@oomol-lab/open-flow 0.1.0-beta.75 → 0.1.0-beta.76

package/src/flow/common/model.ts

@@ -0,0 +1,130 @@
+import type { JsonValue, Port, PortDefinition } from '../../types/index.ts'
+
+export type { JsonValue, Port, PortDefinition } from '../../types/index.ts'
+
+/** Primitives shared by every node family. Node unions and graph operations belong to change.ts. */
+
+export interface RetryConfiguration {
+  readonly maxRetries: number
+  readonly intervalMs: number
+}
+
+export interface InputPortDefinition extends PortDefinition {
+  readonly value?: JsonValue
+}
+
+export interface InputPort extends InputPortDefinition {
+  readonly handle: string
+}
+
+export interface Group {
+  readonly collapsed?: boolean
+  readonly group: string
+}
+
+export function portsByHandle<Value extends Port>(ports: readonly (Value | Group)[]): Readonly<Record<string, Value>> {
+  return Object.fromEntries(ports.flatMap((port) => ('handle' in port ? [[port.handle, port]] : [])))
+}
+
+export interface NodeSource {
+  readonly system?: true
+  readonly field?: string
+  readonly kind: 'node'
+  readonly nodeId: string
+  readonly output: string
+}
+
+export interface BindingSource {
+  readonly bindingId: string
+  readonly kind: 'binding'
+}
+
+export type FixedInputValue = { readonly kind: 'unset' } | { readonly kind: 'value'; readonly value: JsonValue }
+export type InputValues = Readonly<Record<string, FixedInputValue>>
+
+export type InputMapping = FixedInputValue | { readonly kind: 'sources'; readonly sources: readonly (BindingSource | NodeSource)[] }
+
+export interface GraphNodeBase {
+  readonly description?: string
+  readonly icon?: string
+  readonly inputs: Readonly<Record<string, InputMapping>>
+  readonly name?: string
+  readonly maxExecutions?: number
+  readonly timeoutMs?: number
+  readonly retry?: RetryConfiguration
+  readonly onError?: 'stop' | 'error'
+}
+
+export type Source = BindingSource | NodeSource
+
+export interface WorkflowCapability {
+  readonly kind: 'workflow'
+  readonly name: string
+  readonly flowId: string
+  readonly revisionId: string
+  readonly inputs: readonly Port[]
+  readonly outputs: readonly Port[] | null
+}
+
+/** Hosts that Code may call through `context.fetch`; requires Flow model 12 and Engine v9. */
+export interface HttpCapability {
+  readonly kind: 'http'
+  readonly hosts: readonly string[]
+}
+
+export type TaskCapability = ConnectorCapability | WorkflowCapability | HttpCapability
+
+export interface ConnectorAccessCapability {
+  readonly actionHints?: readonly string[]
+  readonly connectionHints?: readonly {
+    readonly action: string
+    readonly connectionId: string
+    readonly alias?: string
+  }[]
+  readonly kind: 'connector'
+}
+
+export interface ConnectorActionCapability {
+  readonly action: string
+  readonly connections: readonly { readonly connectionId: string; readonly alias?: string }[]
+  readonly connectionId?: string
+  readonly kind: 'connector'
+}
+
+export type ConnectorPermissionCapability =
+  | { readonly kind: 'connector'; readonly mode: 'shared' }
+  | { readonly kind: 'connector'; readonly mode: 'independent'; readonly actions: readonly { readonly action: string; readonly connectionId?: string }[] }
+
+export type ConnectorCapability = ConnectorAccessCapability | ConnectorActionCapability | ConnectorPermissionCapability
+
+export interface TaskDefinitionBase {
+  readonly inputs: readonly (InputPort | Group)[]
+  readonly name: string
+  readonly outputs: readonly (Port | Group)[]
+}
+
+export interface InlineTaskDefinition extends TaskDefinitionBase {
+  readonly capabilities?: readonly TaskCapability[]
+  readonly moduleId: string
+}
+
+/** The executor shape every managed Task shares; each node family narrows it with its own executor. */
+export interface TaskExecutor {
+  readonly kind: string
+}
+
+export interface ManagedTaskDefinitionOf<Executor extends TaskExecutor> extends TaskDefinitionBase {
+  readonly executor: Executor
+}
+
+export interface WorkflowExecutor {
+  readonly kind: 'workflow'
+  readonly flowId: string
+  readonly revisionId: string
+}
+
+export interface CodeModule {
+  readonly imports: readonly string[]
+  readonly name: string
+  readonly source: string
+}

package/src/flow/common/modules.ts

@@ -1,4 +1,4 @@
-import type { EngineContract } from '../../execution/common/engineContract.ts'
+import type { EngineContract } from '../../runtime/common/engineContract.ts'
 import type { RevisionContent } from './change.ts'
 import type { Diagnostic } from './semantics.ts'
 

package/src/flow/common/portChanges.ts

@@ -1,4 +1,4 @@
-import type { InputMapping } from './change.ts'
+import type { InputMapping } from './model.ts'
 
 export function renamedPort(
   previous: readonly ({ readonly handle: string } | { readonly group: string })[],

package/src/flow/common/retry.ts

@@ -1,11 +1,9 @@
 import type { GraphNode } from './change.ts'
+import type { RetryConfiguration } from './model.ts'
 
 import { z } from 'zod'
 
-export interface RetryConfiguration {
-  readonly maxRetries: number
-  readonly intervalMs: number
-}
+export type { RetryConfiguration } from './model.ts'
 
 export const retryNodeTypes = ['code', 'connector', 'openapi', 'http-request', 'llm', 'decision'] as const
 export const nodeRetryLimits = { maxRetries: 5, minIntervalMs: 1000, maxIntervalMs: 60000, intervalStepMs: 1000 } as const

package/src/flow/common/semantics.ts

@@ -2,19 +2,19 @@ import { dequal } from 'dequal/lite'
 import { decisionTaskIssues } from '../../decision/common/decision.ts'
 import { httpRequestIssues, httpAuthHandles, httpRequestTask, httpRequestUrl } from '../../http/common/httpRequest.ts'
 import { openApiIssues, authHandles } from '../../openapi/common/openapi.ts'
-import { nodeWorkflowReferences } from '../../workflow/common/workflow.ts'
 import { isTriggerNode } from './change.ts'
+import { nodeWorkflowReferences } from './workflowReferences.ts'
 export { renderPrompt } from './promptTemplate.ts'
 export { connectionUsage, removeConnectionUsage } from './connectionUsage.ts'
 import { matchesTriggerOutputs, normalizeTriggerOutputs } from '../../trigger/common/contract.ts'
 import { nodeInputMappings } from './condition.ts'
 import { connectionUsage } from './connectionUsage.ts'
 export { matchesTriggerOutputs, normalizeTriggerOutputs, triggerOutputDefinitions, triggerOutputPorts } from '../../trigger/common/contract.ts'
-import type { EngineContract } from '../../execution/common/engineContract.ts'
-import type { RuntimeProgram } from '../../execution/common/runtime.ts'
+import type { EngineContract } from '../../runtime/common/engineContract.ts'
+import type { RuntimeProgram } from '../../runtime/common/runtime.ts'
 import type { ConnectorActionCapability, ConnectorCapability, Graph, InputMapping, JsonValue, Port, RevisionContent, SchemaMismatch } from './change.ts'
 
-import { findEngineContract } from '../../execution/common/engineContract.ts'
+import { findEngineContract } from '../../runtime/common/engineContract.ts'
 import { agentConfigIssues } from './agent.ts'
 import { decodeTaskCapabilities } from './change.ts'
 import { canonicalJsonBytes, canonicalModule, canonicalRevisionGraph, digestBytes } from './encoding.ts'
@@ -445,6 +445,13 @@ export async function prepareFlow(revision: RevisionContent, engineContract: str
     Object.values(revision.document.graph.nodes).some((node) => node.kind == 'task' && 'executor' in node.task && node.task.executor.kind == 'http-request')
   )
     return { kind: 'engine-unsupported' }
+  if (
+    !engine.codeFetch &&
+    Object.values(revision.document.graph.nodes).some(
+      (node) => node.kind == 'task' && 'moduleId' in node.task && node.task.capabilities?.some((item) => item.kind == 'http'),
+    )
+  )
+    return { kind: 'engine-unsupported' }
   if (!engine.workflowTools && Object.values(revision.document.graph.nodes).some((node) => nodeWorkflowReferences(node).some((ref) => ref.tool != null)))
     return { kind: 'engine-unsupported' }
   if (triggerId != null) {

package/src/flow/common/webhookResponse.ts

@@ -1,4 +1,4 @@
-import type { InputPort, JsonValue, Port, PortDefinition } from './change.ts'
+import type { InputPort, JsonValue, Port, PortDefinition } from './model.ts'
 
 import { httpHeaderNameIssue } from '../../http/common/headers.ts'
 

package/src/flow/common/workflowReferences.ts

@@ -0,0 +1,31 @@
+import type { GraphNode } from './change.ts'
+import type { WorkflowCapability } from './model.ts'
+
+/** Workflow declarations share discovery across authoring, admission and resource indexing. */
+export function nodeWorkflowReferences(node: GraphNode): readonly {
+  readonly target: Omit<WorkflowCapability, 'kind' | 'name'>
+  readonly path: string
+  readonly tool?: string
+}[] {
+  if (node.kind != 'task') return []
+  if ('moduleId' in node.task)
+    return (node.task.capabilities ?? []).flatMap((item, index) =>
+      item.kind == 'workflow' ? [{ target: item, path: `task/capabilities/${index}`, tool: item.name }] : [],
+    )
+  if (node.task.executor.kind == 'workflow')
+    return [
+      {
+        target: {
+          ...node.task.executor,
+          inputs: node.task.inputs.filter((port) => 'handle' in port),
+          outputs: node.task.outputs.filter((port) => 'handle' in port),
+        },
+        path: 'task/executor',
+      },
+    ]
+  if (node.task.executor.kind == 'agent')
+    return node.task.executor.tools.flatMap((item, index) =>
+      item.kind == 'workflow' ? [{ target: item, path: `task/executor/tools/${index}`, tool: item.name }] : [],
+    )
+  return []
+}

package/src/http/common/authBindings.ts

@@ -1,12 +1,9 @@
-import type { FlowDocument } from '../../flow/common/change.ts'
+import type { InputMapping } from '../../flow/common/model.ts'
 
-/** Never allow credentials to enter a Revision as literal node inputs. */
-export function assertHttpAuthBindings(document: FlowDocument): void {
-  for (const node of Object.values(document.graph.nodes)) {
-    if (node.kind != 'task' || !('executor' in node.task) || !['openapi', 'http-request'].includes(node.task.executor.kind)) continue
-    for (const [handle, mapping] of Object.entries(node.inputs)) {
-      if (handle.startsWith('auth.') && mapping.kind == 'value')
-        throw new TypeError('HTTP authentication accepts deployment variables and upstream outputs only.')
-    }
+/** Never allow credentials to enter a Revision as literal inputs of an OpenAPI or HTTP request node. */
+export function assertHttpAuthBindings(inputs: Readonly<Record<string, InputMapping>>): void {
+  for (const [handle, mapping] of Object.entries(inputs)) {
+    if (handle.startsWith('auth.') && mapping.kind == 'value')
+      throw new TypeError('HTTP authentication accepts deployment variables and upstream outputs only.')
   }
 }

package/src/http/common/hosts.ts

@@ -0,0 +1,13 @@
+/** Hosts of a Code `http` Capability: lowercase DNS names or IPv4 addresses; `*.example.com` matches subdomains only. */
+export const httpHostPattern = /^(?:\*\.)?(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/
+export const maxHttpHosts = 20
+
+/** Wildcards must name a registrable suffix, so `*.com` is rejected. */
+export function isHttpHost(value: string): boolean {
+  return httpHostPattern.test(value) && (!value.startsWith('*.') || value.slice(2).includes('.'))
+}
+
+export function httpHostAllowed(hosts: readonly string[], hostname: string): boolean {
+  const host = hostname.toLowerCase()
+  return hosts.some((pattern) => (pattern.startsWith('*.') ? host.endsWith(pattern.slice(1)) : host == pattern))
+}

package/src/http/common/httpRequest.ts

@@ -1,10 +1,12 @@
-import type { InputMapping, InputPort, JsonValue, ManagedTaskDefinition, TaskNode } from '../../flow/common/change.ts'
+import type { InputMapping, InputPort, JsonValue, ManagedTaskDefinitionOf, TaskDefinitionBase, TaskExecutor } from '../../flow/common/model.ts'
 
 import { dequal } from 'dequal/lite'
 import { z } from 'zod'
 import { remapInputMappings, renamedPort } from '../../flow/common/portChanges.ts'
 import { httpHeaderNameIssue } from './headers.ts'
 
+export { httpHostAllowed, isHttpHost, maxHttpHosts } from './hosts.ts'
+
 const parameterSchema = z.strictObject({ mode: z.enum(['fields', 'object']).default('fields'), names: z.array(z.string()).default([]) })
 export const httpRequestConfigSchema = z.strictObject({
   method: z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']).default('GET'),
@@ -35,10 +37,10 @@ export function httpAuthHandles(config: HttpRequestConfig): string[] {
   return config.authentication.type == 'none' ? [] : config.authentication.type == 'basic' ? ['auth.username', 'auth.password'] : ['auth.token']
 }
 // Preserve metadata on ports whose contracts did not change.
-function retain(ports: readonly InputPort[], old: ManagedTaskDefinition['inputs']): ManagedTaskDefinition['inputs'] {
+function retain(ports: readonly InputPort[], old: TaskDefinitionBase['inputs']): TaskDefinitionBase['inputs'] {
   const remaining = new Map(ports.map((port) => [port.handle, port]))
   return [
-    ...old.flatMap((item): ManagedTaskDefinition['inputs'] => {
+    ...old.flatMap((item): TaskDefinitionBase['inputs'] => {
       if ('group' in item) return [item]
       const next = remaining.get(item.handle)
       if (next == null) return []
@@ -51,8 +53,8 @@ function retain(ports: readonly InputPort[], old: ManagedTaskDefinition['inputs'
 export function httpRequestTask(
   config: HttpRequestConfig = httpRequestConfigSchema.parse({}),
   name = 'HTTP Request',
-  previous?: ManagedTaskDefinition,
-): ManagedTaskDefinition {
+  previous?: TaskDefinitionBase,
+): ManagedTaskDefinitionOf<HttpRequestExecutor> {
   const inputs: InputPort[] = [{ handle: 'url', jsonSchema: { type: 'string' }, nullable: false }]
   for (const group of ['query', 'headers'] as const) {
     if (config[group].mode == 'object') inputs.push({ handle: group, jsonSchema: group == 'query' ? httpQuerySchema : httpHeaderSchema, nullable: true })
@@ -218,18 +220,29 @@ export function parseHttpResponse(config: HttpRequestConfig, status: number, hea
 /** Only a named parameter rename carries a value; changing source modes is not a rename. */
 export function httpRequestInputs(
   mappings: Readonly<Record<string, InputMapping>>,
-  previous: ManagedTaskDefinition,
-  next: ManagedTaskDefinition,
+  previous: TaskDefinitionBase,
+  next: TaskDefinitionBase,
 ): Record<string, InputMapping> {
   const candidate = renamedPort(previous.inputs, next.inputs)
   const rename = candidate != null && ['query.', 'header.'].some((prefix) => candidate.every((name) => name.startsWith(prefix))) ? candidate : undefined
   return remapInputMappings(mappings, next.inputs, rename)
 }
 
+/** A Task node as HTTP helpers read it; inline Tasks have no executor. */
+interface HttpTaskNode {
+  readonly inputs: Readonly<Record<string, InputMapping>>
+  readonly task: TaskDefinitionBase & { readonly executor?: TaskExecutor }
+}
+
+function httpRequestExecutor(node: HttpTaskNode): HttpRequestExecutor | undefined {
+  const executor = node.task.executor
+  return executor?.kind === 'http-request' ? (executor as HttpRequestExecutor) : undefined
+}
+
 /** The object editor assembles named inputs without changing unrelated request settings. */
-export function withHttpParameterFields(node: TaskNode, group: 'query' | 'headers', values: Record<string, JsonValue>): TaskNode {
-  if (!('executor' in node.task) || node.task.executor.kind !== 'http-request') return node
-  const config = node.task.executor
+export function withHttpParameterFields<Node extends HttpTaskNode>(node: Node, group: 'query' | 'headers', values: Record<string, JsonValue>): Node {
+  const config = httpRequestExecutor(node)
+  if (config == null) return node
   const task = httpRequestTask({ ...config, [group]: { mode: 'fields', names: Object.keys(values) } }, node.task.name, node.task)
   const inputs = httpRequestInputs(node.inputs, node.task, task)
   const rename = renamedPort(node.task.inputs, task.inputs)
@@ -238,14 +251,16 @@ export function withHttpParameterFields(node: TaskNode, group: 'query' | 'header
     const existing = config[group].mode === 'fields' && (config[group].names.includes(name) || rename?.[1] === handle)
     if (inputs[handle] == null && !existing) inputs[handle] = { kind: 'value', value }
   }
-  return { ...node, task, inputs }
+  // Only the HTTP Task and its input mappings change, so the node keeps its own type.
+  return { ...node, task, inputs } as Node
 }
 
-export function withHttpParameterSource(node: TaskNode, group: 'query' | 'headers', mapping?: InputMapping): TaskNode {
-  if (!('executor' in node.task) || node.task.executor.kind !== 'http-request') return node
-  const task = httpRequestTask({ ...node.task.executor, [group]: { mode: 'object', names: [] } }, node.task.name, node.task)
+export function withHttpParameterSource<Node extends HttpTaskNode>(node: Node, group: 'query' | 'headers', mapping?: InputMapping): Node {
+  const config = httpRequestExecutor(node)
+  if (config == null) return node
+  const task = httpRequestTask({ ...config, [group]: { mode: 'object', names: [] } }, node.task.name, node.task)
   const inputs = httpRequestInputs(node.inputs, node.task, task)
   if (mapping == null) delete inputs[group]
   else inputs[group] = mapping
-  return { ...node, task, inputs }
+  return { ...node, task, inputs } as Node
 }

package/src/openapi/common/openapi.ts

@@ -1,4 +1,4 @@
-import type { InputPort, JsonValue, ManagedTaskDefinition, Port } from '../../flow/common/change.ts'
+import type { InputPort, JsonValue, ManagedTaskDefinitionOf, Port, TaskExecutor } from '../../flow/common/model.ts'
 
 import { dequal } from 'dequal/lite'
 import { matchesSchema } from '../../flow/common/schema.ts'
@@ -224,6 +224,10 @@ function schema(doc: ObjectValue, schemaValue: JsonValue): JsonValue {
   if (typeof converted == 'boolean') return converted
   return { $schema: 'https://json-schema.org/draft/2020-12/schema', ...object(converted), ...(Object.keys(defs).length ? { $defs: defs } : {}) }
 }
+function isOpenApiExecutor(executor: TaskExecutor): executor is OpenApiExecutor {
+  return executor.kind == 'openapi'
+}
+
 function parameters(config: OpenApiExecutor): ObjectValue[] {
   const doc = parseOpenApi(config.document)
   const { item, op } = operation(doc, config.path, config.method)
@@ -250,7 +254,7 @@ function jsonContent(doc: ObjectValue, value: JsonValue): { schema: JsonValue; r
 export function authHandles(auth: readonly OpenApiAuth[]): string[] {
   return auth.flatMap((scheme) => (scheme.type == 'basic' ? [`auth.${scheme.id}.username`, `auth.${scheme.id}.password`] : [`auth.${scheme.id}.token`]))
 }
-export function openApiTask(config: OpenApiExecutor, name = 'OpenAPI'): ManagedTaskDefinition {
+export function openApiTask(config: OpenApiExecutor, name = 'OpenAPI'): ManagedTaskDefinitionOf<OpenApiExecutor> {
   if (!config.path) return { name, executor: config, inputs: [], outputs: [] }
   const doc = parseOpenApi(config.document)
   const { op } = operation(doc, config.path, config.method)
@@ -318,8 +322,8 @@ export interface OpenApiFieldIssue {
 }
 
 /** The canvas validator and property panel share the same configuration contract. */
-export function openApiFieldIssues(task: ManagedTaskDefinition): OpenApiFieldIssue[] {
-  if (task.executor.kind != 'openapi') return []
+export function openApiFieldIssues<Executor extends TaskExecutor>(task: ManagedTaskDefinitionOf<Executor>): OpenApiFieldIssue[] {
+  if (!isOpenApiExecutor(task.executor)) return []
   const config = task.executor
   let field: OpenApiFieldIssue['field'] = 'sourceUrl'
   try {
@@ -342,7 +346,7 @@ export function openApiFieldIssues(task: ManagedTaskDefinition): OpenApiFieldIss
   }
 }
 
-export function openApiIssues(task: ManagedTaskDefinition): string[] {
+export function openApiIssues(task: ManagedTaskDefinitionOf<TaskExecutor>): string[] {
   return openApiFieldIssues(task).map((issue) => issue.message)
 }
 export function selectOperation(value: JsonValue, sourceUrl: string, path: string, method: string): OpenApiExecutor {

package/src/{execution → runtime}/common/engineContract.ts

@@ -7,25 +7,31 @@ export interface EngineContract {
   readonly webhookResponses?: boolean
   readonly workflowTools?: boolean
   readonly httpRequests?: boolean
+  /** Code may call `context.fetch` for hosts declared by its `http` Capability. */
+  readonly codeFetch?: boolean
 }
 
-export const currentEngineContract = 'open-flow-engine/v8'
+/** v9 is a single contract: the Node compatibility builtins, `context.fetch`, and no `context.egress`. */
+export const currentEngineContract = 'open-flow-engine/v9'
+/** The published v8 Node compatibility contract, retained for existing Publications and Runs. */
 export const nodejsEngineContract = 'open-flow-engine/v8/nodejs-compat-v1'
 
-const currentContract: EngineContract = {
+const platformSource = (contract: string) => `export const engineContract = ${JSON.stringify(contract)}
+export function identity(value) { return value }
+`
+
+const v8Contract: EngineContract = {
   workflowTools: true,
   httpRequests: true,
   waitAutoContinue: true,
   webhookResponses: true,
   platformExports: new Set(['engineContract', 'identity']),
   platformModule: 'open-flow:platform',
-  platformSource: `export const engineContract = ${JSON.stringify(currentEngineContract)}
-export function identity(value) { return value }
-`,
+  platformSource: platformSource('open-flow-engine/v8'),
 }
 
 const nodejsContract: EngineContract = {
-  ...currentContract,
+  ...v8Contract,
   builtinModules: new Set(
     [
       'assert',
@@ -54,31 +60,30 @@ const nodejsContract: EngineContract = {
       'zlib',
     ].flatMap((name) => [name, `node:${name}`]),
   ),
-  platformSource: `export const engineContract = ${JSON.stringify(nodejsEngineContract)}
-export function identity(value) { return value }
-`,
+  platformSource: platformSource(nodejsEngineContract),
 }
 
+const currentContract: EngineContract = { ...nodejsContract, codeFetch: true, platformSource: platformSource(currentEngineContract) }
+
 export function findEngineContract(contract: string): EngineContract | undefined {
   if (contract == currentEngineContract) return currentContract
+  if (contract == 'open-flow-engine/v8') return v8Contract
   if (contract == nodejsEngineContract) return nodejsContract
   if (contract == 'open-flow-engine/v7' || contract == 'open-flow-engine/v7/nodejs-compat-v1')
     return {
-      ...(contract.endsWith('/nodejs-compat-v1') ? nodejsContract : currentContract),
+      ...(contract.endsWith('/nodejs-compat-v1') ? nodejsContract : v8Contract),
       workflowTools: false,
       httpRequests: false,
-      platformSource: `export const engineContract = ${JSON.stringify(contract)}\nexport function identity(value) { return value }\n`,
+      platformSource: platformSource(contract),
     }
   if (contract == 'open-flow-engine/v6' || contract == 'open-flow-engine/v6/nodejs-compat-v1')
     return {
-      ...(contract == 'open-flow-engine/v6' ? currentContract : nodejsContract),
+      ...(contract == 'open-flow-engine/v6' ? v8Contract : nodejsContract),
       workflowTools: false,
       httpRequests: false,
       waitAutoContinue: false,
       webhookResponses: false,
-      platformSource: `export const engineContract = ${JSON.stringify(contract)}
-export function identity(value) { return value }
-`,
+      platformSource: platformSource(contract),
     }
   return undefined
 }