@revenexx/studio-integrations 1.1.1 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,643 @@
 # @revenexx/studio-integrations
 
+## 1.3.0
+
+### Minor Changes
+
+- 593c0d5: A step can be changed onto another version of its node
+
+  The editor could say precisely that a step sat on a node version the platform
+  cannot run, and name the version that would work — and there it stopped. Getting
+  there meant deleting the step and inserting a fresh one, which throws away its
+  settings, its name, its note and its connections.
+
+  The version is now a control wherever there is somewhere to go, and two states
+  reach it. Where the pinned version cannot run, the red notice keeps every word it
+  had and gains the button it was missing. Where the step runs fine and a newer
+  version exists, one grey line in its dialog says so — **and nothing else does**.
+  No mark on the canvas card: nothing is wrong there, and a fourth mark for a
+  non-problem is what teaches an operator to stop reading marks. A node with a
+  single usable version says nothing at all.
+
+  Older versions are offered too, not only newer ones. A version that turns out to
+  behave badly otherwise has no way back.
+
+  **What the change costs is said before it happens.** The two versions are read
+  against the settings the step actually holds, and split three ways: what travels,
+  what the chosen version does not have and will be taken out, and what arrives
+  needing an eye — a setting it requires and the step has no answer for, or one
+  whose type or choices moved. A setting nobody filled in appears nowhere; there is
+  nothing to lose. A change that costs nothing says so in a sentence rather than
+  showing three empty lists, and where the version being left is no longer in the
+  catalogue the answer says the two could not be compared at all.
+
+  Values the chosen version does not declare are removed rather than left behind.
+  The service keeps such a key on save without complaint, so it would otherwise sit
+  in the workflow as invisible dead data.
+
+  Nothing about the step's identity moves: same id, same connections, same name,
+  same note, same place on the canvas. It lands as an unsaved change like editing
+  any setting, so discarding the editor's changes undoes it.
+
+  Promised as `specs/node-configuration.md` AC-24 to AC-26. `specs/node-palette.md`
+  AC-7 gains the clause that the version it names is somewhere the step can
+  actually go, and loses the gap entry that described the dead end.
+
+- bb8a80a: Declare what a workflow may remember between runs (PO-374).
+
+  A new **State** entry in the editor's floating control pane (Shift+T) opens a
+  dialog for the blob's `state` block: each namespace with its role — mapping,
+  cursor, dedupe or digest — and whether it belongs to this workflow alone or to
+  every workflow in the tenant. The engine mints a run's grant from exactly this
+  list, so until now a workflow could not reach the state store from the studio at
+  all.
+
+  The role is chosen when the namespace is added and stated as text afterwards:
+  entries written with one meaning cannot be read back with another. What sharing
+  costs — tenant-wide reads _and_ writes, and a namespace that outlives this
+  workflow — is on screen next to the control that chooses it.
+
+  Also fixes a silent loss in both directions of the workflow mapper, which
+  enumerates blob keys one by one: `state` was neither read from the API nor sent
+  back on save, so a declaration made anywhere else would have disappeared on the
+  next save from the studio.
+
+  A node setting of the new type `state-ref` picks one of the workflow's declared
+  namespaces **of that setting's kind**, and declares a new one from inside the
+  picker — the same shape a `credentials-ref` has, so the author never leaves the
+  node to type a name that nothing would have compared.
+
+  A namespace declared inside the picker waits in the node's draft until the
+  inspector keeps it — Save, or prev/next — so Esc discards the declaration
+  together with the setting that named it, and the workflow does not report
+  unsaved changes for something nobody chose to keep.
+
+  A node's test run now names the workflow being edited, which lets it read that
+  workflow's namespaces. Writes stay refused at author time.
+
+  Promised behaviour: `specs/state-namespaces.md`.
+
+- ddff18a: A setting that cannot apply is no longer put in front of the author
+
+  A node can now say in its manifest when one of its settings applies — another
+  setting's key, an operator, and the value to compare against — and the
+  configuration form draws it only while that holds. Until now the only thing
+  warning an author off a meaningless field was a sentence in small print under
+  it, which they read last, having already filled it in. Date Time's **Source**
+  is the plainest case: under "Now" it still asked which field to read the date
+  out of.
+
+  What changed on screen:
+
+  - A setting whose condition does not hold is not drawn, and is not counted
+    among the optional ones either — a fold that offers four settings and shows
+    three teaches the reader to distrust the number.
+  - What was typed into a setting that stops applying is dropped, the same
+    cascade the studio already runs for a setting whose options another one
+    resolves. A value nowhere on screen is a value nobody can correct.
+  - Settings a node resolves while the author edits are treated the same way.
+
+  The words a condition is written in are the fourteen the condition and filter
+  nodes already offer — `equals`, `isEmpty`, `contains`, `>` and the rest — so an
+  author who has met them in one place does not learn a second set for the other.
+  `specs/node-configuration.md` AC-27 and AC-28 carry the promise.
+
+  Nothing changes for a node that says nothing: every setting is drawn exactly as
+  before. A condition written on a setting _inside a group_ is not honoured here —
+  a group is drawn as one value editor rather than as its own settings — and that
+  is written into the spec's Gaps rather than left to be discovered.
+
+### Patch Changes
+
+- 4dd5b12: The answer that keeps unsaved work is legible, and is the one the question emphasises
+
+  Leaving a workflow with unsaved changes asks whether to discard them, and the
+  question offers two answers. Only one of them looked like an answer: "Keep editing"
+  was drawn in a colour its own background shares, so it read as an empty button beside
+  "Discard and leave" and its label appeared only once the pointer rested on it. Which
+  is the wrong half of the dialog to hide — that button is the one the keyboard lands
+  on, so the answer the question exists to make easy was the answer nobody could see.
+
+  It is now drawn as the filled answer, the way every other dialog in the module draws
+  the answer on the right, so the question also says which answer it falls back to. The
+  cause was two button variants on one element: the dialog's cancel element applies the
+  outline variant itself, and the button inside it was left on the default one, so the
+  merge took the background from the first and the text colour from the second. Nothing
+  else about the question moves — the wording, the keyboard default and what each answer
+  does are unchanged.
+
+  Promised as `specs/workflow-save.md` AC-13 and AC-14: the label is checked as a
+  contrast ratio against the button it sits on, unhovered, and the emphasis as a
+  difference between the two answers' surfaces rather than against a class name or a
+  colour value.
+
+- ab2eb96: A build state stops saying "still building" wherever it is shown
+
+  Saving a workflow queues the platform to build an executable bundle from it, and
+  until that build lands the workflow cannot run. Two surfaces say so: the chip beside
+  Save in the editor, and the build column in the workflows list. Only the editor's
+  ever became true on its own — the list said whatever its last read said, so a
+  workflow that finished building while the list stood open kept reading "Building…"
+  until something reloaded the page. Save in the editor, come back to the list, and the
+  row never moved.
+
+  The list now watches a build out the way the editor does: one read of the tenant per
+  turn, so thirty workflows building at once cost what one costs, and it stops as soon
+  as nothing is waiting. A platform build report still makes it quicker where there is
+  one; nothing depends on one arriving any more, on either surface.
+
+  The two waits now share one interval and one ceiling instead of the editor owning
+  both, so neither surface can drift into asking twice as often as the other.
+
+  Promised as `specs/workflow-build.md`, a new spec for the subject: what becomes of a
+  saved workflow before it can run. AC-1 is the editor's promise, moved out of
+  `specs/workflow-save.md`, where a reader asking what a build state means would not
+  have looked; AC-2 is the list's. `specs/realtime-updates.md` AC-7 keeps the
+  announcement half and now says which of the two makes a build state true.
+
+## 1.2.0
+
+### Minor Changes
+
+- 3f56bfa: A studio surface that is waiting now says so in words, not only as a shimmer.
+
+  Seven surfaces drew placeholder blocks while they loaded and said nothing at all —
+  which is exactly what they say when there is genuinely nothing to show. Those two
+  states ask for opposite reactions: hold on, or go and do something about it. The
+  shimmer that separates them for a sighted reader is not information a screen reader
+  can reach, so for one reader every one of these surfaces was silent in the same way,
+  whether it was loading or empty.
+
+  The template gallery had been given words of its own; the other six now have them
+  too: the dashboard's four panels, the missed-runs list on the Runs page and inside a
+  workflow, the version history, the New-workflow dialog's template picker, and the
+  dialog that imports a platform SFTP account. Each says what _it_ is waiting for,
+  under its own name, and each stops saying it when the answer arrives. Nothing changes
+  on screen for anybody who could already see the shimmer.
+
+  The dashboard's key figures had the sharper half of the problem, and it was worse
+  than silence: while the tenant's workflows were still on their way, each tile
+  announced itself as "Active workflows: 0" — a figure counted from an empty list,
+  which does not read as waiting but as an answer. A tile is now named by what it
+  counts until it has counted it.
+
+  Behind it, one small component owns the announcement — the region that is always in
+  the DOM with only its text changing, the naming that keeps several on one page apart,
+  and the placeholders' removal from the accessibility tree — so the seventh surface to
+  need it cannot get a different version of it than the first.
+
+  The eight lists that draw the shared table are not in this: their placeholder rows
+  come from `@revenexx/studio-shared` and are carried separately.
+
+- 69c9e95: The tenant-wide Runs page now pages and narrows on the platform instead of in the
+  browser, so a tenant's whole run history is reachable rather than only its newest
+  hundred runs.
+
+  What changes for anyone using the page. Older runs are reached a page at a time,
+  and the count under the table is the number of runs that match rather than the
+  number of rows loaded — it used to say "of 100" on a tenant with thousands.
+  Narrowing by outcome or trigger kind, and searching by workflow name, are applied
+  to the history: "what failed last night" no longer searches a window that on a busy
+  tenant can be under an hour, and a narrowing applied from a later page starts again
+  at the first one. The Missed runs tab pages the same way, where it previously read
+  one page and offered no way past it.
+
+  Two things are deliberately withheld rather than left to mislead. The columns no
+  longer offer a sort, because `GET /runs` orders newest first and takes no ordering
+  parameter — a sort here would have reordered one page. And the filter menu shows no
+  count per option, because a count of the rows in hand would describe the page
+  rather than the history the option narrows.
+
+  The filter control itself is unchanged in shape: the same menu, the same words, one
+  value per dimension.
+
+  Fixed on the way: the outcome filter sent a status the platform does not have.
+  The studio's "failed" stands for several of the platform's statuses, and the
+  expansion carried `timed_out`, which its `RunStatus` does not list — so choosing
+  "failed" answered `422 The selected status.2 is invalid` instead of narrowing.
+  The vocabulary now mirrors the enum, the end-to-end mocks refuse what the service
+  refuses, and the suite walks every option of every filter rather than a sample.
+
+  From review: a search taken back inside the debounce window no longer commits
+  itself, a read the platform refuses is now said instead of leaving the previous
+  answer standing under the new question, a narrowing that matches nothing says so
+  rather than claiming the tenant has never run a workflow, the search box is no
+  longer left narrowing the list invisibly after a visit elsewhere, the sidebar's
+  Runs badge keeps converging while a filter is applied, and the Missed runs tab
+  opens on the newest firings when the dashboard links to it.
+
+- 1b2a938: The Runs list can be read in an order other than newest first. Ordering by how
+  long a run took answers "which of these is slow?", which the page could not
+  answer at all: the headers that used to offer it sorted the hundred runs the
+  browser was holding, and were withdrawn when the list moved onto the platform.
+
+  Two of the six columns offer a sort — when the run started, and how long it took
+  — and each orders the whole history rather than the page on screen.
+  A run the column cannot describe, one that never started or one still running,
+  is listed last whichever way the list is read; asking for another order returns
+  to the first page, because re-ordering re-numbers them.
+
+  The other four headers stay fixed. Three are the platform's shape: ordering by
+  the workflow's name would need a join on the path the list pages on, the trigger
+  kind has four values so it groups rather than orders, and the run id orders by
+  nothing a reader would mean.
+
+  The outcome column is ours. The platform can order by it, and this page does not
+  offer it: it would order by the word the platform stores while the column shows
+  the studio's own translated word, so the header would sit over an order the
+  reader cannot see — and in German not even an alphabetical one.
+
+  Needs an integrations service that serves `?sort=` on `GET /v1/runs` (PO-371).
+  Against an older one the headers are offered and the platform refuses them.
+
+- 19829bf: A workflow can be deleted from the page it is open on. Until now the only way to
+  get rid of a workflow was to leave the editor, find it again in the list of all
+  of them and use its row menu — the editor offered duplicating, pausing and
+  saving, and no way to discard the thing it had open.
+
+  The header carries an actions menu, and Duplicate has moved into it beside
+  Delete. The buttons that remain — Cancel, Save — act on the unsaved work in front
+  of the operator; the two in the menu make and unmake the workflow that work
+  belongs to. Delete is not a button for a reason: it is the one control there that
+  cannot be undone, and it has no business a mis-click away from Save. The question
+  it asks is the list's own, unchanged: it names the workflow and says that the
+  revision history goes permanently with it.
+
+  Unsaved work on the canvas raises no second question. The draft belonged to a
+  workflow that has stopped existing, so the studio takes it along and moves to the
+  workflows list rather than offering to keep work that has nowhere left to go.
+
+  Both surfaces now say so when the platform refuses a deletion: the question stays
+  open carrying the reason, and the workflow stays where it is. The list used to
+  fail silently here — the dialog simply stopped, over a row that was still there.
+
+- b85a8e0: A run started from the workflow editor now ends on what it returned, whichever mode
+  the workflow runs in.
+
+  Pressing Run on a workflow that does not wait for its result used to answer "Run #99
+  started" and stop there — the number was the whole answer, and reading what the run
+  actually did meant leaving for the run's own record and watching it fill in. The
+  studio now stays with that run: the dialog says where it has got to while it is
+  going, and shows what it returned when it ends. The mode a workflow runs in decides
+  who waits, not whether the author gets an answer.
+
+  What the result looks like has changed with it. It used to be the run object printed
+  whole — two Temporal identifiers, two re-run references and four timestamps around
+  the value somebody pressed Run to see, keyed by the node's internal id. Each value
+  now stands under the name its node carries on the canvas, with the run's number,
+  status and duration on one line above them; the record itself is still one click
+  away, where the rest of it belongs. A returned value that is not a map of this
+  workflow's nodes is shown whole rather than filed under a name it may not belong to.
+
+  The way into the run's record is offered from the moment the run starts, so waiting
+  here is never the only option. The studio stops following once the run is terminal,
+  once the author closes the result, and after a few reads that cannot be answered —
+  the confirmation and the way in stand either way.
+
+  Behind it: one duration formatter for the runs table, the run record and this
+  dialog, which had three identical private copies, and one place that decides what a
+  node is called, so the result cannot name a node differently from the canvas.
+
+- 1704552: A node setting declared as taking several lines is now drawn with room for them.
+
+  A node type can say that one of its settings runs to more than one line — a mail
+  body, a failure message, a list of instructions one per line — and every layer but
+  this one carried the declaration: the node contract has held it since it was
+  written, and twelve fields across three published packages set it. The editor's own
+  field type did not list it, so it was dropped on arrival and every such setting was
+  drawn as the same one-line box. The help text under one of them told the author to
+  write one instruction per line at a control that refused the second one.
+
+  Both controls a typed setting can land in now honour it. The plain box becomes a
+  text area, and the box that maps values in from earlier steps takes Enter as a new
+  line — with expressions going on working line by line, which matters because that is
+  where most of the twelve fields land: a notification mail assembled from an upstream
+  value is the ordinary case. Such a setting opens at four lines and grows with what is
+  typed until ten, after which it scrolls.
+
+  Nothing has to be edited in a node package for this: the twelve existing
+  declarations start working as they were written. A setting that says nothing about
+  lines is drawn exactly as before, and a kind of setting with no multi-line meaning —
+  a dropdown — ignores the declaration rather than being made to honour it.
+
+### Patch Changes
+
+- c94c96e: One place now spells the identifier of a connection point on the canvas, in both
+  directions.
+
+  Nothing changes on screen or in a saved workflow: the ids are byte-identical to the
+  ones the canvas drew before, and they were never persisted in a workflow anyway — only
+  port names are. What changes is that the twelve places which assembled an id by hand,
+  across the node card, the trigger, the group frame, the editor and the two panels that
+  rebuild a canvas from a run, now ask one module for it, and the four dot positions are
+  declared once instead of six times — including inside the reader, whose own parse is
+  built from that one list rather than repeating it.
+
+  Why it was worth doing while nothing was wrong: the module that reads an id was alone
+  there, so a fifth dot position would have had the writers produce a name the reader had
+  never heard of, handed back as though it were a port. That is not an empty value, so
+  the fallback every call site carries could not have caught it, and the editor would
+  have saved an output no node has. The round-trip test now exercises the writers and the
+  exported side list rather than a string built in the test, so the two halves are proved
+  together.
+
+- 31e9a46: The controls the canvas offers on hover are big enough to hit.
+
+  Deleting a node was the smallest and hardest of them to press, which is the wrong way
+  round for the most irreversible thing the editor offers: the button measured 23 by 24
+  pixels, a pixel under the minimum a pointer target is allowed to have, and it missed by
+  construction rather than by accident — the height was fixed at 24 while the width was
+  left to grow from the padding around an 11-pixel glyph. Duplicate beside it, and the
+  trigger's delete, were the same.
+
+  The canvas also disagreed with itself about the size of a toolbar control, in four
+  sizes: those two rows, the pair offered on a connection at 20, a sticky note's colour
+  swatches at 20, and a group frame's swatches at 16 — the last of them 16 rather than the
+  18 their styling claimed, because an inline size was quietly overriding it. Everything a
+  hover reveals on a node, a trigger, a sticky note or a group frame is now 24 by 24 with
+  a 13-pixel glyph, so a reader learns one target and keeps it.
+
+  The toolbar on a connection is raised with the rest and is the one that is still not
+  promised: it is drawn in the canvas's own coordinates rather than over the top, so its
+  24 pixels shrink as the operator zooms out. Better than the 20 it was, and a size is not
+  the fix — that is carried separately.
+
+- 1c461da: A workflow's own Runs tab no longer draws sort headers that do nothing, and the
+  tenant-wide Runs page opens on its first page.
+
+  On a workflow's Runs tab the column headers looked sortable and were not. Started
+  and Duration drew a hover state and a sort icon, took the click and did nothing
+  with it — the arrow did not move either, and the tab opened with no column marked
+  at all. The headers came back with the tenant-wide list's ordering, which the
+  platform performs; this tab renders the same table and the platform cannot order
+  its feed.
+
+  They are no longer offered. The alternative was to make them sort what the browser
+  holds, and that is a page: this tab pages on the server, so "order by duration"
+  would have put the slowest of the twenty-five rows on screen at the top and said
+  nothing about the rest of the history — which is the sentence the tenant-wide list
+  withdrew its own headers for until the platform could order the whole thing. The
+  runs stand newest first, as they always did, and what would bring an order back is
+  recorded in the spec rather than mimed by a control.
+
+  Two things on the tenant-wide Runs page ride along. Arriving at it now opens on the
+  first page: the search box comes back empty whatever was searched for, so a page
+  number kept from last time was a position inside a narrowing nothing on screen
+  still showed — the outcome and trigger kind are drawn back onto the menu and still
+  survive. And arriving with a search still in force now costs one read of the list
+  rather than the two it used to.
+
+- fae7446: A duration now reads the same wherever the studio prints one.
+
+  The same step used to say `1.50s` on a run's Details tab and `1.5 s` on its Replay
+  tab one click away, and a step that took a minute said `1.1m` in the first place and
+  `1m 3s` in the second — which reads as two different figures rather than two
+  spellings of one. The dashboard spelled it a third way again — two decimals whatever
+  the value, so a run of 900 ms read `0.90s` there and `900ms` in the list it links to.
+  Five surfaces printed a duration, across three copies of the arithmetic.
+
+  They now share one, and its form is `900ms`, `1.5s`, `1m 3s`: the unit against the
+  number, as in the `10d ago` beside it, a tenth of a second where one was measured, and
+  minutes with their seconds above one — where `1.1m` for a 63-second step was the least
+  readable of the three candidates and the second decimal of `1.50s` was precision nobody
+  acts on.
+
+  **A run's duration loses its decimal place entirely, because there was never anything in
+  it.** The studio derives it from the two timestamps the platform records to the second,
+  so `4.00s` was three characters claiming a precision the platform does not store: that
+  run reads `4s` now, and one that took a minute reads `1m`. A step keeps its tenth —
+  there the milliseconds are measured, so `3.4s` says something `3s` would not. The replay
+  panel loses the space before its unit, and the dashboard stops printing seconds for a
+  figure that is not in seconds.
+
+  Two figures that could not come out right before are gone with it: a duration just
+  under a minute printed as `60.0s` — a minute said the other way — and the replay
+  panel's own arithmetic could produce `1m 60s`.
+
+  A duration still takes no language, so German is served `1.5s` rather than `1,5 s`.
+  That gap is now written down in one place rather than in four.
+
+- d63594c: A refused save now states the reason and not the service's count of everything else it
+  found — everywhere, rather than on the two credential surfaces it was reported from.
+
+  The service refuses a save with one message and a tally: "The name has already been
+  taken. (and 2 more errors)". That count is honest arithmetic and misleading copy — it
+  counts by validation rule, so one missing field the service checks twice is two of them,
+  and it counts things no form draws. PO-275 removed it where it was reported. Creating a
+  workflow, creating a credential from the node editor's own lightbox and provisioning a
+  revenexx source kept showing it, because each had written the error handling out by hand
+  and only the credentials page knew the count was there.
+
+  The secret form gains a fallback it never had: a refusal whose message was empty drew an
+  empty sentence there, because nothing stood behind the message at all.
+
+  Underneath that: one function now answers what an error should say. It had three
+  implementations — the one that knew about the count, a byte-identical private
+  `captureError` in six composables, and the cast spelled inline at thirty-seven call
+  sites. `refusalReason` is `errorReason`, because a function named for refusals was
+  answering "could not load the audit log" in half its callers, and the name is why nobody
+  reached for it there. The count of call sites is the reason the sweep had to be done
+  twice: the same contract was spelled `(e as { message?: string })?.message`,
+  `(e as Error).message`, `(e as Error)?.message` and as an `instanceof` guard with the
+  message in each branch, and a search for one of those finds one of those.
+
+  One behaviour changes on the read paths, and it is small: an error whose message is
+  nothing but whitespace used to be drawn as an empty sentence and now falls back to the
+  surface's own wording.
+
+- b0fcc32: Connecting a credential by OAuth now runs through one handshake instead of three copies
+  of it.
+
+  The **Connect** button exists in three places — a row in the credentials list, the
+  credential detail dialog, and the create dialog straight after a credential is made —
+  and each carried its own copy of the whole dance:
+  open the provider's window, listen for the message the return page posts back, and poll
+  once a second in case the operator closes the window instead. The two copies agreed, so
+  nothing was wrong on screen; what it cost is that the prerequisite for the message path
+  ever firing was documented in only one of them, and a fix to one button did not reach
+  the other.
+
+  Three things that were wrong in both copies are fixed by having one:
+
+  - **The poll kept running after the message arrived.** The listener removed itself and
+    reloaded, but the one-second timer stayed up until the window closed, and then
+    reloaded a second time. Harmless while the reload is idempotent, which is the sort of
+    thing that stops being true quietly.
+  - **No copy stopped when its caller went away.** Closing the detail dialog, or leaving
+    the page, while the provider's window was still open left a timer and a listener
+    running — and the detail dialog is held open by a prop rather than by `v-if`, so
+    closing it unmounts nothing. An attempt begun there could announce a connection, and
+    refresh the row, for whichever credential the operator opened next.
+  - **A second attempt while one was outstanding left the first still watching**, so a
+    window the operator had stopped looking at could still trigger a reload.
+  - **The completion message was accepted from any sender.** The landing page posts it to
+    our own origin, but nothing checked where it came from — and the window we open holds
+    a live `window.opener` on us, so a provider page could have announced a connection
+    that never happened. The origin is checked now.
+  - **A window the browser refuses to open left the poll running for ever.** `window.open`
+    returns `null`, `null?.closed` is `undefined`, and neither path could ever settle.
+    Nothing is installed in that case now. The operator is still told nothing, which is
+    what all three copies did — that is PO-399.
+
+  What an operator sees is unchanged: the connection is announced when the provider
+  answers, and closing the window refreshes quietly without claiming anything — because
+  a closed window says nothing about whether the authorisation went through.
+
+- f6cb6e2: The deep copy every editing surface takes now comes from one module, and that module
+  says what the copy keeps.
+
+  Nothing changes on screen. Opening a workflow, editing a node, opening the variables
+  dialog, duplicating a workflow and building a manual run's payload all begin by copying
+  what they are about to let somebody edit, so an unsaved change can be dropped rather
+  than undone. That copy was written out eight times — as the same private one-line
+  `clone<T>` in the canvas and in the node inspector, and as a bare
+  `JSON.parse(JSON.stringify(…))` in six more places. All eight produced the same value,
+  and they still do: this is the same round trip, moved.
+
+  What was missing is the sentence underneath them. The round trip is safe **because a
+  workflow blob is JSON** — that is the entire guarantee, and it was written down nowhere,
+  so nothing said which inputs it holds for. A caller reaching for the same expression
+  with editor state that has not been through the API — a resolved sample, a cached
+  schema, anything holding a `Date`, a `Map` or an `undefined` — would lose those values
+  silently, in whichever of the eight places they copied from. The guarantee, and the
+  five things the round trip does not survive, are now in one doc comment with a unit
+  test that pins each of them.
+
+  `structuredClone` is deliberately not used, and the reason is in the module: it
+  preserves all five, which sounds strictly better and is a behaviour change — a field
+  dropped today because JSON cannot carry it would start surviving, and something
+  downstream may be relying on that loss. Swapping the mechanism is now one edit, and it
+  wants its own proof.
+
+- 2271245: What the canvas does with a connection dot's side is now three exhaustive maps instead
+  of ternary chains scattered across five components.
+
+  A dot sits on one of four sides, and three separate answers follow from that: where Vue
+  Flow draws it, which side an edge arriving from it should land on, and where along the
+  side it is spread when a node has several outputs. Each was a chain of `if`s ending in
+  an `else`, inside a component: the position one in both the node card and the trigger
+  card, and the opposite-side one in the editor and in both read-only canvases.
+
+  Nothing changes on screen — the four sides get the same answers. What changes is what
+  happens to a fifth. An `else` gives a name it has never heard the last branch's answer:
+  a `centre` dot would have been drawn on the **left**, told that `right` faces it, and
+  spread along the horizontal axis — three plausible answers, no type error, and nothing
+  to notice. The maps are `Record<Side, …>`, so adding a name to `SIDES` stops all three
+  compiling until they say what it means.
+
+  This is the follow-up PO-258 wrote down for itself. Its note said three functions were
+  duplicated, and named them; two were, and one of those was hiding under a second name
+  (`opposite`, not `oppositeSide`) in the two read-only canvases. The note now says so.
+
+- 759d21f: A copy control now says what actually happened, and all seven of them say it the same way.
+
+  The audit log's copy control announced "Copied" the instant it was pressed rather than
+  after the copy succeeded. `writeText` returns a promise, and a browser can refuse it —
+  a page that is not focused, a context that is not secure, a permission the operator
+  declined. The message had already gone up by then, and nothing contradicted it: the
+  operator believed they had the entry on their clipboard and pasted whatever was there
+  before. It could also do nothing at all — the control guarded on `navigator.clipboard`
+  existing and skipped the whole block when it did not, so on a browser without the API
+  the button neither copied nor complained.
+
+  Both are gone. A refused copy now says so, in English and German.
+
+  One more had the same defect and was found in review: the expression chip in the node
+  inspector, which copies an expression when no field is focused. It discarded the promise,
+  short-circuited to nothing when the clipboard API was absent, and said "Expression
+  copied" either way. It now reports a failure and keeps the useful half of the hint —
+  that clicking into a field inserts the expression directly, which still works when the
+  clipboard does not.
+
+  The other five — node config, rotated secret, webhook URL, a variable's expression,
+  nodes copied on the canvas — already behaved correctly, each with its own copy of the
+  await-and-catch. All seven now go through one helper, so the next one cannot be written
+  the wrong way by having nothing to copy from. Each keeps its own two
+  messages: copying a node's config, a webhook URL and an audit entry are three different
+  things to have failed, and one message covering all of them would name none of them.
+
+- 70bbddc: A saved workflow stops claiming its build is queued once it is not.
+
+  Pressing Save queues a bundle build, and the editor put "Build queued…" on the toolbar
+  and left it there — the build finishes on the platform within a second or two, and the
+  chip stayed up for as long as the page was open. Reloading showed everything saved. A
+  chip that never clears is read as a save that did not happen, and it was reported as
+  exactly that.
+
+  What resolved it before was a platform announcement over the event bus, and nothing
+  else — so a host that does not have that channel, one where it is down, and a
+  connection that dropped in the second after the save all produced the same permanently
+  wrong screen. The announcement is still the fast path; under it, every way into a queued
+  build now watches it out, on the same interval and the same ceiling the Run button
+  already used when it had to wait a build out: an ordinary save, the resend-as-paused
+  after the deactivation dialog, putting an earlier version back, and opening a workflow
+  whose build is already running. That last one is the reload an operator reaches for
+  when the chip looks stuck, and it used to land on a chip that was stuck for good. A
+  build that fails reaches its notice the same way.
+
+- 47fedc8: The validation banner and the card's badge now name a setting the way the node's own form names it.
+
+  A workflow that cannot be activated yet is reported in an amber banner listing the
+  settings still to fix, one line per node. Those settings were named by their internal
+  key, taken from the path the service reports the finding at — so an operator read
+  "Bestellung anlegen — credentials, companyId, customerId" and then opened the node to
+  find three fields called **Revenexx-Anmeldedaten**, **Firma** and **Kunde**. The same
+  fields, named two ways, on one screen, and in English inside an otherwise German
+  interface.
+
+  The banner asks the node's manifest now, which is where those names already live and
+  what the settings form has always rendered. Where there is no name to resolve — a
+  package that is gone, or a workflow older than the field it was saved with — the key
+  still stands: worse to read, but never the wrong field.
+
+  The badge on the card — the amber count whose hover lists the settings at fault — says
+  the same, and resolves it where it is drawn rather than upstream: the node card already
+  watches the manifest catalogue, so a name that arrives late redraws that one card instead
+  of re-syncing the whole canvas.
+
+  The marker inside the node's own settings form is deliberately unchanged. It is keyed by
+  the config key, which is how a message finds its input; a translated key would stop
+  matching the field it belongs to.
+
+- d5838d6: The result of a run started by hand can be read when it is long.
+
+  The dialog that shows what a run returned capped its width and not its height, so it
+  grew as tall as its content: a result of two node outputs came out half a screen taller
+  than the screen, ran off the top and the bottom at once, and what stuck out was clipped
+  rather than made reachable — including the buttons at its foot, so the only way out was
+  the corner cross.
+
+  The body of the dialog now scrolls, as it already does in the create-workflow,
+  node-configuration and SFTP-import dialogs, and a single node's output may take a little
+  less of the screen so that two of them plus the footer stay navigable. Nothing about
+  what is shown changes.
+
+  Measured rather than eyeballed: with two outputs of a hundred entries each, the dialog
+  came out at 1106 pixels in a 900-pixel window before, and inside the window after.
+
+- ea5b275: Picking the same node from the palette again lands it beside the last one instead of on top of it.
+
+  Clicking a row in the editor's node palette dropped the card in the centre of the view,
+  and the centre of the view does not move between two clicks. So five picks in a row
+  produced five nodes on one set of coordinates and one visible card — the workflow had
+  grown, the canvas said it had not, and the only way to find out was to drag the top card
+  away and see the next one underneath it.
+
+  A click-insert now steps off a spot the canvas already occupies, down and to the right in
+  grid steps, until it finds one that is clear. It reads the canvas each time rather than
+  counting the clicks so far, which is what makes a spot freed by dragging a card away
+  usable again — the next pick goes back to the centre of the view. The empty group frame
+  from the control pane, which is centred the same way and stacked the same way, goes
+  through the same helper.
+
+  Notes are deliberately left as they are. A note is drawn behind the cards because it
+  belongs over the nodes it explains, so a rule that keeps it clear of everything on the
+  canvas would push the first note of a workflow away from the middle of the view — two
+  notes in a row still land on one spot, and `specs/sticky-notes.md` says so.
+
+  Dragging a node out of the palette is deliberately unchanged: that gesture already shows a
+  ghost at the exact spot the card will land, so nudging the drop would make the ghost lie.
+
 ## 1.1.1
 
 ### Patch Changes

package/README.md

@@ -92,7 +92,9 @@ pnpm changeset   # record what your change does to the version
 
 Branch off `main` as `feature/<desc>`, `fix/<desc>` or `chore/<desc>` — GitHub refuses
 the first push of any other name, and `main` itself takes a reviewed pull request with
-CI green: [`docs/branch-protection.md`](docs/branch-protection.md).
+CI green: [`docs/branch-protection.md`](docs/branch-protection.md). A separate,
+non-blocking `Security Scan` reports secrets and dependency advisories:
+[`docs/security-scanning.md`](docs/security-scanning.md).
 
 Hosts to develop against:
 

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@revenexx/studio-integrations",
   "configKey": "studioIntegrations",
-  "version": "1.1.1",
+  "version": "1.3.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"