@oomol-lab/open-flow 0.1.0-beta.75 → 0.1.0-beta.77

package/dist/common/control-requests.d.ts

@@ -35,7 +35,7 @@ export declare const controlRequests: {
         edits: ({
             op: "node.add";
             as: string;
-            type: "agent" | "approval" | "code" | "condition" | "connector" | "cron" | "decision" | "error" | "http-request" | "integration" | "llm" | "openapi" | "outputs" | "poll" | "start" | "value" | "wait" | "webhook" | "webhook-response" | "workflow";
+            type: "agent" | "approval" | "code" | "condition" | "connector" | "cron" | "decision" | "dedupe" | "error" | "http-request" | "integration" | "llm" | "openapi" | "outputs" | "poll" | "start" | "value" | "wait" | "webhook" | "webhook-response" | "workflow";
             name: string;
             onError?: "error" | "stop" | undefined;
             retry?: {
@@ -178,12 +178,12 @@ export declare const controlRequests: {
     authoringSearch: (value: unknown) => {
         revision?: string | undefined;
         query: string;
-        type?: "agent" | "approval" | "code" | "condition" | "connector" | "cron" | "decision" | "error" | "http-request" | "integration" | "llm" | "openapi" | "outputs" | "poll" | "start" | "value" | "wait" | "webhook" | "webhook-response" | "workflow" | undefined;
+        type?: "agent" | "approval" | "code" | "condition" | "connector" | "cron" | "decision" | "dedupe" | "error" | "http-request" | "integration" | "llm" | "openapi" | "outputs" | "poll" | "start" | "value" | "wait" | "webhook" | "webhook-response" | "workflow" | undefined;
         offset: number;
         limit: number;
     };
     authoringSchema: (value: unknown) => {
-        type?: "agent" | "approval" | "code" | "condition" | "connector" | "cron" | "decision" | "error" | "http-request" | "integration" | "llm" | "openapi" | "outputs" | "poll" | "start" | "value" | "wait" | "webhook" | "webhook-response" | "workflow" | undefined;
+        type?: "agent" | "approval" | "code" | "condition" | "connector" | "cron" | "decision" | "dedupe" | "error" | "http-request" | "integration" | "llm" | "openapi" | "outputs" | "poll" | "start" | "value" | "wait" | "webhook" | "webhook-response" | "workflow" | undefined;
         action?: string | undefined;
     };
     loadOpenApiDocument: (value: unknown) => {
@@ -200,11 +200,30 @@ export declare const controlRequests: {
         file: JsonValue;
         name?: string | undefined;
         teamId?: string | undefined;
+        tagIds?: string[] | undefined;
         version: 1;
     };
     createFlow: (value: unknown) => {
         name: string;
         teamId?: string | undefined;
+        tagIds?: string[] | undefined;
+        version: 1;
+    };
+    saveTag: (value: unknown) => {
+        name: string;
+        version: 1;
+    };
+    setFlowTags: (value: unknown) => {
+        tagIds: string[];
+        version: 1;
+    };
+    updateFlow: (value: unknown) => {
+        name: string;
+        tagIds?: string[] | undefined;
+        version: 1;
+    } | {
+        name?: string | undefined;
+        tagIds: string[];
         version: 1;
     };
     renameFlow: (value: unknown) => {

package/dist/common/control-requests.js

@@ -12163,6 +12163,9 @@ function schemaValidationErrors(value, schema) {
 }
 //#endregion
 //#region src/decision/common/decision.ts
+function isDecisionExecutor(executor) {
+	return executor.kind === "decision";
+}
 var decisionLimits = {
 	choice: 255,
 	score: 10
@@ -12185,7 +12188,7 @@ function limitDecisionQuestions(questions) {
 }
 /** Loading an oversized task also updates its previously generated output schemas. */
 function limitDecisionTask(task) {
-	if (task.executor.kind !== "decision") return task;
+	if (!isDecisionExecutor(task.executor)) return task;
 	const original = task.executor.questions;
 	const questions = limitDecisionQuestions(original);
 	if (questions === original) return task;
@@ -12286,12 +12289,17 @@ function decisionTask(questions = [defaultDecisionQuestion()], name = "AI Decisi
 }
 //#endregion
 //#region src/http/common/authBindings.ts
-/** Never allow credentials to enter a Revision as literal node inputs. */
-function assertHttpAuthBindings(document) {
-	for (const node of Object.values(document.graph.nodes)) {
-		if (node.kind != "task" || !("executor" in node.task) || !["openapi", "http-request"].includes(node.task.executor.kind)) continue;
-		for (const [handle, mapping] of Object.entries(node.inputs)) if (handle.startsWith("auth.") && mapping.kind == "value") throw new TypeError("HTTP authentication accepts deployment variables and upstream outputs only.");
-	}
+/** Never allow credentials to enter a Revision as literal inputs of an OpenAPI or HTTP request node. */
+function assertHttpAuthBindings(inputs) {
+	for (const [handle, mapping] of Object.entries(inputs)) if (handle.startsWith("auth.") && mapping.kind == "value") throw new TypeError("HTTP authentication accepts deployment variables and upstream outputs only.");
+}
+//#endregion
+//#region src/http/common/hosts.ts
+/** Hosts of a Code `http` Capability: lowercase DNS names or IPv4 addresses; `*.example.com` matches subdomains only. */
+var httpHostPattern = /^(?:\*\.)?(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** Wildcards must name a registrable suffix, so `*.com` is rejected. */
+function isHttpHost(value) {
+	return httpHostPattern.test(value) && (!value.startsWith("*.") || value.slice(2).includes("."));
 }
 //#endregion
 //#region src/flow/common/portChanges.ts
@@ -12465,6 +12473,71 @@ function httpRequestInputs(mappings, previous, next) {
 	const rename = candidate != null && ["query.", "header."].some((prefix) => candidate.every((name) => name.startsWith(prefix))) ? candidate : void 0;
 	return remapInputMappings(mappings, next.inputs, rename);
 }
+strictObject({
+	scope: _enum(["draft", "live"]),
+	values: boolean().optional()
+});
+strictObject({
+	scope: _enum(["draft", "live"]),
+	key: string().min(1).refine((key) => new TextEncoder().encode(key).length <= 256).optional()
+});
+strictObject({
+	scope: _enum(["draft", "live"]),
+	space: string().regex(/^(flow|node:.+)$/)
+});
+var dedupeConfigSchema = strictObject({
+	field: string().default(""),
+	mode: _enum(["new", "increasing"]).default("new"),
+	space: _enum(["node", "flow"]).default("node")
+});
+var dedupeExecutorSchema = dedupeConfigSchema.extend({ kind: literal("dedupe") });
+function dedupeTask(config = dedupeConfigSchema.parse({}), name = "Remove Duplicates") {
+	return {
+		name,
+		executor: {
+			...config,
+			kind: "dedupe"
+		},
+		inputs: [{
+			handle: "items",
+			jsonSchema: { type: "array" },
+			nullable: false
+		}],
+		outputs: ["items", "duplicates"].map((handle) => ({
+			handle,
+			jsonSchema: { type: "array" },
+			nullable: false
+		}))
+	};
+}
+object$1({
+	version: literal(1),
+	scope: _enum(["draft", "live"]),
+	limits: object$1({
+		maxValueBytes: number().positive(),
+		maxValues: number().int().positive(),
+		maxSpaces: number().int().positive(),
+		maxIdentities: number().positive(),
+		maxRunWrites: number().positive()
+	}),
+	values: array(object$1({
+		key: string(),
+		size: number().nonnegative(),
+		updatedAt: number(),
+		value: json$5().optional()
+	})),
+	spaces: array(object$1({
+		space: string(),
+		mode: _enum(["new", "increasing"]),
+		count: number().nonnegative(),
+		watermark: union([
+			string(),
+			number(),
+			_null()
+		]),
+		updatedAt: number()
+	}))
+});
 function checkJsonDepth(value, depth = 0) {
 	if (depth > 64) throw new TypeError("Value exceeds the maximum JSON depth.");
 	if (value != null && typeof value == "object") for (const child of Object.values(value)) checkJsonDepth(child, depth + 1);
@@ -12665,7 +12738,15 @@ var workflowCapabilitySchema = strictObject({
 	inputs: array(port),
 	outputs: array(port).nullable()
 });
-var capability = union([connectorCapabilitySchema, workflowCapabilitySchema]);
+var httpCapabilitySchema = strictObject({
+	kind: literal("http"),
+	hosts: array(text$1.refine(isHttpHost, "Use a lowercase host name or IPv4 address, optionally prefixed by \"*.\" for subdomains.")).min(1).max(20).describe("Hosts Code may call with context.fetch. \"*.example.com\" matches subdomains only.")
+});
+var capability = union([
+	connectorCapabilitySchema,
+	workflowCapabilitySchema,
+	httpCapabilitySchema
+]);
 var inline = object$1({
 	...ports,
 	name: text$1,
@@ -12776,7 +12857,8 @@ var managedFields = object$1({
 			flowId: text$1,
 			revisionId: text$1
 		}),
-		httpRequestExecutorSchema
+		httpRequestExecutorSchema,
+		dedupeExecutorSchema
 	])
 });
 var managed = managedFields.transform(limitDecisionTask);
@@ -13045,7 +13127,9 @@ var revision = object$1({
 		literal(8),
 		literal(9),
 		literal(10),
-		literal(11)
+		literal(11),
+		literal(12),
+		literal(13)
 	]),
 	document,
 	modules: record$3(text$1, module)
@@ -13076,7 +13160,7 @@ function decodeRevisionContent(value) {
 	checkJsonDepth(value);
 	const content = revision.parse(value);
 	checkModelVersion(content);
-	assertHttpAuthBindings(content.document);
+	assertDocumentHttpAuthBindings(content.document);
 	return content;
 }
 var shapes = {
@@ -13270,6 +13354,8 @@ function changeOperationsSchema(kind) {
 	return toJSONSchema(schema, { io: "input" });
 }
 function checkModelVersion(content) {
+	if (content.modelVersion < 13 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind === "task" && "executor" in candidateNode.task && candidateNode.task.executor.kind === "dedupe")) throw new Error("Deduplication requires Flow model v13.");
+	if (content.modelVersion < 12 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && "moduleId" in candidateNode.task && candidateNode.task.capabilities?.some((item) => item.kind == "http"))) throw new TypeError("Code HTTP access requires Flow model version 12.");
 	if (content.modelVersion < 11 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && "executor" in candidateNode.task && candidateNode.task.executor.kind == "http-request")) throw new TypeError("HTTP Request requires Flow model version 11.");
 	if (content.modelVersion < 11 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && ("moduleId" in candidateNode.task ? candidateNode.task.capabilities?.some((item) => item.kind == "workflow") : candidateNode.task.executor.kind == "agent" && candidateNode.task.executor.tools.some((item) => item.kind == "workflow")))) throw new TypeError("Workflow tools require Flow model version 11.");
 	if (content.modelVersion < 10 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "webhook" && (candidateNode.options?.responseBody != null || candidateNode.options?.responseStatusCodeOutput != null || candidateNode.options?.responseHeadersSource != null || candidateNode.options?.responseHeaderOutputs != null))) throw new TypeError("Dynamic Webhook responses require Flow model version 10.");
@@ -13285,6 +13371,87 @@ function checkModelVersion(content) {
 	if (content.modelVersion < 6 && Object.values(content.document.graph.nodes).some((candidateNode) => candidateNode.kind == "task" && "executor" in candidateNode.task)) throw new TypeError("Node-owned managed Tasks require Flow model version 6.");
 	if (content.modelVersion < 5 && Object.values(content.document.graph.nodes).some((itemNode) => itemNode.kind == "error")) throw new TypeError("Error workflows require Flow model version 5.");
 }
+function assertDocumentHttpAuthBindings(content) {
+	for (const graphNode of Object.values(content.graph.nodes)) if (graphNode.kind == "task" && "executor" in graphNode.task && ["openapi", "http-request"].includes(graphNode.task.executor.kind)) assertHttpAuthBindings(graphNode.inputs);
+}
+//#endregion
+//#region src/runtime/common/engineContract.ts
+/** v10 adds persistent Flow State to the published v9 Node compatibility and fetch contract. */
+var currentEngineContract = "open-flow-engine/v10";
+/** The published v8 Node compatibility contract, retained for existing Publications and Runs. */
+var nodejsEngineContract = "open-flow-engine/v8/nodejs-compat-v1";
+var platformSource = (contract) => `export const engineContract = ${JSON.stringify(contract)}
+export function identity(value) { return value }
+`;
+var v8Contract = {
+	workflowTools: true,
+	httpRequests: true,
+	waitAutoContinue: true,
+	webhookResponses: true,
+	platformExports: /* @__PURE__ */ new Set(["engineContract", "identity"]),
+	platformModule: "open-flow:platform",
+	platformSource: platformSource("open-flow-engine/v8")
+};
+var nodejsContract = {
+	...v8Contract,
+	builtinModules: new Set([
+		"assert",
+		"assert/strict",
+		"buffer",
+		"console",
+		"constants",
+		"crypto",
+		"events",
+		"fs",
+		"fs/promises",
+		"os",
+		"path",
+		"path/posix",
+		"process",
+		"punycode",
+		"querystring",
+		"stream",
+		"stream/promises",
+		"stream/web",
+		"string_decoder",
+		"timers",
+		"timers/promises",
+		"url",
+		"util",
+		"zlib"
+	].flatMap((name) => [name, `node:${name}`])),
+	platformSource: platformSource(nodejsEngineContract)
+};
+var v9Contract = {
+	...nodejsContract,
+	codeFetch: true,
+	platformSource: platformSource("open-flow-engine/v9")
+};
+var currentContract = {
+	...v9Contract,
+	flowState: true,
+	platformSource: platformSource(currentEngineContract)
+};
+function findEngineContract(contract) {
+	if (contract == "open-flow-engine/v10") return currentContract;
+	if (contract == "open-flow-engine/v9") return v9Contract;
+	if (contract == "open-flow-engine/v8") return v8Contract;
+	if (contract == "open-flow-engine/v8/nodejs-compat-v1") return nodejsContract;
+	if (contract == "open-flow-engine/v7" || contract == "open-flow-engine/v7/nodejs-compat-v1") return {
+		...contract.endsWith("/nodejs-compat-v1") ? nodejsContract : v8Contract,
+		workflowTools: false,
+		httpRequests: false,
+		platformSource: platformSource(contract)
+	};
+	if (contract == "open-flow-engine/v6" || contract == "open-flow-engine/v6/nodejs-compat-v1") return {
+		...contract == "open-flow-engine/v6" ? v8Contract : nodejsContract,
+		workflowTools: false,
+		httpRequests: false,
+		waitAutoContinue: false,
+		webhookResponses: false,
+		platformSource: platformSource(contract)
+	};
+}
 //#endregion
 //#region src/control/common/authoringLlm.ts
 var authoringLlmConfiguration = strictObject({
@@ -13872,6 +14039,7 @@ var authoringTypes = [
 	"decision",
 	"openapi",
 	"http-request",
+	"dedupe",
 	"condition",
 	"value",
 	"wait",
@@ -13934,11 +14102,15 @@ var agentTool = union([workflowAgentToolSchema.omit({
 	id: true,
 	inputs: true
 }).extend({ inputs: toolSources }).strict()]);
-var authoringCapabilities = array(union([connectorCapabilitySchema, strictObject({
-	kind: literal("workflow"),
-	name: id$1,
-	flowId: id$1
-})]));
+var authoringCapabilities = array(union([
+	connectorCapabilitySchema,
+	strictObject({
+		kind: literal("workflow"),
+		name: id$1,
+		flowId: id$1
+	}),
+	httpCapabilitySchema
+]));
 var notification = strictObject({
 	...authoringDefinitionSchemas.connector.shape,
 	messageHandle: id$1,
@@ -13999,6 +14171,7 @@ var authoringConfigurations = {
 	"connector": authoringDefinitionSchemas.connector.omit({ outputMode: true }).strict(),
 	"openapi": authoringOpenApiSchema,
 	"http-request": httpRequestConfigSchema,
+	"dedupe": dedupeConfigSchema,
 	"agent": authoringDefinitionSchemas.agent.omit({
 		prompt: true,
 		tools: true
@@ -14200,6 +14373,7 @@ var requestContracts = {
 		examples: [{ revisionId: "REVISION" }]
 	}
 };
+var codeGuidance = `Code is an ES module whose default export receives (inputs, context) and returns the business outputs. It may import the Node builtins ${[...findEngineContract(currentEngineContract).builtinModules].filter((name) => !name.startsWith("node:")).join(", ")}, with or without the node: prefix; fs is a fresh in-memory filesystem containing /tmp per execution. require, dynamic import, packages and the http/net builtins are unavailable. To call HTTP APIs, declare their hosts in config.capabilities as {kind: "http", hosts: ["api.example.com", "*.example.org"]} and use context.fetch(url, {method, headers, body}); it returns status, ok, headers.get(), text(), json() and bytes(), does not follow redirects, adds no credentials, and limits bodies to 1 MiB. Prefer an HTTP Request node for a single call without transformation and Connector Actions for services with accounts. context provides inputs, signal, getPrevious(), fetch, actions, workflows, artifact, flowId, runId and blockId. Select workflows through config.capabilities: [{kind: "workflow", flowId, name}]. Call context.workflows.call(name, input) and await its business output. The platform derives input/output types. Refresh a selected workflow tool with node.refresh and tool: its name. Calls obey node and Run time limits.`;
 /** Transport-independent discovery of the same requests the service validates. */
 function authoringRequestContract(name) {
 	if (!Object.hasOwn(requestContracts, name)) return void 0;
@@ -14217,7 +14391,7 @@ function authoringSchema(kind) {
 		guidance: "Read a node type schema before creating or configuring it. Use $alias to reference a preceding node.add in the same batch. Read returns stable node references. Long code and prompt fields use text reads and edits. Changes use the observed baseRevision and a stable requestId."
 	} : {
 		type: kind,
-		onError: retryNodeTypes.some((nodeType) => nodeType == kind) ? { enum: ["stop", "error"] } : false,
+		onError: kind == "dedupe" || retryNodeTypes.some((nodeType) => nodeType == kind) ? { enum: ["stop", "error"] } : false,
 		retry: retryNodeTypes.some((nodeType) => nodeType == kind) ? toJSONSchema(retryConfigurationSchema) : false,
 		inputSources: ["poll", "integration"].includes(kind) ? [
 			"value",
@@ -14247,7 +14421,7 @@ function authoringSchema(kind) {
 			"wait",
 			"approval"
 		].includes(kind),
-		guidance: kind == "webhook-response" ? "Prepare an HTTP response using fixed inputs body (any JSON, default empty text), statusCode (number, default 200) and headers (scalar-valued object, default {}). Select this node in Webhook options.responseBody as {kind: \"webhook-response\", nodeId: \"node reference\", timeoutMs: 30000}. Its first completion responds immediately while the Run continues. It has no business outputs. Multiple response nodes are allowed; each Webhook selects one reachable node." : kind == "outputs" ? "Declare output fields through config.outputDefs. Set their values through node.add.inputs or input.set. Outputs is a singleton execution sink; it waits for its predecessors and produces workflow business outputs independently of node logs. No downstream edges or data references to Outputs are allowed." : kind == "webhook" ? "Use options.responseBody: {kind: \"webhook-response\", nodeId: \"node ID or $alias\", timeoutMs: 30000} to respond on the selected node’s first completion while the Run continues. Body, statusCode and headers come exclusively from that node; clear workflow-output-only status/header references when switching. Alternatively configure options.responseBody as {kind: \"workflow-outputs\", output?: \"top-level output name\", timeoutMs?: 30000} to respond after the Run succeeds. Omit output for the complete object. Connect Webhook to Outputs. Timeout is 1000–60000 ms; HTTP timeout does not cancel the Run. Strings return text; other values return JSON. Only in this mode, options.responseStatusCodeOutput can select a numeric top-level workflow output as the HTTP status, overriding the preserved fixed responseStatusCode (default 200). Its runtime value must be an integer from 200 to 599, excluding 204, 205, 304; missing or invalid values return 500. Use responseHeaders for fixed text headers. In workflow-output mode, responseHeaderOutputs maps header names to top-level output names; values can be string, number or boolean and are converted to text. Alternatively responseHeadersSource: {kind: \"workflow-outputs\", output?: \"object field\"} replaces the entire header object (omit output for all outputs), preserving but ignoring per-header settings. Missing, null, complex or invalid header values return 500 without fallback. Header restrictions and Content-Type policy still apply. Omit responseBody for immediate responseData. Clear options.responseBody, options.responseStatusCodeOutput, options.responseHeadersSource and options.responseHeaderOutputs explicitly to switch back." : kind == "start" ? "Declare workflow inputs through config.inputDefs; read them in Start node details. REST calls and manual runs supply them as trigger.outputs. Downstream nodes bind these parameters as Start outputs. Start has no input sources or defaults; non-nullable parameters are required, and omitted nullable parameters become null." : kind == "condition" ? "Edit branch operands through config.branches. A branch can test one expression, all expressions, or any alternatives. Unmatched execution uses branch otherwise." : ["poll", "integration"].includes(kind) ? "Configure static parameters with node.add.inputs or input.set. Definitions come from the selected Trigger key; execution output and variable sources are unavailable." : kind == "llm" ? "Configure model settings, message templates and history as defaults. Input bindings with the same names override these defaults; named business inputs can be bound directly. Template strings interpolate {{name}}." : kind == "http-request" ? "Configure method, query/headers modes and names, bodyFormat, authentication, responseFormat and statusPolicy. Bind url, query.<name>/header.<name> or whole query/headers objects, body and auth.token (Basic: auth.username/auth.password). Credentials accept variables or upstream outputs only. Outputs: body, statusCode, headers. Authentication is replaced as a complete choice." : kind == "openapi" ? "Select an operation; the tool resolves its ports and authentication. Read authenticationChoices from node details. authentication is replaced as a complete choice. Bind advertised credentials through inputs." : kind == "workflow" ? "Select another workflow with config.flowId. A workflow cannot call itself, including in a disconnected node. Owned unpublished or unavailable targets may be saved as incomplete drafts. Use node.refresh to load the current published interface." : kind == "agent" ? "Tools accept Connector Actions or {kind: \"workflow\", flowId, name, description, approval, inputs}. Workflow parameter sources use model, input or value. The platform derives the interface. Refresh a workflow tool with node.refresh and tool: its name." : kind == "code" ? "Select workflows through config.capabilities: [{kind: \"workflow\", flowId, name}]. Call context.workflows.call(name, input) and await its business output. The platform derives input/output types. Refresh a selected workflow tool with node.refresh and tool: its name. Calls obey node and Run time limits." : "Supply business configuration and input data. Fixed definitions are assembled by the tool. Existing constraints and defaults are preserved on partial updates.",
+		guidance: kind == "webhook-response" ? "Prepare an HTTP response using fixed inputs body (any JSON, default empty text), statusCode (number, default 200) and headers (scalar-valued object, default {}). Select this node in Webhook options.responseBody as {kind: \"webhook-response\", nodeId: \"node reference\", timeoutMs: 30000}. Its first completion responds immediately while the Run continues. It has no business outputs. Multiple response nodes are allowed; each Webhook selects one reachable node." : kind == "outputs" ? "Declare output fields through config.outputDefs. Set their values through node.add.inputs or input.set. Outputs is a singleton execution sink; it waits for its predecessors and produces workflow business outputs independently of node logs. No downstream edges or data references to Outputs are allowed." : kind == "webhook" ? "Use options.responseBody: {kind: \"webhook-response\", nodeId: \"node ID or $alias\", timeoutMs: 30000} to respond on the selected node’s first completion while the Run continues. Body, statusCode and headers come exclusively from that node; clear workflow-output-only status/header references when switching. Alternatively configure options.responseBody as {kind: \"workflow-outputs\", output?: \"top-level output name\", timeoutMs?: 30000} to respond after the Run succeeds. Omit output for the complete object. Connect Webhook to Outputs. Timeout is 1000–60000 ms; HTTP timeout does not cancel the Run. Strings return text; other values return JSON. Only in this mode, options.responseStatusCodeOutput can select a numeric top-level workflow output as the HTTP status, overriding the preserved fixed responseStatusCode (default 200). Its runtime value must be an integer from 200 to 599, excluding 204, 205, 304; missing or invalid values return 500. Use responseHeaders for fixed text headers. In workflow-output mode, responseHeaderOutputs maps header names to top-level output names; values can be string, number or boolean and are converted to text. Alternatively responseHeadersSource: {kind: \"workflow-outputs\", output?: \"object field\"} replaces the entire header object (omit output for all outputs), preserving but ignoring per-header settings. Missing, null, complex or invalid header values return 500 without fallback. Header restrictions and Content-Type policy still apply. Omit responseBody for immediate responseData. Clear options.responseBody, options.responseStatusCodeOutput, options.responseHeadersSource and options.responseHeaderOutputs explicitly to switch back." : kind == "start" ? "Declare workflow inputs through config.inputDefs; read them in Start node details. REST calls and manual runs supply them as trigger.outputs. Downstream nodes bind these parameters as Start outputs. Start has no input sources or defaults; non-nullable parameters are required, and omitted nullable parameters become null." : kind == "condition" ? "Edit branch operands through config.branches. A branch can test one expression, all expressions, or any alternatives. Unmatched execution uses branch otherwise." : ["poll", "integration"].includes(kind) ? "Configure static parameters with node.add.inputs or input.set. Definitions come from the selected Trigger key; execution output and variable sources are unavailable." : kind == "llm" ? "Configure model settings, message templates and history as defaults. Input bindings with the same names override these defaults; named business inputs can be bound directly. Template strings interpolate {{name}}." : kind == "dedupe" ? "Bind an items array. Configure field (dot-separated identity path, empty for scalar items), mode (new or increasing), and space (node or flow). Outputs are items and duplicates. History persists immediately; downstream failures do not roll it back. Increasing mode accepts finite numbers or RFC 3339 timestamps, never mixed types." : kind == "http-request" ? "Configure method, query/headers modes and names, bodyFormat, authentication, responseFormat and statusPolicy. Bind url, query.<name>/header.<name> or whole query/headers objects, body and auth.token (Basic: auth.username/auth.password). Credentials accept variables or upstream outputs only. Outputs: body, statusCode, headers. Authentication is replaced as a complete choice." : kind == "openapi" ? "Select an operation; the tool resolves its ports and authentication. Read authenticationChoices from node details. authentication is replaced as a complete choice. Bind advertised credentials through inputs." : kind == "workflow" ? "Select another workflow with config.flowId. A workflow cannot call itself, including in a disconnected node. Owned unpublished or unavailable targets may be saved as incomplete drafts. Use node.refresh to load the current published interface." : kind == "agent" ? "Tools accept Connector Actions or {kind: \"workflow\", flowId, name, description, approval, inputs}. Workflow parameter sources use model, input or value. The platform derives the interface. Refresh a workflow tool with node.refresh and tool: its name." : kind == "code" ? codeGuidance : "Supply business configuration and input data. Fixed definitions are assembled by the tool. Existing constraints and defaults are preserved on partial updates.",
 		example: {
 			op: "node.add",
 			as: "step",
@@ -14270,6 +14444,17 @@ function authoringSchema(kind) {
 					}]
 				} },
 				"integration": { config: { key: "<Trigger key>" } },
+				"dedupe": {
+					config: {
+						field: "id",
+						mode: "new",
+						space: "node"
+					},
+					inputs: { items: {
+						kind: "value",
+						value: [{ id: "a" }, { id: "b" }]
+					} }
+				},
 				"http-request": {
 					config: {},
 					inputs: { url: {
@@ -14529,7 +14714,7 @@ var nodeErrorSchema = {
 	}
 };
 function supportsNodeErrorHandling(node) {
-	return supportsNodeRetry(node);
+	return supportsNodeRetry(node) || node.kind === "task" && "executor" in node.task && node.task.executor.kind === "dedupe";
 }
 function nodeSystemOutputPorts(node) {
 	return supportsNodeErrorHandling(node) && node.onError == "error" ? { error: {
@@ -14537,6 +14722,11 @@ function nodeSystemOutputPorts(node) {
 		nullable: true
 	} } : {};
 }
+//#endregion
+//#region src/flow/common/model.ts
+function portsByHandle(ports) {
+	return Object.fromEntries(ports.flatMap((port) => "handle" in port ? [[port.handle, port]] : []));
+}
 function resourceNameIssue(value) {
 	const name = value.trim();
 	if (name.length == 0) return "empty";
@@ -14547,9 +14737,6 @@ function resourceNameIssue(value) {
 	}
 	if (!/^[\p{L}\p{N}](?:[\p{L}\p{N} _-]*[\p{L}\p{N}])?$/u.test(name)) return "specialCharacter";
 }
-function portsByHandle(ports) {
-	return Object.fromEntries(ports.flatMap((port) => "handle" in port ? [[port.handle, port]] : []));
-}
 var workflowToolNamePattern = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
 function workflowToolNameIssue(name, otherNames = []) {
 	if (!workflowToolNamePattern.test(name)) return "invalid";
@@ -14565,6 +14752,8 @@ function decodeTaskCapabilities(value) {
 		if (workflowToolNameIssue(item.name, names)) throw new TypeError("Workflow tool names must be unique provider-compatible names.");
 		names.add(item.name);
 	}
+	const http = parsed.filter((item) => item.kind == "http");
+	if (http.length > 1 || http.some((item) => new Set(item.hosts).size != item.hosts.length)) throw new TypeError("Code declares HTTP hosts once, without duplicates.");
 	let connectorIndex = 0;
 	return parsed.map((item) => item.kind == "connector" ? connectors[connectorIndex++] : item);
 }
@@ -14700,10 +14889,10 @@ function upgradeRevisionContent(content) {
 function upgradeDecodedRevisionContent(content) {
 	const graph = content.document.graph;
 	const hasManual = Object.values(graph.nodes).some((node) => node.kind == "manual");
-	if (!hasManual && content.modelVersion == 11) return content;
+	if (!hasManual && content.modelVersion == 13) return content;
 	return {
 		...content,
-		modelVersion: 11,
+		modelVersion: 13,
 		document: {
 			...content.document,
 			graph: hasManual ? {
@@ -14738,7 +14927,7 @@ function invalid(message) {
 	throw new FlowChangeError(message);
 }
 function applyFlowChanges(content, operations) {
-	const source = content.modelVersion != 11 || Object.values(content.document.graph.nodes).some((node) => node.kind == "manual") ? decodeRevisionContent(content) : content;
+	const source = content.modelVersion != 13 || Object.values(content.document.graph.nodes).some((node) => node.kind == "manual") ? decodeRevisionContent(content) : content;
 	const document = { ...source.document };
 	const modules = { ...source.modules };
 	for (const operation of operations) switch (operation.kind) {
@@ -15183,10 +15372,10 @@ function applyFlowChanges(content, operations) {
 			break;
 		}
 	}
-	assertHttpAuthBindings(document);
+	assertDocumentHttpAuthBindings(document);
 	return upgradeDecodedRevisionContent({
 		document,
-		modelVersion: 11,
+		modelVersion: 13,
 		modules
 	});
 }
@@ -16411,7 +16600,7 @@ function authoringNode(content, ref) {
 			inputs: fieldsView([...task.inputs, ...node.kind == "task" ? node.additionalInputs ?? [] : []].filter((port) => !("handle" in port) || !llmReservedInputs.includes(port.handle)))
 		};
 		else if (task.executor.kind == "workflow") config = { flowId: task.executor.flowId };
-		else if (task.executor.kind == "http-request") {
+		else if (task.executor.kind == "http-request" || task.executor.kind == "dedupe") {
 			const { kind: _kind, ...settings } = task.executor;
 			config = settings;
 		} else if (task.executor.kind == "openapi") config = { ...openApiConfigView(task.executor) };
@@ -16801,6 +16990,14 @@ async function compileAuthoring(base, request, host) {
 					};
 				} else task = await connectorTask(config, String(update.name));
 			} else if (type == "decision") task = decisionTask(config.questions, String(update.name));
+			else if (type == "dedupe") task = {
+				...before,
+				name: String(update.name),
+				executor: {
+					kind: "dedupe",
+					...dedupeConfigSchema.parse(config)
+				}
+			};
 			else if (type == "http-request") {
 				task = httpRequestTask(httpRequestConfigSchema.parse(config), String(update.name), before);
 				next = {
@@ -17148,6 +17345,9 @@ async function compileAuthoring(base, request, host) {
 						case "connector":
 							changes = createManagedTask(identity, await connectorTask(config, name));
 							break;
+						case "dedupe":
+							changes = createManagedTask(identity, dedupeTask(dedupeConfigSchema.parse(config), name));
+							break;
 						case "http-request":
 							changes = createManagedTask(identity, httpRequestTask(httpRequestConfigSchema.parse(config), name));
 							break;
@@ -17369,6 +17569,7 @@ var descriptions = {
 	"poll": "Gmail polling by key; replace CONNECTION_ID with an active Gmail connection.",
 	"integration": "Telegram webhook integration by key; replace CONNECTION_ID with an active Telegram connection.",
 	"decision": "AI Decision evaluates named questions against target and returns a complete answer object per output. Configure target before running.",
+	"dedupe": "Filter items using persistent history. Records immediately, including when downstream work fails. Empty field uses each scalar item as identity.",
 	"http-request": "A single HTTP request. Bind url and request inputs; outputs are body, statusCode and headers.",
 	"openapi": "A fixed JSON API operation. Replace the example document and URL before running.",
 	"connector": "A Connector Task and its node. Replace ACTION_ID, CONNECTION_ID and port definitions using connector_get / connector show. Set connectionId to an empty string to defer account configuration; execution will require an account.",
@@ -17413,6 +17614,21 @@ function authoringExample(name) {
 				instructions: "Does the customer need support?"
 			}]);
 			break;
+		case "dedupe":
+			operations = [...createManagedTask({ nodeId: "dedupe" }, dedupeTask()), {
+				kind: "graph.node.input.set",
+				nodeId: "dedupe",
+				handle: "items",
+				value: {
+					kind: "value",
+					value: [
+						"a",
+						"b",
+						"a"
+					]
+				}
+			}];
+			break;
 		case "http-request":
 			operations = [...createManagedTask({ nodeId: "http" }, httpRequestTask()), {
 				kind: "graph.node.input.set",
@@ -17656,6 +17872,8 @@ var json = json$5();
 var id = string().min(1);
 var version = literal(1);
 var flowName = id.refine((value) => value == value.trim() && resourceNameIssue(value) == null, "Flow name is invalid.");
+var tagIds = array(id).transform((ids) => [...new Set(ids)].toSorted());
+var tagName = id.transform((name) => name.trim()).refine((name) => resourceNameIssue(name) == null, "Tag name is invalid.");
 var inputs = record$3(string(), record$3(string(), json));
 var trigger = strictObject({
 	nodeId: id,
@@ -17682,13 +17900,32 @@ var schemas = {
 		file: json,
 		name: flowName.optional(),
 		teamId: id.optional(),
+		tagIds: tagIds.optional(),
 		version
 	}),
 	createFlow: strictObject({
 		name: flowName,
 		teamId: id.optional(),
+		tagIds: tagIds.optional(),
+		version
+	}),
+	saveTag: strictObject({
+		name: tagName,
+		version
+	}),
+	setFlowTags: strictObject({
+		tagIds,
 		version
 	}),
+	updateFlow: union([strictObject({
+		name: flowName,
+		tagIds: tagIds.optional(),
+		version
+	}), strictObject({
+		name: flowName.optional(),
+		tagIds,
+		version
+	})]),
 	renameFlow: strictObject({
 		name: flowName,
 		version
@@ -17793,6 +18030,9 @@ var controlRequests = {
 	eventSourceRevision: decoder(schemas.eventSourceRevision),
 	importFlow: decoder(schemas.importFlow),
 	createFlow: decoder(schemas.createFlow),
+	saveTag: decoder(schemas.saveTag),
+	setFlowTags: decoder(schemas.setFlowTags),
+	updateFlow: decoder(schemas.updateFlow),
 	renameFlow: decoder(schemas.renameFlow),
 	changeDraft(value) {
 		const body = schemas.changeDraft.parse(value);

package/dist/common/cron-trigger.d.ts

@@ -1,4 +1,5 @@
-import type { JsonValue, TriggerSchedule } from './flow-change.js';
+import type { JsonValue } from './flow-model.js';
+import type { TriggerSchedule } from './trigger-model.js';
 export declare function validateTriggerSchedule(rules: readonly TriggerSchedule[]): void;
 export declare function validateCronExpression(expression: string, timezone: string): void;
 export declare function nextTriggerScheduledAt(rules: readonly TriggerSchedule[], afterMs: number): number;

package/dist/common/decision.d.ts

@@ -1,4 +1,4 @@
-import type { JsonValue, ManagedTaskDefinition } from './flow-change.js';
+import type { JsonValue, ManagedTaskDefinitionOf, TaskExecutor } from './flow-model.js';
 export type DecisionQuestion = {
     readonly name: string;
     readonly instructions: string;
@@ -36,12 +36,12 @@ export declare const decisionLimits: {
 export declare function limitDecisionQuestion(question: DecisionQuestion): DecisionQuestion;
 export declare function limitDecisionQuestions(questions: readonly DecisionQuestion[]): readonly DecisionQuestion[];
 /** Loading an oversized task also updates its previously generated output schemas. */
-export declare function limitDecisionTask(task: ManagedTaskDefinition): ManagedTaskDefinition;
+export declare function limitDecisionTask<Task extends ManagedTaskDefinitionOf<TaskExecutor>>(task: Task): Task;
 export declare const decisionStateSchema: JsonValue;
 export declare const defaultDecisionQuestion: (name?: string) => DecisionQuestion;
 export declare function decisionQuestionIssues(questions: readonly DecisionQuestion[]): readonly DecisionIssue[];
 export declare function decisionAnswerSchema(question: DecisionQuestion): JsonValue;
-export declare function decisionTask(questions?: readonly DecisionQuestion[], name?: string): ManagedTaskDefinition;
-export declare function decisionTaskIssues(task: ManagedTaskDefinition): readonly DecisionIssue[];
+export declare function decisionTask(questions?: readonly DecisionQuestion[], name?: string): ManagedTaskDefinitionOf<DecisionExecutor>;
+export declare function decisionTaskIssues(task: ManagedTaskDefinitionOf<TaskExecutor>): readonly DecisionIssue[];
 export declare function decisionRequest(questions: readonly DecisionQuestion[], state: JsonValue): JsonValue;
 export declare function decisionAnswers(questions: readonly DecisionQuestion[], response: unknown): Readonly<Record<string, JsonValue>>;

package/dist/common/decision.js

@@ -3686,6 +3686,9 @@ function schemaValidationErrors(value, schema) {
 }
 //#endregion
 //#region src/decision/common/decision.ts
+function isDecisionExecutor(executor) {
+	return executor.kind === "decision";
+}
 var decisionModel = "typesafe/jev";
 var decisionLimits = {
 	choice: 255,
@@ -3709,7 +3712,7 @@ function limitDecisionQuestions(questions) {
 }
 /** Loading an oversized task also updates its previously generated output schemas. */
 function limitDecisionTask(task) {
-	if (task.executor.kind !== "decision") return task;
+	if (!isDecisionExecutor(task.executor)) return task;
 	const original = task.executor.questions;
 	const questions = limitDecisionQuestions(original);
 	if (questions === original) return task;
@@ -3834,7 +3837,7 @@ function decisionTask(questions = [defaultDecisionQuestion()], name = "AI Decisi
 }
 function decisionTaskIssues(task) {
 	task = limitDecisionTask(task);
-	if (task.executor.kind !== "decision") return [];
+	if (!isDecisionExecutor(task.executor)) return [];
 	const expected = decisionTask(task.executor.questions, task.name);
 	return [...decisionQuestionIssues(task.executor.questions), ...!dequal(task.inputs, expected.inputs) || !dequal(task.outputs, expected.outputs) ? [{
 		field: "ports",