@scenario-labs/sdk 3.3.1 → 3.4.0

package/src/lib/user_selection_limits.ts

@@ -0,0 +1,14 @@
+/** Inclusive lower bound for user-selection `min` / `max` and choose counts. */
+export const USER_SELECTION_MIN_SELECT = 1;
+
+/**
+ * Caps how many candidates may be offered (and how high `input.min` may be).
+ * Matches the API `MAX_USER_SELECTION_CANDIDATES` limit.
+ */
+export const USER_SELECTION_MAX_CANDIDATES = 50;
+
+/**
+ * Caps how many items the user may pick (`input.max`).
+ * Matches the API `USER_SELECTION_DEFAULT_MAX` (also the omitted-`max` default).
+ */
+export const USER_SELECTION_DEFAULT_MAX = 100;

package/src/lib/workflow_converter.ts

@@ -1,6 +1,8 @@
 // Converts a workflow editor state (nodes + edges) to a flow array suitable for the Scenario API.
 // Ported from fawkes useConvertWorkflowToApp — pure function, no React dependencies.
 
+import { USER_SELECTION_MAX_CANDIDATES, USER_SELECTION_MIN_SELECT } from './user_selection_limits';
+
 // ---- Public types ----
 
 export type WorkflowEditorHandleInput = {
@@ -47,6 +49,7 @@ export type WorkflowEditorNode =
     }
   | { id: string; type: 'transformText'; data: NodeCommonData & { value?: string } }
   | { id: string; type: 'splitText'; data: NodeCommonData & { splitDelimiter?: string } }
+  | { id: string; type: 'joinTexts'; data: NodeCommonData & { joinDelimiter?: string } }
   | { id: string; type: 'aspectRatio'; data: NodeCommonData & { output?: string; quality?: string } }
   | { id: string; type: 'groupItems'; data: NodeCommonData & { value?: string } }
   | {
@@ -136,8 +139,6 @@ type ModelInputNodeData = NodeCommonData & {
 
 const RUNNABLE_TYPES = new Set(['model', 'llm', 'forEach', 'forEachEnd']);
 const MODEL_CUSTOM_INPUT_HANDLE_SUFFIX = '-source-custom';
-const USER_SELECTION_MIN_SELECT = 1;
-const USER_SELECTION_MAX_SELECT = 100;
 const DEFAULT_SLICE_ASSETS_CHOOSE_MESSAGE = 'Select the items to continue';
 
 type SliceAssetsMode = 'default' | 'randomize' | 'choose';
@@ -232,7 +233,12 @@ function toCelIdentifier(name: string): string {
 }
 
 function escapeCELString(value: string): string {
-  return value.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/\n/g, '\\n');
+  return value
+    .replace(/\\/g, '\\\\')
+    .replace(/'/g, "\\'")
+    .replace(/\n/g, '\\n')
+    .replace(/\r/g, '\\r')
+    .replace(/\t/g, '\\t');
 }
 
 function formatTextAsCELString(text: string): string {
@@ -391,6 +397,7 @@ function getForEachFlowListInputDescriptor(args: {
     listProvider?.type === 'text' ||
     listProvider?.type === 'llm' ||
     listProvider?.type === 'transformText' ||
+    listProvider?.type === 'joinTexts' ||
     (outputHandle?.type === 'text' && !!outputHandle.isArray);
   return isText ?
       { name: `text${inputIndex}`, type: 'string_array' }
@@ -592,21 +599,50 @@ function getIsSliceAssetsItemsSourceHandle(nodeId: string, sourceHandle: string
 }
 
 /**
- * Prompt Builder (transformText) binds upstream vars for CEL. Reuse the same
- * list-producer rules as concat/slice (`groupItems`, `sliceAssets`, `allOutputs`,
- * split-text, LLM "All Results", `isArray` handles): those nodes always emit CEL
- * lists (via concat/slice/randomSample), so Prompt Builder must bind them as
- * `string_array` for indexing. Scalar text (plain text nodes, forEach outputs)
- * stays `string`.
+ * True when `expression` treats `varName` as a CEL list via indexing, `size(x)`,
+ * or list macros (`.map` / `.filter` / …). This is a converter tolerance for
+ * flows that index a list producer (editor First/Last/Nth stores `x[0]` on
+ * `isArray` handles; agent/MCP/import flows may index without that flag). It is
+ * not Fawkes's preview rule: the webapp binds a list only when the handle has
+ * `isArray`. Intentionally narrow so Prompt Builder cannot be steered into
+ * list semantics through other CEL list idioms.
+ */
+function expressionUsesListVariable(expression: string, varName: string): boolean {
+  const escaped = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return (
+    new RegExp(`${escaped}\\s*\\[`).test(expression) ||
+    new RegExp(`\\bsize\\s*\\(\\s*${escaped}\\s*\\)`).test(expression) ||
+    new RegExp(`${escaped}\\s*\\.\\s*(map|filter|all|exists|exists_one)\\s*\\(`).test(expression)
+  );
+}
+
+/**
+ * Prompt Builder (transformText) binds upstream vars for CEL. List producers
+ * bind as `string_array` when the source handle is `isArray`, or when the
+ * expression indexes/uses the variable as a list (see
+ * `expressionUsesListVariable`). Otherwise bare refs stay `string` so the API
+ * collapses the list to its first item.
+ *
+ * Fawkes today omits `isArray` on Slice/Group Items on purpose: only `isArray`
+ * handles get an indexed insert (`x[0]`); every other list insert is bare `x`
+ * and must collapse to the first item. Adding `isArray` to those handles later
+ * requires migrating stored expressions (`x` → `x[0]`) in the same Fawkes
+ * release, or both preview and published flows break on `'…' + x`.
  */
 function getPromptBuilderInputType(
   targetNode: WorkflowEditorNode,
   outHandle: WorkflowEditorHandleOutput | undefined,
   outHandleName: string,
+  expression: string,
+  varName: string,
 ): 'string' | 'string_array' {
-  return getConcatListSourceDescriptor(targetNode, outHandle, outHandleName).inputType === 'string_array' ?
-      'string_array'
-    : 'string';
+  if (getConcatListSourceDescriptor(targetNode, outHandle, outHandleName).inputType !== 'string_array') {
+    return 'string';
+  }
+  if (outHandle?.isArray || expressionUsesListVariable(expression, varName)) {
+    return 'string_array';
+  }
+  return 'string';
 }
 
 function getConcatListSourceDescriptor(
@@ -903,17 +939,65 @@ function applyAspectRatioInputs(args: {
   }
 }
 
+/**
+ * Neighbours of every editor node, built once per conversion. Edges read
+ * `{ source: consumer, target: provider }`: an input handle on `source` reads an
+ * output handle on `target`. `consumers` keeps the internal for-each → end edge,
+ * which lets the body walk reach a nested loop from its end. `dataProviders` and
+ * `dataConsumers` drop it: it carries no data, and it closes a cycle
+ * (loop → body → end → loop) that a walk must not follow. They also drop the
+ * edge of an approval: it gates the node it is attached to and follows it into
+ * a loop body, so it is not a consumer through which a draw escapes the loop.
+ */
+type LoopGraph = {
+  nodeById: Map<string, WorkflowEditorNode>;
+  consumers: Map<string, string[]>;
+  dataProviders: Map<string, string[]>;
+  dataConsumers: Map<string, string[]>;
+};
+
+function buildLoopGraph(nodes: WorkflowEditorNode[], edges: WorkflowEditorEdge[]): LoopGraph {
+  const nodeById = new Map(nodes.map((n) => [n.id, n]));
+  const isInternalForEachEdge = (e: WorkflowEditorEdge): boolean => {
+    const target = nodeById.get(e.target);
+    return (
+      nodeById.get(e.source)?.type === 'forEach' &&
+      target?.type === 'forEachEnd' &&
+      target.data.parentNodeId === e.source
+    );
+  };
+  const push = (map: Map<string, string[]>, key: string, value: string) => {
+    const list = map.get(key);
+    if (list) list.push(value);
+    else map.set(key, [value]);
+  };
+  const graph: LoopGraph = {
+    nodeById,
+    consumers: new Map(),
+    dataProviders: new Map(),
+    dataConsumers: new Map(),
+  };
+  for (const e of edges) {
+    push(graph.consumers, e.target, e.source);
+    if (isInternalForEachEdge(e) || nodeById.get(e.source)?.type === 'approval') continue;
+    push(graph.dataProviders, e.source, e.target);
+    push(graph.dataConsumers, e.target, e.source);
+  }
+  return graph;
+}
+
 function getForEachBodyEditorNodeIds(
   forEachId: string,
   forEachEndId: string,
   edges: WorkflowEditorEdge[],
-  nodes: WorkflowEditorNode[],
+  graph: LoopGraph,
 ): Set<string> {
   const bodyNodeIds = new Set<string>();
   const queue: string[] = [];
   const escaped = forEachId.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const itemHandle = new RegExp(`^${escaped}-output-\\d+$`);
   for (const edge of edges) {
-    if (edge.target === forEachId && edge.targetHandle?.match(new RegExp(`^${escaped}-output-\\d+$`))) {
+    if (edge.target === forEachId && edge.targetHandle && itemHandle.test(edge.targetHandle)) {
       queue.push(edge.source);
     }
   }
@@ -921,14 +1005,12 @@ function getForEachBodyEditorNodeIds(
     const nodeId = queue.pop()!;
     if (nodeId === forEachEndId || bodyNodeIds.has(nodeId)) continue;
     bodyNodeIds.add(nodeId);
-    for (const edge of edges) {
-      if (edge.target === nodeId && !bodyNodeIds.has(edge.source) && edge.source !== forEachEndId) {
-        queue.push(edge.source);
-      }
+    for (const consumer of graph.consumers.get(nodeId) ?? []) {
+      if (!bodyNodeIds.has(consumer) && consumer !== forEachEndId) queue.push(consumer);
     }
   }
 
-  addRandomizeClosureToBody(bodyNodeIds, forEachEndId, edges, nodes);
+  addRandomizeClosureToBody(bodyNodeIds, forEachEndId, graph);
 
   return bodyNodeIds;
 }
@@ -944,36 +1026,36 @@ function getForEachBodyEditorNodeIds(
  * for an UNLOCKED randomize node we mutate `bodyNodeIds` in place to also include
  * that node plus the deterministic chain down to the body, so the runtime clones
  * it per iteration and each iteration re-draws. We only pull it in when *every*
- * path out of it lands in the body — if it also feeds a node outside the loop,
- * cloning it would break that external consumer, so we leave it shared.
+ * path out of it lands in the body or in this loop's results — if it also feeds a
+ * node outside the loop, cloning it would break that external consumer, so we
+ * leave it shared.
+ *
+ * Loop nodes (any for-each or loop end outside the body) stop both walks: a
+ * loop's list is computed once, before the loop runs, so neither a loop nor what
+ * feeds its list may be cloned with another loop's body. A for-each in its own
+ * body would even expand again on every iteration. A node that reaches one stays
+ * shared.
  */
-function addRandomizeClosureToBody(
-  bodyNodeIds: Set<string>,
-  forEachEndId: string,
-  edges: WorkflowEditorEdge[],
-  nodes: WorkflowEditorNode[],
-): void {
-  const nodeById = new Map(nodes.map((n) => [n.id, n]));
+function addRandomizeClosureToBody(bodyNodeIds: Set<string>, forEachEndId: string, graph: LoopGraph): void {
+  const isLoopNode = (id: string): boolean => {
+    const type = graph.nodeById.get(id)?.type;
+    return type === 'forEach' || type === 'forEachEnd';
+  };
   const isUnlockedRandomize = (id: string): boolean => {
-    const data = nodeById.get(id)?.data as
+    const data = graph.nodeById.get(id)?.data as
       | { mode?: SliceAssetsMode; isRandomize?: boolean; isSeedLocked?: boolean }
       | undefined;
     return !!data && getSliceAssetsMode(data) === 'randomize' && data.isSeedLocked !== true;
   };
-  // edge convention: `{ source: consumer, target: provider }` — an input handle
-  // on `source` reads an output handle on `target`.
-  const providersOf = (id: string): string[] => edges.filter((e) => e.source === id).map((e) => e.target);
-  const consumersOf = (id: string): string[] => edges.filter((e) => e.target === id).map((e) => e.source);
 
-  // Every node strictly upstream of the body (its transitive input providers).
+  // The nodes that feed the body without going through a loop node.
   const upstream = new Set<string>();
   const upstreamQueue = [...bodyNodeIds];
   while (upstreamQueue.length > 0) {
-    for (const provider of providersOf(upstreamQueue.pop()!)) {
-      if (provider !== forEachEndId && !bodyNodeIds.has(provider) && !upstream.has(provider)) {
-        upstream.add(provider);
-        upstreamQueue.push(provider);
-      }
+    for (const provider of graph.dataProviders.get(upstreamQueue.pop()!) ?? []) {
+      if (bodyNodeIds.has(provider) || upstream.has(provider) || isLoopNode(provider)) continue;
+      upstream.add(provider);
+      upstreamQueue.push(provider);
     }
   }
 
@@ -985,16 +1067,16 @@ function addRandomizeClosureToBody(
     let escapesLoop = false;
     while (chainQueue.length > 0) {
       const id = chainQueue.pop()!;
-      if (bodyNodeIds.has(id)) continue; // reached the loop body — a valid sink
-      chain.add(id);
-      const consumers = consumersOf(id);
-      if (consumers.length === 0) {
-        escapesLoop = true; // dead-end outside the loop → do not internalize
+      // The body and this loop's results are where a per-iteration draw belongs.
+      if (bodyNodeIds.has(id) || id === forEachEndId || chain.has(id)) continue;
+      const consumers = graph.dataConsumers.get(id) ?? [];
+      // Another loop, or a dead end outside the loop: the draw must stay shared.
+      if (isLoopNode(id) || consumers.length === 0) {
+        escapesLoop = true;
         break;
       }
-      for (const consumer of consumers) {
-        if (!bodyNodeIds.has(consumer)) chainQueue.push(consumer);
-      }
+      chain.add(id);
+      chainQueue.push(...consumers);
     }
     if (!escapesLoop) for (const id of chain) bodyNodeIds.add(id);
   }
@@ -1275,13 +1357,14 @@ export function convertWorkflowEditorToFlow(
   const forEachLoopFlowIds = new Map<string, string[]>();
   const forEachFlowItemRefs = new Map<string, WorkflowEditorFlowItem>();
 
+  const loopGraph = buildLoopGraph(nodes, edges);
   for (const node of sortedNodes) {
     if (node.type !== 'forEach') continue;
     const endNode = nodes.find(
       (n) => n.type === 'forEachEnd' && (n.data as { parentNodeId?: string }).parentNodeId === node.id,
     );
     if (!endNode) continue;
-    forEachBodyEditorNodeIds.set(node.id, getForEachBodyEditorNodeIds(node.id, endNode.id, edges, nodes));
+    forEachBodyEditorNodeIds.set(node.id, getForEachBodyEditorNodeIds(node.id, endNode.id, edges, loopGraph));
     forEachLoopFlowIds.set(node.id, []);
   }
 
@@ -1660,9 +1743,10 @@ export function convertWorkflowEditorToFlow(
         const outHandle = targetNode.data.outputHandles?.find((h) => h.id === edge.targetHandle);
         const outHandleName = outHandle?.name ?? 'output';
         const targetFlowId = nodeIdToFlowIdMap.get(targetNode.id) ?? targetNode.id;
+        const varName = `${targetFlowId}_${outHandleName}`;
         flowInputs.push({
-          name: `${targetFlowId}_${outHandleName}`,
-          type: getPromptBuilderInputType(targetNode, outHandle, outHandleName),
+          name: varName,
+          type: getPromptBuilderInputType(targetNode, outHandle, outHandleName, value, varName),
           ref,
         });
       }
@@ -1704,6 +1788,35 @@ export function convertWorkflowEditorToFlow(
         inputs: flowInputs.length > 0 ? flowInputs : undefined,
       });
 
+      // ------------------------------------
+      // JoinTexts -> join string list into a single string
+      // ------------------------------------
+    } else if (node.type === 'joinTexts') {
+      const flowInputs: WorkflowEditorFlowInput[] = [];
+      const conditionalHandleId = getConditionalInputHandleId(node.id);
+      let listSourceVarName: string | undefined;
+
+      for (const edge of incomingEdges) {
+        if (edge.sourceHandle === conditionalHandleId) continue;
+        const targetNode = nodes.find((n) => n.id === edge.target);
+        if (!targetNode) continue;
+        const ref = getSourceRef(edge, ctx);
+        if (!ref) continue;
+        const varName = toCelIdentifier(targetNode.id);
+        flowInputs.push({ name: varName, type: 'string_array', ref });
+        listSourceVarName = varName;
+      }
+      flowInputs.push(...collectConditionalConnectionInputs(incomingEdges, node.id, ctx));
+      const delim = (node.data as { joinDelimiter?: string }).joinDelimiter ?? ', ';
+      flow.push({
+        id: flowId,
+        type: 'transform',
+        logic: {
+          transform: `${listSourceVarName ?? '[]'}.join(${formatTextAsCELString(delim)})`,
+        },
+        inputs: flowInputs.length > 0 ? flowInputs : undefined,
+      });
+
       // ------------------------------------
       // GroupItems -> array concatenation
       // ------------------------------------
@@ -1767,7 +1880,10 @@ export function convertWorkflowEditorToFlow(
             getOutputHandleVarName,
           );
           const count = clampUserSelectionCount(parseInt(String(sliceData.count ?? ''), 10) || 1);
-          const message = sliceData.message?.trim() || DEFAULT_SLICE_ASSETS_CHOOSE_MESSAGE;
+          const message =
+            typeof sliceData.message === 'string' ?
+              sliceData.message.trim() || DEFAULT_SLICE_ASSETS_CHOOSE_MESSAGE
+            : DEFAULT_SLICE_ASSETS_CHOOSE_MESSAGE;
           const arrayType = getUserSelectionArrayType(flowInputs);
 
           // Single array-typed source can feed user-selection directly; scalars must be wrapped.
@@ -1903,6 +2019,9 @@ export function convertWorkflowEditorToFlow(
         }
       }
 
+      // CEL conditions need hyphen→underscore identifiers, but the shared input-name
+      // map must keep the real workflow input keys (`text-1`, not `text_1`).
+      const celFieldNameMap = new Map<string, string>();
       const edgesIntoIfElse = edges.filter((e) => e.target === node.id);
       for (const fieldKey of fieldsUsed) {
         const resolved = resolveIfElseConditionField(fieldKey, nodes);
@@ -1917,7 +2036,7 @@ export function convertWorkflowEditorToFlow(
           : 'output';
 
         const celVarName = getOutputHandleVarName(fieldNodeId, outputHandleName);
-        nodeIdToInputNameMap.set(fieldKey, celVarName);
+        celFieldNameMap.set(fieldKey, celVarName);
 
         const edgeToIfElse =
           edgesIntoIfElse
@@ -1953,7 +2072,7 @@ export function convertWorkflowEditorToFlow(
 
       const cases: { condition: string; value: string }[] = [];
       for (let i = 0; i < conditionBlocks.length; i++) {
-        const condition = conditionBlockToCEL(conditionBlocks[i]!, nodeIdToInputNameMap);
+        const condition = conditionBlockToCEL(conditionBlocks[i]!, celFieldNameMap);
         if (condition) cases.push({ condition, value: String(i + 2) });
       }
 
@@ -2100,7 +2219,7 @@ function getSliceAssetsMode(data: { mode?: SliceAssetsMode; isRandomize?: boolea
 }
 
 function clampUserSelectionCount(count: number): number {
-  return Math.min(USER_SELECTION_MAX_SELECT, Math.max(USER_SELECTION_MIN_SELECT, count));
+  return Math.min(USER_SELECTION_MAX_CANDIDATES, Math.max(USER_SELECTION_MIN_SELECT, count));
 }
 
 function getUserSelectionArrayType(flowInputs: WorkflowEditorFlowInput[]): 'file_array' | 'string_array' {

package/src/lib/workflow_import_validator.ts

@@ -1,3 +1,5 @@
+import { evaluateCel } from './cel';
+
 export class WorkflowImportError extends Error {
   constructor(message: string) {
     super(message);
@@ -13,6 +15,7 @@ export type WorkflowEditorNodeType =
   | 'llm'
   | 'transformText'
   | 'splitText'
+  | 'joinTexts'
   | 'ifElse'
   | 'groupItems'
   | 'sliceAssets'
@@ -30,6 +33,7 @@ export const VALID_EDITOR_NODE_TYPES: readonly WorkflowEditorNodeType[] = [
   'llm',
   'transformText',
   'splitText',
+  'joinTexts',
   'ifElse',
   'groupItems',
   'sliceAssets',
@@ -40,6 +44,12 @@ export const VALID_EDITOR_NODE_TYPES: readonly WorkflowEditorNodeType[] = [
   'modelInput',
 ];
 
+export interface WorkflowNodeGroup {
+  title: string;
+  color: string;
+  locked?: boolean;
+}
+
 export interface WorkflowExportData {
   version: '1.0';
   name: string;
@@ -48,6 +58,7 @@ export interface WorkflowExportData {
     nodes: Array<{ type: WorkflowEditorNodeType; [key: string]: unknown }>;
     edges: Array<{ [key: string]: unknown }>;
     inputKeys: string[];
+    nodeGroups?: Record<string, WorkflowNodeGroup>;
   };
   inputs: unknown[];
   tagSet: string[];
@@ -67,7 +78,10 @@ export interface WorkflowExportData {
  *  2. `version` field is present and equals "1.0"
  *  3. `editorInfo` has non-empty `nodes` and `edges` arrays
  *  4. Each node's `type` is a recognized editor node type
- *  5. `inputs` is an array
+ *  5. `sliceAssets` nodes with a `data.message` require that field to be a string
+ *  6. `inputs` is an array
+ *  7. Each `transformText` node's `data.value` is supported by the Prompt
+ *     Builder visual editor (single-quoted string templates)
  */
 export function validateEditorInfo(data: unknown): WorkflowExportData {
   if (typeof data !== 'object' || data === null) {
@@ -104,7 +118,108 @@ export function validateEditorInfo(data: unknown): WorkflowExportData {
     if (!(VALID_EDITOR_NODE_TYPES as readonly string[]).includes(node.type)) {
       throw new WorkflowImportError(`Invalid node type: ${node.type}`);
     }
+
+    if (node.type === 'sliceAssets') {
+      const nodeData = node['data'];
+      if (
+        nodeData !== null &&
+        typeof nodeData === 'object' &&
+        'message' in nodeData &&
+        (nodeData as { message?: unknown }).message != null &&
+        typeof (nodeData as { message?: unknown }).message !== 'string'
+      ) {
+        const nodeId = typeof node['id'] === 'string' && node['id'] ? node['id'] : '(unknown)';
+        throw new WorkflowImportError(`Invalid sliceAssets node "${nodeId}": data.message must be a string`);
+      }
+    }
+
+    if (node.type === 'transformText') {
+      const value = getTransformTextValue(node);
+      if (value === undefined) continue;
+      if (typeof value !== 'string' || !getIsPromptBuilderVisualEditorSupported(value)) {
+        throw new WorkflowImportError(
+          `Node "${getNodeIdLabel(
+            node,
+          )}": Prompt Builder value is not supported by the visual editor; use a single-quoted template like 'sheep ' + text1_output`,
+        );
+      }
+    }
   }
 
   return workflow as WorkflowExportData;
 }
+
+// ------------------------------------
+
+/**
+ * True if `value` is safe for the Prompt Builder chip editor.
+ * Only single-quoted string templates like `'lit' + var` are supported;
+ * double-quoted strings or CEL lists/numbers/bools will break or be removed.
+ */
+export function getIsPromptBuilderVisualEditorSupported(value: string): boolean {
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || trimmed === "''") return true;
+
+  // List / map literals never come from the visual editor and confuse the
+  // quote/variable scanner (`["sheep", "on"]`, `{a: 1}`, …).
+  if (/^[[{]/.test(trimmed)) return false;
+
+  if (getHasDoubleQuotedCelStringLiteral(trimmed)) return false;
+
+  try {
+    const result = evaluateCel(trimmed, {});
+    if (typeof result !== 'string') return false;
+  } catch {
+    // Unbound variables (`text1_output`) and similar fail evaluation with an
+    // empty binding map — that is still a normal canvas template.
+  }
+
+  return true;
+}
+
+/** True when the expression contains a `"` / `r"..."` string literal outside of `'...'`. */
+function getHasDoubleQuotedCelStringLiteral(input: string): boolean {
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+
+    if ((ch === 'r' || ch === 'R') && (input[i + 1] === '"' || input[i + 1] === "'")) {
+      if (input[i + 1] === '"') return true;
+      i += 2;
+      while (i < input.length && input[i] !== "'") i++;
+      if (i < input.length) i++;
+      continue;
+    }
+
+    if (ch === "'") {
+      i++;
+      while (i < input.length) {
+        if (input[i] === '\\' && i + 1 < input.length) {
+          i += 2;
+          continue;
+        }
+        if (input[i] === "'") {
+          i++;
+          break;
+        }
+        i++;
+      }
+      continue;
+    }
+
+    if (ch === '"') return true;
+    i++;
+  }
+  return false;
+}
+
+function getTransformTextValue(node: { [key: string]: unknown }): unknown {
+  const data = node['data'];
+  if (data === undefined || data === null) return undefined;
+  if (typeof data !== 'object') return undefined;
+  return (data as { [key: string]: unknown })['value'];
+}
+
+function getNodeIdLabel(node: { [key: string]: unknown }): string {
+  return typeof node['id'] === 'string' ? node['id'] : 'unknown';
+}

package/src/lib/workflow_validator.ts

@@ -1,3 +1,9 @@
+import {
+  USER_SELECTION_DEFAULT_MAX,
+  USER_SELECTION_MAX_CANDIDATES,
+  USER_SELECTION_MIN_SELECT,
+} from './user_selection_limits';
+
 const VALID_NODE_TYPES = new Set([
   'custom-model',
   'for-each',
@@ -12,8 +18,6 @@ const VALID_NODE_TYPES = new Set([
   'workflow',
 ]);
 
-const USER_SELECTION_MIN_SELECT = 1;
-const USER_SELECTION_MAX_SELECT = 100;
 const USER_SELECTION_INPUT_TYPES = new Set(['file_array', 'string_array']);
 
 type RawRef = {
@@ -58,7 +62,7 @@ type RawNode = {
  *       - logic        → logicType
  *       - for-each        → loopBodyNodeIds (non-empty) OR count (>0)
  *       - user-selection  → exactly one file_array/string_array input (optional connection);
- *                           input.min ≤ input.max
+ *                           input.min in 1..50, input.max in 1..100, input.min ≤ input.max
  *  5. Cross-references all point to node IDs that exist in the flow:
  *       - dependsOn entries
  *       - input ref.node (excluding "workflow" which is a reserved keyword)
@@ -321,26 +325,26 @@ function validateUserSelectionNode(label: string, node: RawNode): void {
   const input = selectionInputs[0]!;
 
   const min = input.min === undefined ? USER_SELECTION_MIN_SELECT : input.min;
-  const max = input.max === undefined ? USER_SELECTION_MAX_SELECT : input.max;
+  const max = input.max === undefined ? USER_SELECTION_DEFAULT_MAX : input.max;
 
   if (
     typeof min !== 'number' ||
     !Number.isInteger(min) ||
     min < USER_SELECTION_MIN_SELECT ||
-    min > USER_SELECTION_MAX_SELECT
+    min > USER_SELECTION_MAX_CANDIDATES
   ) {
     throw new Error(
-      `Node ${label} (user-selection) input.min must be an integer between ${USER_SELECTION_MIN_SELECT} and ${USER_SELECTION_MAX_SELECT}`,
+      `Node ${label} (user-selection) input.min must be an integer between ${USER_SELECTION_MIN_SELECT} and ${USER_SELECTION_MAX_CANDIDATES}`,
     );
   }
   if (
     typeof max !== 'number' ||
     !Number.isInteger(max) ||
     max < USER_SELECTION_MIN_SELECT ||
-    max > USER_SELECTION_MAX_SELECT
+    max > USER_SELECTION_DEFAULT_MAX
   ) {
     throw new Error(
-      `Node ${label} (user-selection) input.max must be an integer between ${USER_SELECTION_MIN_SELECT} and ${USER_SELECTION_MAX_SELECT}`,
+      `Node ${label} (user-selection) input.max must be an integer between ${USER_SELECTION_MIN_SELECT} and ${USER_SELECTION_DEFAULT_MAX}`,
     );
   }
   if (min > max) {