnectorActionCapability {
-  readonly action: string
-  readonly connections: readonly { readonly connectionId: string; readonly alias?: string }[]
-  readonly connectionId?: string
-  readonly kind: 'connector'
-}
-
-export type ConnectorPermissionCapability =
-  | { readonly kind: 'connector'; readonly mode: 'shared' }
-  | { readonly kind: 'connector'; readonly mode: 'independent'; readonly actions: readonly { readonly action: string; readonly connectionId?: string }[] }
-
-export type ConnectorCapability = ConnectorAccessCapability | ConnectorActionCapability | ConnectorPermissionCapability
-
 export function decodeConnectorCapabilities(value: unknown): readonly ConnectorCapability[] {
   if (!Array.isArray(value)) throw new TypeError('Connector capabilities must be an array.')
   if (value.length == 0) return []
@@ -389,20 +357,7 @@ export function decodeConnectorCapabilities(value: unknown): readonly ConnectorC
   })
 }
 
-interface TaskDefinitionBase {
-  readonly inputs: readonly (InputPort | Group)[]
-  readonly name: string
-  readonly outputs: readonly (Port | Group)[]
-}
-
-export interface InlineTaskDefinition extends TaskDefinitionBase {
-  readonly capabilities?: readonly TaskCapability[]
-  readonly moduleId: string
-}
-
-export interface ManagedTaskDefinition extends TaskDefinitionBase {
-  readonly executor: ManagedTaskExecutor
-}
+export type ManagedTaskDefinition = ManagedTaskDefinitionOf<ManagedTaskExecutor>
 
 export type TaskDefinition = InlineTaskDefinition | ManagedTaskDefinition
 
@@ -417,89 +372,6 @@ export interface Graph {
   readonly nodes: Readonly<Record<string, GraphNode>>
 }
 
-export type TriggerSchedule =
-  | { readonly expression: string; readonly timezone: string; readonly type: 'cron' }
-  | { readonly type: 'every'; readonly unit: 'day' | 'hour' | 'minute' | 'month' | 'week'; readonly value: number }
-
-interface TriggerKeySnapshotBase {
-  readonly configInputs: readonly (InputPort | Group)[]
-  readonly definitionVersion: number
-  readonly description: string
-  readonly displayName: string
-  readonly key: string
-  readonly name: string
-  readonly outputs: readonly Port[]
-  readonly provider: string
-}
-
-export type IntegrationEndpointMethod = 'DELETE' | 'GET' | 'HEAD' | 'PATCH' | 'POST' | 'PUT'
-
-export type IntegrationBodyFormat = 'form' | 'json' | 'multipart' | 'text'
-
-export interface IntegrationEndpointDeclaration {
-  readonly body: {
-    readonly allowArray: boolean
-    readonly allowEmpty: boolean
-    readonly formats: readonly IntegrationBodyFormat[]
-  }
-  readonly methods: readonly IntegrationEndpointMethod[]
-  readonly successStatus: number
-}
-
-export type TriggerKeySnapshot =
-  | (TriggerKeySnapshotBase & { readonly type: 'poll' })
-  | (TriggerKeySnapshotBase & { readonly endpoint: IntegrationEndpointDeclaration; readonly type: 'integration' })
-
-export interface WebhookBodyField extends InputPort {}
-
-export interface WebhookOptions {
-  readonly allowedOrigins?: readonly string[]
-  readonly responseBody?:
-    | { readonly kind: 'workflow-outputs'; readonly output?: string; readonly timeoutMs?: number }
-    | { readonly kind: 'webhook-response'; readonly nodeId?: string; readonly timeoutMs?: number }
-  readonly responseData?: string
-  readonly responseHeaders?: Readonly<Record<string, string>>
-  readonly responseHeadersSource?: {
-    readonly kind: 'workflow-outputs'
-    readonly output?: string
-  }
-  readonly responseHeaderOutputs?: Readonly<Record<string, string>>
-  readonly responseStatusCode?: number
-  readonly responseStatusCodeOutput?: string
-}
-
-interface TriggerNodeBase {
-  readonly onError?: never
-  readonly description?: string
-  readonly icon?: string
-  readonly name: string
-}
-
-export type TriggerNode =
-  | (TriggerNodeBase & { readonly kind: 'manual' })
-  | (TriggerNodeBase & { readonly kind: 'start'; readonly inputDefs: readonly Port[] })
-  | (TriggerNodeBase & { readonly kind: 'error'; readonly sourceFlowIds?: readonly string[] })
-  | (TriggerNodeBase & {
-      readonly bodyFields: readonly WebhookBodyField[]
-      readonly kind: 'webhook'
-      readonly method: WebhookMethod
-      readonly options?: WebhookOptions
-    })
-  | (TriggerNodeBase & { readonly cronTimes: readonly TriggerSchedule[]; readonly kind: 'cron' })
-  | (TriggerNodeBase & {
-      readonly connectionId?: string
-      readonly config: InputValues
-      readonly definition: TriggerKeySnapshot & { readonly type: 'poll' }
-      readonly kind: 'poll'
-      readonly pollTimes: readonly TriggerSchedule[]
-    })
-  | (TriggerNodeBase & {
-      readonly connectionId?: string
-      readonly config: InputValues
-      readonly definition: TriggerKeySnapshot & { readonly type: 'integration' }
-      readonly kind: 'integration'
-    })
-
 export interface OutputsNode extends Omit<GraphNodeBase, 'inputs'> {
   readonly kind: 'outputs'
   readonly outputDefs: readonly Port[]
@@ -523,12 +395,6 @@ export interface FlowDocument {
   readonly graph: Graph
 }
 
-export interface CodeModule {
-  readonly imports: readonly string[]
-  readonly name: string
-  readonly source: string
-}
-
 export interface RevisionContent {
   readonly document: FlowDocument
   readonly modelVersion: 2 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | typeof currentFlowModelVersion
@@ -1032,6 +898,6 @@ export function applyFlowChanges(content: RevisionContent, operations: readonly
       }
     }
   }
-  assertHttpAuthBindings(document)
+  assertDocumentHttpAuthBindings(document)
   return upgradeDecodedRevisionContent({ document, modelVersion: currentFlowModelVersion, modules })
 }

package/src/flow/common/changeSchema.ts

@@ -4,6 +4,7 @@ import { dequal } from 'dequal/lite'
 import { z } from 'zod'
 import { limitDecisionTask } from '../../decision/common/decision.ts'
 import { assertHttpAuthBindings } from '../../http/common/authBindings.ts'
+import { isHttpHost, maxHttpHosts } from '../../http/common/hosts.ts'
 import { httpRequestExecutorSchema } from '../../http/common/httpRequest.ts'
 import { checkJsonDepth } from './json.ts'
 import { retryConfigurationSchema } from './retry.ts'
@@ -12,7 +13,7 @@ import { waitAutoContinueDraftSchema, waitAutoContinueSchema } from './wait.ts'
 import { webhookMethods } from './webhookMethod.ts'
 import { webhookResponseTimeout } from './webhookResponse.ts'
 
-export const currentFlowModelVersion = 11
+export const currentFlowModelVersion = 12
 const text = z.string()
 const actionConnection = text.describe(
   'Account selection: omit while unconfigured; use an account ID to select it; use "" to explicitly defer configuration. Deferred Actions fail if called; deferred Agent tools are excluded from the callable tool set. Not supported by Triggers.',
@@ -57,7 +58,15 @@ export const workflowCapabilitySchema = z.strictObject({
   inputs: z.array(port),
   outputs: z.array(port).nullable(),
 })
-const capability = z.union([connectorCapabilitySchema, workflowCapabilitySchema])
+export const httpCapabilitySchema = z.strictObject({
+  kind: z.literal('http'),
+  hosts: z
+    .array(text.refine(isHttpHost, 'Use a lowercase host name or IPv4 address, optionally prefixed by "*." for subdomains.'))
+    .min(1)
+    .max(maxHttpHosts)
+    .describe('Hosts Code may call with context.fetch. "*.example.com" matches subdomains only.'),
+})
+const capability = z.union([connectorCapabilitySchema, workflowCapabilitySchema, httpCapabilitySchema])
 const inline = z.object({ ...ports, name: text, moduleId: text, capabilities: z.array(capability).optional() })
 const agentValue = z.union([z.object({ kind: z.literal('value'), value: json }), z.object({ kind: z.literal('input'), input: text })])
 const agentInput = z.union([agentValue, z.object({ kind: z.literal('model') })])
@@ -308,6 +317,7 @@ const revision = z.object({
     z.literal(8),
     z.literal(9),
     z.literal(10),
+    z.literal(11),
     z.literal(currentFlowModelVersion),
   ]),
   document,
@@ -593,7 +603,7 @@ export function decodeRevisionContent(value: unknown): RevisionContent {
   checkJsonDepth(value)
   const content = revision.parse(value) as RevisionContent
   checkModelVersion(content)
-  assertHttpAuthBindings(content.document)
+  assertDocumentHttpAuthBindings(content.document)
   return content
 }
 
@@ -603,7 +613,7 @@ export function decodeRevisionEnvelope(value: unknown): RevisionContent {
   const candidate = revisionSource.modelVersion == 2 ? { ...revisionSource, document: upgradeLegacyDocument(revisionSource.document) } : value
   const content = envelope.parse(candidate) as RevisionContent
   checkModelVersion(content)
-  assertHttpAuthBindings(content.document)
+  assertDocumentHttpAuthBindings(content.document)
   return { modelVersion: content.modelVersion, document: content.document, modules: content.modules }
 }
 
@@ -713,6 +723,14 @@ export function changeOperationsSchema(kind?: string): JsonValue {
 }
 
 function checkModelVersion(content: RevisionContent): void {
+  if (
+    content.modelVersion < 12 &&
+    Object.values(content.document.graph.nodes).some(
+      (candidateNode) =>
+        candidateNode.kind == 'task' && 'moduleId' in candidateNode.task && candidateNode.task.capabilities?.some((item) => item.kind == 'http'),
+    )
+  )
+    throw new TypeError('Code HTTP access requires Flow model version 12.')
   if (
     content.modelVersion < 11 &&
     Object.values(content.document.graph.nodes).some(
@@ -790,3 +808,10 @@ function checkModelVersion(content: RevisionContent): void {
   if (content.modelVersion < 5 && Object.values(content.document.graph.nodes).some((itemNode) => itemNode.kind == 'error'))
     throw new TypeError('Error workflows require Flow model version 5.')
 }
+
+export function assertDocumentHttpAuthBindings(content: FlowDocument): void {
+  for (const graphNode of Object.values(content.graph.nodes)) {
+    if (graphNode.kind == 'task' && 'executor' in graphNode.task && ['openapi', 'http-request'].includes(graphNode.task.executor.kind))
+      assertHttpAuthBindings(graphNode.inputs)
+  }
+}

package/src/flow/common/connectionUsage.ts

@@ -93,7 +93,7 @@ export function clearNodeConnections(graph: FlowDocument['graph'], connectionId?
           return [id, node]
         }
         const capabilities = node.task.capabilities?.map((capability) => {
-          if (capability.kind == 'workflow') return capability
+          if (capability.kind == 'workflow' || capability.kind == 'http') return capability
           if (!('mode' in capability)) {
             if ('action' in capability) {
               const { connectionId: selected, ...rest } = capability

package/src/flow/common/inputValue.ts

@@ -1,4 +1,4 @@
-import type { FixedInputValue, InputValues, InputMapping, JsonValue } from './change.ts'
+import type { FixedInputValue, InputValues, InputMapping, JsonValue } from './model.ts'
 
 /** An explicit clear suppresses the default; absent mappings still inherit it. */
 export function inputValue(mapping: InputMapping | undefined, fallback: JsonValue | undefined): JsonValue | undefined {