@synergenius/flow-weaver 0.33.1 → 0.44.0

package/dist/cli/flow-weaver-chunk-MHJ4N652.mjs

@@ -0,0 +1,1580 @@
+import { createRequire as __createRequire } from "module";
+const require = __createRequire(import.meta.url);
+import {
+  AmbiguousWorkflowError,
+  BundleChangedError,
+  InvalidAnswerError,
+  MissingOutputsError,
+  ParseError,
+  RunBusyError,
+  RunNotFoundError,
+  RunNotWaitingError,
+  answerAgentGate,
+  createLocalCoordinator,
+  defaultRunsDir,
+  isAnswering,
+  noteAnswerMisfit,
+  reclaimStaleAgentAnswers,
+  transcriptName
+} from "./flow-weaver-chunk-YLSRZWFK.mjs";
+import {
+  MissingParamsError
+} from "./flow-weaver-chunk-EKWF27G6.mjs";
+import {
+  loadAgentProfiles
+} from "./flow-weaver-chunk-TS5P3PIN.mjs";
+import {
+  parseWorkflow
+} from "./flow-weaver-chunk-W3YNK26P.mjs";
+import {
+  VERSION
+} from "./flow-weaver-chunk-VXWNLYQU.mjs";
+import {
+  getErrorMessage
+} from "./flow-weaver-chunk-OMVWSNHJ.mjs";
+import {
+  Ze
+} from "./flow-weaver-chunk-GAQXZHNO.mjs";
+
+// src/server/workflow-registry.ts
+import * as fs from "fs";
+import * as path from "path";
+var WorkflowRegistry = class {
+  constructor(workflowDir, options = {}) {
+    this.workflowDir = workflowDir;
+    this.options = options;
+  }
+  workflowDir;
+  options;
+  endpoints = /* @__PURE__ */ new Map();
+  watcher = null;
+  debounceTimers = /* @__PURE__ */ new Map();
+  startTime = Date.now();
+  /**
+   * Initialize the registry by discovering all workflows
+   */
+  async initialize() {
+    await this.discoverWorkflows();
+  }
+  /**
+   * Discover all workflow files in the configured directory
+   */
+  async discoverWorkflows() {
+    const files = await Ze("**/*.ts", {
+      cwd: this.workflowDir,
+      absolute: true,
+      ignore: [
+        "**/*.generated.ts",
+        "**/node_modules/**",
+        "**/*.d.ts",
+        "**/*.test.ts",
+        "**/*.spec.ts"
+      ]
+    });
+    this.endpoints.clear();
+    for (const file of files) {
+      try {
+        const content = fs.readFileSync(file, "utf8");
+        if (!content.includes("@flowWeaver")) {
+          continue;
+        }
+        let result = await parseWorkflow(file, { projectDir: path.dirname(file) });
+        if (result.errors.length && result.availableWorkflows.length > 1) {
+          result = await parseWorkflow(file, { projectDir: path.dirname(file), workflowName: result.availableWorkflows[0] });
+        }
+        if (result.errors.length) continue;
+        for (const workflow of result.allWorkflows) {
+          const endpoint = {
+            name: workflow.name,
+            functionName: workflow.functionName,
+            filePath: file,
+            method: "POST",
+            path: `/workflows/${workflow.name}`,
+            inputSchema: this.extractInputSchema(workflow),
+            outputSchema: this.extractOutputSchema(workflow),
+            description: workflow.description,
+            gates: workflow.instances.filter((i) => workflow.nodeTypes.find((n) => n.name === i.nodeType || n.functionName === i.nodeType)?.durableGate !== void 0).length,
+            routes: workflow.options?.http ?? []
+          };
+          this.endpoints.set(workflow.name, endpoint);
+        }
+      } catch {
+      }
+    }
+  }
+  /**
+   * Extract JSON Schema for workflow input ports
+   */
+  extractInputSchema(workflow) {
+    const schema = {
+      type: "object",
+      properties: {}
+    };
+    const required = [];
+    for (const [portName, port] of Object.entries(workflow.startPorts || {})) {
+      if (portName === "execute") continue;
+      schema.properties[portName] = {
+        ...this.dataTypeToJsonSchema(port.dataType),
+        ...port.label && { description: port.label }
+      };
+      if (!port.optional) {
+        required.push(portName);
+      }
+    }
+    if (required.length > 0) {
+      schema.required = required;
+    }
+    return schema;
+  }
+  /**
+   * Extract JSON Schema for workflow output ports
+   */
+  extractOutputSchema(workflow) {
+    const schema = {
+      type: "object",
+      properties: {}
+    };
+    for (const [portName, port] of Object.entries(workflow.exitPorts || {})) {
+      if (portName === "onSuccess" || portName === "onFailure") continue;
+      schema.properties[portName] = {
+        ...this.dataTypeToJsonSchema(port.dataType),
+        ...port.label && { description: port.label }
+      };
+    }
+    return schema;
+  }
+  /**
+   * A Flow Weaver data type as a JSON Schema fragment. `ANY` has no JSON
+   * Schema type: it is the empty schema, which admits anything.
+   */
+  dataTypeToJsonSchema(dataType) {
+    const mapping = {
+      STRING: "string",
+      NUMBER: "number",
+      BOOLEAN: "boolean",
+      OBJECT: "object",
+      ARRAY: "array",
+      STEP: "boolean"
+    };
+    const type = mapping[dataType];
+    return type ? { type } : {};
+  }
+  /**
+   * Get a specific endpoint by workflow name
+   */
+  getEndpoint(name) {
+    return this.endpoints.get(name);
+  }
+  /**
+   * Get all registered endpoints
+   */
+  getAllEndpoints() {
+    return Array.from(this.endpoints.values());
+  }
+  /**
+   * Get server uptime in seconds
+   */
+  getUptime() {
+    return Math.floor((Date.now() - this.startTime) / 1e3);
+  }
+  /**
+   * Start watching for file changes. After a change settles, the workflows
+   * are discovered again and `onChange` runs. A rediscovery that fails goes
+   * to `onError`, which by default writes it to stderr, and the next change
+   * tries again.
+   */
+  async startWatching(onChange, onError = (error) => {
+    console.error(`Rediscovering workflows in ${this.workflowDir} failed: ${getErrorMessage(error)}`);
+  }) {
+    try {
+      const chokidar = await import("chokidar");
+      const watcher = chokidar.watch(this.workflowDir, {
+        persistent: true,
+        ignoreInitial: true,
+        ignored: ["**/*.generated.ts", "**/node_modules/**", "**/*.d.ts"],
+        awaitWriteFinish: {
+          stabilityThreshold: 300,
+          pollInterval: 100
+        }
+      });
+      this.watcher = watcher;
+      watcher.on("all", (event, filePath) => {
+        if (!filePath.endsWith(".ts")) return;
+        const existingTimer = this.debounceTimers.get(filePath);
+        if (existingTimer) {
+          clearTimeout(existingTimer);
+        }
+        const timer = setTimeout(() => {
+          this.debounceTimers.delete(filePath);
+          this.discoverWorkflows().then(() => onChange()).catch(onError);
+        }, 500);
+        this.debounceTimers.set(filePath, timer);
+      });
+    } catch {
+    }
+  }
+  /**
+   * Stop watching for file changes
+   */
+  async stopWatching() {
+    for (const timer of this.debounceTimers.values()) {
+      clearTimeout(timer);
+    }
+    this.debounceTimers.clear();
+    if (this.watcher) {
+      await this.watcher.close();
+      this.watcher = null;
+    }
+  }
+};
+
+// src/server/openapi.ts
+function buildOpenApi(input) {
+  const { endpoints, mounted, legacy, secured } = input;
+  const base = input.base ?? "";
+  const paths = {};
+  const run = { $ref: "#/components/schemas/Run" };
+  const error = { $ref: "#/components/schemas/Error" };
+  for (const c of mounted) {
+    const e = c.endpoint;
+    const props = e.inputSchema?.properties ?? {};
+    const required = e.inputSchema?.required ?? [];
+    const inPath = new Set(c.keys);
+    const rest = Object.fromEntries(Object.entries(props).filter(([k]) => !inPath.has(k)));
+    const restRequired = required.filter((k) => !inPath.has(k));
+    const oaPath = c.route.path.replace(/:([A-Za-z_][A-Za-z0-9_]*)/g, "{$1}");
+    const parameters = c.keys.map((k) => ({ name: k, in: "path", required: true, schema: props[k] ?? {} }));
+    const op = {
+      operationId: `${c.route.method.toLowerCase()}_${e.functionName}${c.keys.length ? `_by_${c.keys.join("_")}` : ""}`,
+      summary: e.description || `${c.route.method} ${c.route.path}`,
+      tags: ["endpoints"],
+      ...c.route.auth === "none" ? { security: [] } : {},
+      responses: {
+        "200": { description: "The workflow ran to its end", content: { "application/json": { schema: e.outputSchema ?? { type: "object" } } } },
+        "202": { description: `Paused at a gate${c.route.mode === "async" ? ", or running" : ""}. Follow Location`, headers: { Location: { schema: { type: "string" } } }, content: { "application/json": { schema: run } } },
+        "400": { description: "Bad parameters, or a refused callback URL", content: { "application/json": { schema: error } } },
+        "409": { description: "Idempotency-Key reused with different parameters", content: { "application/json": { schema: error } } },
+        "422": { description: "The workflow finished on its failure path", content: { "application/json": { schema: e.outputSchema ?? { type: "object" } } } },
+        "500": { description: "The run failed", content: { "application/json": { schema: error } } }
+      }
+    };
+    if (c.route.method === "GET" || c.route.method === "DELETE") {
+      parameters.push(...Object.entries(rest).map(([k, s]) => ({ name: k, in: "query", required: restRequired.includes(k), schema: s })));
+      if (c.route.callback) parameters.push({ name: "callbackUrl", in: "query", required: false, schema: { type: "string", format: "uri" }, description: "Receives the final response by POST" });
+    } else {
+      op.requestBody = {
+        required: restRequired.length > 0,
+        content: {
+          "application/json": { schema: { type: "object", properties: { ...rest, ...c.route.callback ? { callbackUrl: { type: "string", format: "uri", description: "Receives the final response by POST" } } : {} }, ...restRequired.length ? { required: restRequired } : {} } },
+          "application/x-www-form-urlencoded": { schema: { type: "object", properties: rest, ...restRequired.length ? { required: restRequired } : {} } }
+        }
+      };
+    }
+    parameters.push({ name: "Idempotency-Key", in: "header", required: false, schema: { type: "string" }, description: "The same key gives the same run" });
+    parameters.push({ name: "Prefer", in: "header", required: false, schema: { type: "string", enum: ["respond-async"] }, description: "Answer 202 before the first step runs" });
+    op.parameters = parameters;
+    paths[oaPath] = { ...paths[oaPath] ?? {}, [c.route.method.toLowerCase()]: op };
+  }
+  if (legacy) {
+    for (const e of endpoints) {
+      paths[e.path] = {
+        ...paths[e.path] ?? {},
+        get: { operationId: `describe_${e.functionName}`, summary: `Describe ${e.name}`, tags: ["workflows"], responses: { "200": { description: "The endpoint and its schemas" } } },
+        post: {
+          operationId: `run_${e.functionName}`,
+          summary: `Run ${e.name} (run resource)`,
+          tags: ["workflows"],
+          parameters: [{ name: "async", in: "query", schema: { type: "boolean" } }],
+          requestBody: { required: true, content: { "application/json": { schema: e.inputSchema || { type: "object", additionalProperties: true } } } },
+          responses: { "200": { description: "Completed", content: { "application/json": { schema: run } } }, "202": { description: "Waiting at a gate, or running when async", content: { "application/json": { schema: run } } }, "500": { description: "Failed", content: { "application/json": { schema: run } } } }
+        }
+      };
+    }
+  }
+  const runId = { name: "runId", in: "path", required: true, schema: { type: "string" } };
+  paths["/runs"] = { get: { operationId: "listRuns", summary: "List runs", tags: ["runs"], parameters: [{ name: "workflow", in: "query", schema: { type: "string" } }], responses: { "200": { description: "Runs, newest first" } } } };
+  paths["/runs/{runId}"] = { get: { operationId: "getRun", summary: "One run", tags: ["runs"], parameters: [runId], responses: { "200": { description: "The run", content: { "application/json": { schema: run } } }, "404": { description: "No such run" } } } };
+  paths["/runs/{runId}/resolve"] = { post: { operationId: "resolveRun", summary: "Answer the gate a run is waiting at", tags: ["runs"], parameters: [runId, { name: "async", in: "query", schema: { type: "boolean" } }], requestBody: { required: true, content: { "application/json": { schema: { type: "object", properties: { answer: { description: "The gate's result" }, reject: { type: "string" } } } } } }, responses: { "200": { description: "Completed", content: { "application/json": { schema: run } } }, "202": { description: "Waiting at the next gate", content: { "application/json": { schema: run } } }, "409": { description: "Not waiting, the file changed, or an agent is answering", content: { "application/json": { schema: error } } } } } };
+  paths["/runs/{runId}/cancel"] = { post: { operationId: "cancelRun", summary: "Stop a run", tags: ["runs"], parameters: [runId], responses: { "200": { description: "The run", content: { "application/json": { schema: run } } } } } };
+  paths["/runs/{runId}/events"] = { get: { operationId: "runEvents", summary: "Follow a run as server-sent events", tags: ["runs"], parameters: [runId], responses: { "200": { description: "text/event-stream: run, event, agent, synced" } } } };
+  paths["/runs/{runId}/agent"] = { get: { operationId: "runAgent", summary: "The transcript of the agent that answered the latest agent gate", tags: ["runs"], parameters: [runId], responses: { "200": { description: "The transcript" }, "404": { description: "No agent answered this run" } } } };
+  paths["/health"] = { get: { operationId: "health", summary: "Liveness", tags: ["meta"], security: [], responses: { "200": { description: "ok" } } } };
+  return {
+    openapi: "3.0.3",
+    info: {
+      title: input.info?.title ?? "Flow Weaver API",
+      version: input.info?.version ?? VERSION,
+      description: input.info?.description ?? `${mounted.length} declared endpoint(s)${legacy ? ` and ${endpoints.length} workflow(s) as run resources` : ""}. A workflow that pauses at a gate answers 202 with a run id.`
+    },
+    servers: [{ url: `${input.serverUrl ?? ""}${base}` || "/" }],
+    paths,
+    tags: [{ name: "endpoints" }, { name: "workflows" }, { name: "runs" }, { name: "meta" }],
+    components: {
+      schemas: {
+        Run: { type: "object", properties: { runId: { type: "string" }, workflow: { type: "string" }, status: { type: "string", enum: ["running", "waiting", "completed", "failed", "cancelled"] }, gate: { type: "object" }, agent: { type: "object" }, result: {}, error, links: { type: "object" } } },
+        Error: { type: "object", properties: { error: { type: "object", properties: { code: { type: "string" }, message: { type: "string" }, details: {} } } } }
+      },
+      ...secured ? { securitySchemes: { bearer: { type: "http", scheme: "bearer" } } } : {}
+    },
+    ...secured ? { security: [{ bearer: [] }] } : {}
+  };
+}
+
+// src/server/access.ts
+import { timingSafeEqual } from "node:crypto";
+
+// src/server/http-error.ts
+var HttpError = class extends Error {
+  constructor(status, code, message, details, headers) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.headers = headers;
+    this.name = "HttpError";
+  }
+  status;
+  code;
+  details;
+  headers;
+};
+function errorToHttp(err) {
+  if (err instanceof HttpError) return err;
+  if (err instanceof ParseError) return new HttpError(400, "PARSE_ERROR", err.message);
+  if (err instanceof AmbiguousWorkflowError) return new HttpError(400, "AMBIGUOUS_WORKFLOW", err.message);
+  if (err instanceof RunNotFoundError) return new HttpError(404, "RUN_NOT_FOUND", err.message);
+  if (err instanceof RunNotWaitingError) return new HttpError(409, "RUN_NOT_WAITING", err.message);
+  if (err instanceof BundleChangedError) return new HttpError(409, "BUNDLE_CHANGED", err.message);
+  if (err instanceof MissingOutputsError) return new HttpError(400, "MISSING_OUTPUTS", err.message);
+  if (err instanceof InvalidAnswerError) return new HttpError(400, "INVALID_INPUT", err.message);
+  if (err instanceof RunBusyError) return new HttpError(409, "RUN_IN_FLIGHT", err.message, void 0, { "Retry-After": "2" });
+  if (err instanceof MissingParamsError) return new HttpError(400, "VALIDATION_ERROR", err.message, err.missing.map((k) => ({ path: k, message: "required" })));
+  const name = err?.name;
+  if (name === "ContinuationRefusalError") return new HttpError(409, "CONTINUATION_REFUSED", getErrorMessage(err));
+  return new HttpError(500, "EXECUTION_ERROR", getErrorMessage(err));
+}
+
+// src/server/respond.ts
+function header(req, name) {
+  const v = req.headers[name.toLowerCase()];
+  return Array.isArray(v) ? v[0] : v;
+}
+function json(res, status, body, extra = {}) {
+  const text = JSON.stringify(body);
+  res.writeHead(status, { "Content-Type": "application/json; charset=utf-8", "Content-Length": Buffer.byteLength(text), ...extra });
+  res.end(text);
+}
+function html(res, body) {
+  res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+  res.end(body);
+}
+function decodeSegment(raw) {
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    throw new HttpError(400, "BAD_PATH", `the path segment "${raw}" is not valid percent-encoding`);
+  }
+}
+var isForm = (req) => /application\/x-www-form-urlencoded/i.test(header(req, "content-type") ?? "");
+function parseBodyText(text, form) {
+  const t = text.trim();
+  if (!t) return {};
+  if (form) {
+    const out = {};
+    for (const [k, v] of new URLSearchParams(t)) out[k] = v;
+    return out;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(t);
+  } catch {
+    throw new HttpError(400, "INVALID_JSON", "the body is not valid JSON");
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new HttpError(400, "INVALID_JSON", "the body must be a JSON object");
+  return parsed;
+}
+async function readBody(req, given, maxBody) {
+  const form = isForm(req);
+  const pre = given !== void 0 ? given : req.body;
+  if (pre !== void 0 && pre !== null) {
+    if (typeof pre === "string") return { body: parseBodyText(pre, form), form };
+    if (Buffer.isBuffer(pre) || pre instanceof Uint8Array) return { body: parseBodyText(Buffer.from(pre).toString("utf8"), form), form };
+    if (typeof pre !== "object" || Array.isArray(pre)) throw new HttpError(400, "INVALID_JSON", "the body must be a JSON object");
+    return { body: pre, form };
+  }
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const buf = typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk);
+    size += buf.length;
+    if (size > maxBody) throw new HttpError(413, "BODY_TOO_LARGE", `the body may not exceed ${maxBody} bytes`);
+    chunks.push(buf);
+  }
+  return { body: parseBodyText(Buffer.concat(chunks).toString("utf8"), form), form };
+}
+function wantsAsync(req, url) {
+  const q = url.searchParams.get("async");
+  if (q !== null) return q !== "0" && q !== "false";
+  return /respond-async/i.test(header(req, "prefer") ?? "");
+}
+function waitBudget(req, maxWait) {
+  const m = /wait=(\d+(?:\.\d+)?)/i.exec(header(req, "prefer") ?? "");
+  return m ? Math.min(maxWait, Math.max(0, Number(m[1]) * 1e3)) : maxWait;
+}
+async function settledWithin(segment, ms) {
+  let timer;
+  const done = await Promise.race([
+    segment.then(() => true, () => true),
+    new Promise((r) => {
+      timer = setTimeout(() => r(false), ms);
+      timer.unref?.();
+    })
+  ]);
+  if (timer) clearTimeout(timer);
+  if (!done) segment.catch(() => void 0);
+  return done;
+}
+
+// src/server/access.ts
+var isLoopback = (host) => ["127.0.0.1", "localhost", "::1", "[::1]"].includes(host);
+function authorized(req, token) {
+  if (!token) return true;
+  const raw = req.headers.authorization;
+  const line = Array.isArray(raw) ? raw[0] : raw;
+  const given = /^Bearer\s+(.+)$/i.exec(line ?? "")?.[1]?.trim() ?? "";
+  const a = Buffer.from(given), b = Buffer.from(token);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function cors(req, res, allowed) {
+  if (!allowed) return;
+  let origin;
+  if (Array.isArray(allowed)) {
+    const requested = header(req, "origin");
+    origin = requested !== void 0 && allowed.includes(requested) ? requested : void 0;
+    res.setHeader("Vary", "Origin");
+  } else {
+    origin = allowed;
+  }
+  if (!origin) return;
+  res.setHeader("Access-Control-Allow-Origin", origin);
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
+  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Prefer, Idempotency-Key, X-Callback-Url");
+}
+
+// src/server/route-plan.ts
+var RESERVED_PATHS = ["/health", "/workflows", "/runs", "/openapi.json", "/docs"];
+var RESERVED = RESERVED_PATHS;
+var isReserved = (p) => RESERVED.some((r) => p === r || p.startsWith(`${r}/`));
+function planRoutes(list) {
+  const mounted = [];
+  const problems = [];
+  const seen = /* @__PURE__ */ new Map();
+  for (const owner of list) {
+    for (const route of owner.routes) {
+      if (isReserved(route.path)) {
+        problems.push(`${owner.name}: @http ${route.method} ${route.path} is under a reserved path (${RESERVED.join(", ")}), so it is not mounted`);
+        continue;
+      }
+      const key = `${route.method} ${route.path}`;
+      const other = seen.get(key);
+      if (other) {
+        problems.push(`${owner.name}: @http ${key} is already declared by ${other}, not mounted`);
+        continue;
+      }
+      seen.set(key, owner.name);
+      mounted.push({ owner, route });
+    }
+  }
+  return { mounted, problems };
+}
+function compileRoute(routePath) {
+  const keys = [];
+  const pattern = routePath.split("/").map((seg) => {
+    if (seg.startsWith(":")) {
+      keys.push(seg.slice(1));
+      return "([^/]+)";
+    }
+    return seg.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }).join("/");
+  return { regex: new RegExp(`^${pattern}/?$`), keys };
+}
+function mountRoutes(endpoints) {
+  const plan = planRoutes(endpoints.map((endpoint) => ({ name: endpoint.name, routes: endpoint.routes ?? [], endpoint })));
+  return { compiled: plan.mounted.map(({ owner, route }) => ({ endpoint: owner.endpoint, route, ...compileRoute(route.path) })), problems: plan.problems };
+}
+
+// src/server/api.ts
+import * as path3 from "node:path";
+
+// src/server/routes-declared.ts
+import { randomUUID, createHash } from "node:crypto";
+
+// src/server/callback-url.ts
+import { lookup } from "node:dns/promises";
+import * as http from "node:http";
+import * as https from "node:https";
+import { isIP } from "node:net";
+function isPrivateAddress(ip) {
+  const v = isIP(ip);
+  if (v === 4) {
+    const [a, b] = ip.split(".").map(Number);
+    return a === 10 || a === 127 || a === 0 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127;
+  }
+  if (v === 6) {
+    const low = canonicalIPv6(ip);
+    if (low === "::1" || low === "::") return true;
+    if (low.startsWith("fc") || low.startsWith("fd")) return true;
+    if (/^fe[89ab]/.test(low)) return true;
+    const mapped = low.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+    if (mapped) {
+      const [hi, lo] = [parseInt(mapped[1], 16), parseInt(mapped[2], 16)];
+      return isPrivateAddress(`${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`);
+    }
+  }
+  return false;
+}
+function canonicalIPv6(ip) {
+  try {
+    return new URL(`http://[${ip}]/`).hostname.slice(1, -1);
+  } catch {
+    return ip.toLowerCase();
+  }
+}
+var hostMatches = (host, pattern) => {
+  const p = pattern.toLowerCase();
+  if (p.startsWith("*.")) return host.endsWith(p.slice(1)) && host.length > p.length - 1;
+  return host === p;
+};
+var systemResolve = (host) => lookup(host, { all: true });
+function judgeUrl(raw, policy) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return { refused: "not a valid URL" };
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return { refused: "only http and https callbacks are delivered" };
+  if (url.username || url.password) return { refused: "credentials in the URL are not allowed" };
+  const host = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (policy.allow) {
+    const verdict = policy.allow(url);
+    if (verdict !== true) return { refused: typeof verdict === "string" ? verdict : "refused by the server's callback policy" };
+    return { url, host, publicOnly: false };
+  }
+  if (policy.hosts) {
+    return policy.hosts.some((h) => hostMatches(host, h)) ? { url, host, publicOnly: false } : { refused: `${host} is not among the hosts this server delivers callbacks to` };
+  }
+  if (policy.allowPrivate) return { url, host, publicOnly: false };
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) return { refused: `${host} is a private host, and callbacks go to public addresses only` };
+  return { url, host, publicOnly: true };
+}
+async function addressesOf(host, publicOnly, resolve2) {
+  const literal = isIP(host);
+  let found;
+  if (literal) found = [{ address: host, family: literal }];
+  else {
+    try {
+      found = await resolve2(host);
+    } catch {
+      return { refused: `${host} does not resolve` };
+    }
+    if (!found.length) return { refused: `${host} does not resolve` };
+  }
+  const bad = publicOnly ? found.find((a) => isPrivateAddress(a.address)) : void 0;
+  if (bad) {
+    return { refused: literal ? `${host} is a private address, and callbacks go to public addresses only` : `${host} resolves to ${bad.address}, a private address, and callbacks go to public addresses only` };
+  }
+  return found;
+}
+async function refuseCallbackUrl(raw, policy = {}, resolve2 = systemResolve) {
+  const judged = judgeUrl(raw, policy);
+  if ("refused" in judged) return judged.refused;
+  if (!judged.publicOnly) return void 0;
+  const found = await addressesOf(judged.host, true, resolve2);
+  return "refused" in found ? found.refused : void 0;
+}
+async function callbackTarget(raw, policy = {}, resolve2 = systemResolve) {
+  const judged = judgeUrl(raw, policy);
+  if ("refused" in judged) return judged;
+  const found = await addressesOf(judged.host, judged.publicOnly, resolve2);
+  if ("refused" in found) return found;
+  return { url: judged.url, address: found[0].address, family: found[0].family };
+}
+function postCallback(target, headers, body, timeoutMs) {
+  const { url, address, family } = target;
+  const send = url.protocol === "https:" ? https.request : http.request;
+  return new Promise((resolve2, reject) => {
+    const req = send(url, {
+      method: "POST",
+      headers: { ...headers, "Content-Length": String(Buffer.byteLength(body)) },
+      signal: AbortSignal.timeout(timeoutMs),
+      // Every connection goes to the checked address, whatever the name resolves to now.
+      lookup: (_host, options, callback) => {
+        if (options.all) callback(null, [{ address, family }]);
+        else callback(null, address, family);
+      }
+    }, (res) => {
+      res.resume();
+      res.on("end", () => resolve2(res.statusCode ?? 0));
+      res.on("error", reject);
+    });
+    req.on("error", reject);
+    req.end(body);
+  });
+}
+
+// src/server/route-params.ts
+function coerce(value, schema) {
+  const type = schema?.type;
+  if (type === "number") {
+    const n = Number(value);
+    return Number.isFinite(n) ? n : value;
+  }
+  if (type === "boolean") return value === "true" ? true : value === "false" ? false : value;
+  if (type === "object" || type === "array" || type === void 0) {
+    if (/^[[{]/.test(value.trim())) {
+      try {
+        return JSON.parse(value);
+      } catch {
+        return value;
+      }
+    }
+  }
+  return value;
+}
+function paramsFor(c, m, url, body, form, dev) {
+  const schemas = c.endpoint.inputSchema?.properties ?? {};
+  const props = (k) => Object.hasOwn(schemas, k) ? schemas[k] : void 0;
+  const params = {};
+  const set = (k, v) => {
+    if (k !== "__proto__") params[k] = v;
+  };
+  let callbackUrl;
+  let mocks;
+  if (c.route.method === "GET" || c.route.method === "DELETE") {
+    for (const [k, v] of url.searchParams) {
+      if (k === "async") continue;
+      if (k === "callbackUrl") {
+        callbackUrl = v;
+        continue;
+      }
+      set(k, coerce(v, props(k)));
+    }
+  } else {
+    for (const [k, v] of Object.entries(body)) {
+      if (k === "callbackUrl" && typeof v === "string") {
+        callbackUrl = v;
+        continue;
+      }
+      if (k === "mocks" && dev && typeof v === "object" && v !== null) {
+        mocks = v;
+        continue;
+      }
+      set(k, form && typeof v === "string" ? coerce(v, props(k)) : v);
+    }
+  }
+  c.keys.forEach((k, i) => {
+    set(k, coerce(decodeSegment(m[i + 1]), props(k)));
+  });
+  const missing = (c.endpoint.inputSchema?.required ?? []).filter((k) => !Object.hasOwn(params, k) || params[k] === void 0);
+  if (missing.length) throw new HttpError(400, "VALIDATION_ERROR", `missing parameter${missing.length === 1 ? "" : "s"}: ${missing.join(", ")}`, missing.map((k) => ({ path: k, message: "required" })));
+  for (const [k, v] of Object.entries(params)) {
+    const t = props(k)?.type;
+    if (t === "number" && typeof v !== "number") throw new HttpError(400, "VALIDATION_ERROR", `parameter ${k} must be a number`, [{ path: k, message: "must be a number" }]);
+    if (t === "boolean" && typeof v !== "boolean") throw new HttpError(400, "VALIDATION_ERROR", `parameter ${k} must be true or false`, [{ path: k, message: "must be a boolean" }]);
+    if (t === "string" && typeof v !== "string") throw new HttpError(400, "VALIDATION_ERROR", `parameter ${k} must be text`, [{ path: k, message: "must be a string" }]);
+  }
+  return { params, callbackUrl: c.route.callback ? callbackUrl : void 0, mocks };
+}
+
+// src/server/run-view.ts
+var CONTROL = /* @__PURE__ */ new Set(["onSuccess", "onFailure"]);
+function runView(id, base, l, rec) {
+  const links = { self: `${base}/runs/${id}`, events: `${base}/runs/${id}/events`, result: `${base}/runs/${id}/result` };
+  if (l && !rec) {
+    return l.error ? { runId: id, workflow: l.workflow, status: "failed", startedAt: new Date(l.startedAt).toISOString(), updatedAt: (/* @__PURE__ */ new Date()).toISOString(), params: l.params, error: { code: "EXECUTION_ERROR", message: l.error }, links } : { runId: id, workflow: l.workflow, status: "running", startedAt: new Date(l.startedAt).toISOString(), updatedAt: (/* @__PURE__ */ new Date()).toISOString(), params: l.params, links: { ...links, cancel: `${base}/runs/${id}/cancel` } };
+  }
+  if (l && rec) {
+    return { runId: id, workflow: rec.workflowName, status: "running", startedAt: rec.createdAt, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), params: rec.params, agent: rec.agent, links: { ...links, cancel: `${base}/runs/${id}/cancel` } };
+  }
+  if (!rec) return void 0;
+  const out = { runId: id, workflow: rec.workflowName, status: rec.status, startedAt: rec.createdAt, updatedAt: rec.updatedAt, params: rec.params, links };
+  if (rec.status === "waiting" && rec.gate) {
+    out.gate = { id: rec.gate.id, kind: rec.gate.kind, node: rec.gate.node, inputs: rec.gate.inputs, absent: rec.gate.absent, outputs: rec.gate.outputs, hasFailurePort: rec.gate.hasFailurePort };
+    if (rec.due) out.due = rec.due;
+    out.links = { ...links, resolve: `${base}/runs/${id}/resolve`, cancel: `${base}/runs/${id}/cancel` };
+  }
+  if (rec.agent) out.agent = rec.agent;
+  if (rec.status === "completed") out.result = rec.result;
+  if (rec.status === "failed") out.error = { code: "EXECUTION_ERROR", message: rec.error ?? "failed" };
+  return out;
+}
+function dataOf(result) {
+  if (typeof result !== "object" || result === null || Array.isArray(result)) return { data: { result }, failed: false };
+  const r = result;
+  const data = {};
+  for (const [k, v] of Object.entries(r)) if (!CONTROL.has(k)) data[k] = v;
+  return { data, failed: r.onFailure === true };
+}
+var statusFor = (run) => run.status === "completed" ? 200 : run.status === "failed" ? 500 : 202;
+
+// src/server/routes-declared.ts
+function stable(v) {
+  if (Array.isArray(v)) return `[${v.map(stable).join(",")}]`;
+  if (typeof v === "object" && v !== null) return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${stable(v[k])}`).join(",")}}`;
+  return JSON.stringify(v) ?? "null";
+}
+function idempotentRunId(scope, key) {
+  const h = createHash("sha256").update(`${scope}\0${key}`).digest("hex");
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-8${h.slice(17, 20)}-${h.slice(20, 32)}`;
+}
+async function answerDeclared(ctx, res, id, base, replayed, executionTime) {
+  const snap = await ctx.runs.snapshot(id, base);
+  const extra = { "X-Run-Id": id, ...replayed ? { "Idempotent-Replayed": "true" } : {} };
+  if (snap.status === "completed") {
+    const { data, failed } = dataOf(snap.result);
+    return json(res, failed ? 422 : 200, data, extra);
+  }
+  if (snap.status === "failed") return json(res, 500, { error: snap.error, runId: id, links: snap.links }, extra);
+  if (snap.status === "cancelled") return json(res, 410, { error: { code: "RUN_CANCELLED", message: "the run was cancelled" }, runId: id, links: snap.links }, extra);
+  if (executionTime !== void 0) snap.executionTime = executionTime;
+  return json(res, 202, snap, { ...extra, Location: snap.links.result, "Retry-After": "2" });
+}
+async function declaredRoute(ctx, req, res, c, m, url, base, given) {
+  const { coordinator, runs } = ctx;
+  if (c.route.auth !== "none" && !authorized(req, ctx.token)) throw new HttpError(401, "UNAUTHORIZED", "a bearer token is required");
+  const { body, form } = c.route.method === "GET" || c.route.method === "DELETE" ? { body: {}, form: false } : await readBody(req, given, ctx.maxBody);
+  const { params, callbackUrl, mocks } = paramsFor(c, m, url, body, form, ctx.dev);
+  if (callbackUrl) {
+    const why = await refuseCallbackUrl(callbackUrl, ctx.callbackPolicy);
+    if (why) throw new HttpError(400, "CALLBACK_REFUSED", `callbackUrl refused: ${why}`, [{ path: "callbackUrl", message: why }]);
+  }
+  const idem = header(req, "idempotency-key");
+  const id = idem ? idempotentRunId(`${c.route.method} ${c.route.path}`, idem) : randomUUID();
+  if (idem) {
+    const before = (await coordinator.record(id))?.params ?? runs.inFlightParams(id);
+    if (before) {
+      if (stable(before) !== stable(params)) throw new HttpError(409, "IDEMPOTENCY_MISMATCH", "this Idempotency-Key was already used with different parameters");
+      return answerDeclared(ctx, res, id, base, true);
+    }
+  }
+  runs.admit();
+  const started = Date.now();
+  const async = c.route.mode === "async" || wantsAsync(req, url);
+  const segment = runs.start(c.endpoint, id, params, mocks);
+  const noteWhenPossible = (async () => {
+    for (let i = 0; i < 50 && !await coordinator.record(id); i++) await new Promise((r) => setTimeout(r, 20));
+    if (!await coordinator.record(id)) return;
+    await coordinator.keep(id, "http", { route: { method: c.route.method, path: c.route.path }, ...callbackUrl ? { callbackUrl } : {} });
+    if (callbackUrl) runs.callbacks.owe(id);
+  })();
+  if (async) {
+    segment.catch(() => void 0);
+    void noteWhenPossible;
+    return json(res, 202, await runs.snapshot(id, base), { "X-Run-Id": id, Location: `${base}/runs/${id}/result` });
+  }
+  if (!await settledWithin(segment, waitBudget(req, ctx.maxWait))) {
+    void noteWhenPossible;
+    return answerDeclared(ctx, res, id, base, false, Date.now() - started);
+  }
+  await segment;
+  await noteWhenPossible;
+  void runs.callbacks.deliver(id);
+  return answerDeclared(ctx, res, id, base, false, Date.now() - started);
+}
+
+// src/server/routes-runs.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+async function answerSegment(ctx, req, res, id, url, base, started, segment) {
+  const { runs } = ctx;
+  if (wantsAsync(req, url)) {
+    segment.catch(() => void 0);
+    return json(res, 202, await runs.snapshot(id, base), { Location: `${base}/runs/${id}` });
+  }
+  if (await settledWithin(segment, waitBudget(req, ctx.maxWait))) await segment;
+  const snap = await runs.snapshot(id, base);
+  snap.executionTime = Date.now() - started;
+  return json(res, statusFor(snap), snap, snap.status === "running" ? { Location: snap.links.self, "Retry-After": "2" } : {});
+}
+async function legacyStart(ctx, req, res, endpoint, url, base, given) {
+  const { runs } = ctx;
+  const { body: b } = await readBody(req, given, ctx.maxBody);
+  const envelope = "params" in b && typeof b.params === "object" && b.params !== null && !Array.isArray(b.params) && Object.keys(b).every((k) => ["params", "mocks"].includes(k));
+  const params = envelope ? b.params : b;
+  const mocks = envelope && ctx.dev && typeof b.mocks === "object" && b.mocks !== null ? b.mocks : void 0;
+  runs.admit();
+  const id = randomUUID2();
+  const started = Date.now();
+  return answerSegment(ctx, req, res, id, url, base, started, runs.start(endpoint, id, params, mocks));
+}
+async function resolveRoute(ctx, req, res, id, url, base, given) {
+  const { runs } = ctx;
+  const { body: b } = await readBody(req, given, ctx.maxBody);
+  const hasAnswer = "answer" in b, hasReject = "reject" in b;
+  if (hasAnswer === hasReject) throw new HttpError(400, "INVALID_INPUT", "give exactly one of answer or reject");
+  const input = hasReject ? { reject: String(b.reject ?? "") } : { answer: b.answer };
+  runs.admit();
+  const started = Date.now();
+  return answerSegment(ctx, req, res, id, url, base, started, runs.resume(id, input));
+}
+async function serveRuns(ctx, req, res, method, p, url, base, given) {
+  const { runs, coordinator } = ctx;
+  if (method === "GET" && p === "/runs") {
+    json(res, 200, await runs.listRuns(url.searchParams.get("workflow") ?? void 0, base));
+    return true;
+  }
+  const m = p.match(/^\/runs\/([^/]+)(?:\/(events|resolve|cancel|agent|result))?$/);
+  if (!m) return false;
+  const id = m[1];
+  const snap = await runs.snapshot(id, base);
+  if (!snap) throw new HttpError(404, "RUN_NOT_FOUND", `no run with id ${id}`);
+  if (!m[2] && method === "GET") {
+    json(res, 200, snap);
+    return true;
+  }
+  if (m[2] === "result" && method === "GET") {
+    await answerDeclared(ctx, res, id, base, false);
+    return true;
+  }
+  if (m[2] === "events" && method === "GET") {
+    await runs.follow(req, res, id, base);
+    return true;
+  }
+  if (m[2] === "agent" && method === "GET") {
+    const rec = await coordinator.record(id);
+    const gateId = rec?.agent?.gateId;
+    const kept = gateId ? await coordinator.kept(id, transcriptName(gateId)) : void 0;
+    if (!kept) throw new HttpError(404, "NO_TRANSCRIPT", "no agent has answered this run");
+    json(res, 200, kept);
+    return true;
+  }
+  if (m[2] === "resolve" && method === "POST") {
+    await resolveRoute(ctx, req, res, id, url, base, given);
+    return true;
+  }
+  if (m[2] === "cancel" && method === "POST") {
+    await runs.cancel(id);
+    json(res, 200, await runs.snapshot(id, base));
+    return true;
+  }
+  throw new HttpError(405, "METHOD_NOT_ALLOWED", `${method} is not allowed here`);
+}
+
+// src/server/routes-catalog.ts
+function describeEndpoint(e) {
+  return { name: e.name, path: e.path, method: e.method, description: e.description, gates: e.gates, routes: e.routes ?? [], inputSchema: e.inputSchema, outputSchema: e.outputSchema };
+}
+function health(ctx) {
+  const { registry } = ctx;
+  return { status: "ok", timestamp: (/* @__PURE__ */ new Date()).toISOString(), workflows: registry.getAllEndpoints().length, uptime: registry.getUptime(), version: VERSION, auth: ctx.token ? "token" : "open", agents: ctx.agents, routes: ctx.mounted().compiled.length };
+}
+async function serveCatalog(ctx, req, res, method, p, url, base, given) {
+  const { registry } = ctx;
+  if (method === "GET" && p === "/health") {
+    json(res, 200, health(ctx));
+    return true;
+  }
+  if (method === "GET" && p === "/workflows") {
+    json(res, 200, { count: registry.getAllEndpoints().length, workflows: registry.getAllEndpoints().map(describeEndpoint), problems: ctx.mounted().problems });
+    return true;
+  }
+  if (method === "GET" && p === "/openapi.json") {
+    json(res, 200, ctx.openapi(void 0, base));
+    return true;
+  }
+  if (method === "GET" && p === "/docs") {
+    if (!ctx.docs) throw new HttpError(404, "NOT_FOUND", "docs are off. Start with --swagger, or docs: true");
+    html(res, swaggerPage(`${base}/openapi.json`));
+    return true;
+  }
+  const m = p.match(/^\/workflows\/([^/]+)$/);
+  if (!m) return false;
+  const endpoint = registry.getEndpoint(decodeSegment(m[1]));
+  if (!endpoint) throw new HttpError(404, "WORKFLOW_NOT_FOUND", `Workflow "${m[1]}" not found`);
+  if (method === "GET") {
+    json(res, 200, describeEndpoint(endpoint));
+    return true;
+  }
+  if (method === "POST") {
+    if (!ctx.legacy && (endpoint.routes?.length ?? 0) > 0) throw new HttpError(404, "USE_DECLARED_ROUTE", `use ${endpoint.routes.map((r) => `${r.method} ${r.path}`).join(" or ")}`);
+    if (!ctx.legacy) throw new HttpError(404, "NOT_AN_ENDPOINT", `${endpoint.name} declares no @http route`);
+    await legacyStart(ctx, req, res, endpoint, url, base, given);
+    return true;
+  }
+  throw new HttpError(405, "METHOD_NOT_ALLOWED", `${method} is not allowed here`);
+}
+function swaggerPage(specUrl) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Flow Weaver API Documentation</title>
+  <link rel="stylesheet" href="https://unpkg.com/swagger-ui-dist@5/swagger-ui.css">
+</head>
+<body>
+  <div id="swagger-ui"></div>
+  <script src="https://unpkg.com/swagger-ui-dist@5/swagger-ui-bundle.js"></script>
+  <script>
+    SwaggerUIBundle({ url: ${JSON.stringify(specUrl)}, dom_id: '#swagger-ui', presets: [SwaggerUIBundle.presets.apis, SwaggerUIBundle.SwaggerUIStandalonePreset], layout: 'BaseLayout' });
+  </script>
+</body>
+</html>`;
+}
+
+// src/server/run-driver.ts
+import * as path2 from "node:path";
+import * as fs3 from "node:fs";
+
+// src/console/schema.ts
+import * as fs2 from "node:fs";
+import { Project } from "ts-morph";
+var MAX_DEPTH = 4;
+var project;
+var loaded = /* @__PURE__ */ new Map();
+function source(file) {
+  project ??= new Project({ compilerOptions: { strict: true, skipLibCheck: true }, skipAddingFilesFromTsConfig: true });
+  const mtime = fs2.statSync(file).mtimeMs;
+  const existing = project.getSourceFile(file);
+  if (existing && loaded.get(file) === mtime) return existing;
+  if (existing) existing.refreshFromFileSystemSync();
+  const sf = existing ?? project.addSourceFileAtPath(file);
+  loaded.set(file, mtime);
+  return sf;
+}
+function toSchema(t, depth = 0) {
+  if (depth > MAX_DEPTH) return { type: "any", text: t.getText() };
+  if (t.isBoolean()) return { type: "boolean" };
+  if (t.isUnion()) {
+    const parts = t.getUnionTypes();
+    const real = parts.filter((p) => !p.isNull() && !p.isUndefined());
+    const optional = real.length !== parts.length;
+    if (real.length && real.every((p) => p.isBooleanLiteral())) return { type: "boolean", optional };
+    if (real.length && real.every((p) => p.isStringLiteral() || p.isNumberLiteral()))
+      return { type: "enum", values: real.map((p) => p.getLiteralValue()), optional };
+    if (real.length === 1) return { ...toSchema(real[0], depth), optional };
+    return { type: "any", text: t.getText(), optional };
+  }
+  if (t.isString()) return { type: "string" };
+  if (t.isNumber()) return { type: "number" };
+  if (t.isStringLiteral() || t.isNumberLiteral()) return { type: "enum", values: [t.getLiteralValue()] };
+  if (t.isArray()) return { type: "array", items: toSchema(t.getArrayElementTypeOrThrow(), depth + 1), text: t.getText() };
+  if (t.isObject()) {
+    const props = t.getProperties();
+    if (!props.length || t.getStringIndexType()) return { type: "object", text: t.getText() };
+    const fields = {};
+    for (const p of props) {
+      const decl = p.getDeclarations()[0];
+      const s = decl ? toSchema(p.getTypeAtLocation(decl), depth + 1) : { type: "any" };
+      fields[p.getName()] = { ...s, optional: s.optional || p.isOptional() };
+    }
+    return { type: "object", fields, text: t.getText() };
+  }
+  return { type: "any", text: t.getText() };
+}
+function gateOutputSchemas(ast, gateId, fallbackFile) {
+  const typeOf = (id) => {
+    const inst = ast.instances.find((i) => i.id === id);
+    return inst ? ast.nodeTypes.find((n) => n.name === inst.nodeType) ?? ast.nodeTypes.find((n) => n.functionName === inst.nodeType) : void 0;
+  };
+  const nt = typeOf(gateId);
+  const nodeFile = nt?.sourceLocation?.file ?? fallbackFile;
+  if (nt?.functionText) {
+    const own = nodeOutputSchema(nodeFile, nt.functionName);
+    if (own && Object.keys(own).length) return own;
+  }
+  const control = /* @__PURE__ */ new Set(["execute", "onSuccess", "onFailure"]);
+  const out = {};
+  for (const conn of ast.connections) {
+    if (conn.from.node !== gateId || control.has(conn.from.port)) continue;
+    const targetType = typeOf(conn.to.node);
+    if (!targetType?.functionText) continue;
+    const schema = nodeInputSchema(targetType.sourceLocation?.file ?? fallbackFile, targetType.functionName, conn.to.port);
+    if (schema) out[conn.from.port] = schema;
+  }
+  return Object.keys(out).length ? out : null;
+}
+function workflowParamsSchema(file, fnName) {
+  try {
+    const params = source(file).getFunction(fnName)?.getParameters()[1]?.getType();
+    if (!params) return null;
+    const s = toSchema(params);
+    return s.type === "object" && s.fields ? s.fields : null;
+  } catch {
+    return null;
+  }
+}
+function nodeInputSchema(file, fnName, paramName) {
+  try {
+    const fn = source(file).getFunction(fnName);
+    if (!fn) return null;
+    const params = fn.getParameters();
+    const param = params.find((p) => p.getName() === paramName);
+    if (!param) return null;
+    const s = toSchema(param.getType());
+    return { ...s, optional: s.optional || param.hasQuestionToken() };
+  } catch {
+    return null;
+  }
+}
+function nodeOutputSchema(file, fnName) {
+  try {
+    const fn = source(file).getFunction(fnName);
+    if (!fn) return null;
+    let ret = fn.getReturnType();
+    if (ret.getSymbol()?.getName() === "Promise") ret = ret.getTypeArguments()[0];
+    const s = toSchema(ret);
+    if (s.type !== "object" || !s.fields) return null;
+    const { onSuccess: _s, onFailure: _f, ...data } = s.fields;
+    return data;
+  } catch {
+    return null;
+  }
+}
+
+// src/server/callback-delivery.ts
+import { createHmac } from "node:crypto";
+var CALLBACK_BACKOFF_MS = [2e3, 1e4, 6e4, 3e5, 9e5];
+var ATTEMPT_TIMEOUT_MS = 1e4;
+function createCallbackDelivery(opts) {
+  const { coordinator } = opts;
+  const now = opts.now ?? Date.now;
+  const pending = /* @__PURE__ */ new Set();
+  const delivering = /* @__PURE__ */ new Set();
+  function bodyFor(rec) {
+    const body = { runId: rec.runId, workflow: rec.workflowName, status: rec.status };
+    if (rec.status === "completed") {
+      const { data, failed } = opts.outputs(rec.result);
+      body.result = data;
+      body.failed = failed;
+    }
+    if (rec.status === "failed") body.error = { code: "EXECUTION_ERROR", message: rec.error };
+    return body;
+  }
+  async function deliver(id) {
+    const note = await coordinator.kept(id, "http");
+    if (!note?.callbackUrl || note.delivered || note.gaveUp) {
+      pending.delete(id);
+      return;
+    }
+    const rec = await coordinator.record(id);
+    if (!rec) {
+      pending.delete(id);
+      return;
+    }
+    if (rec.status === "waiting" || opts.inFlight(id)) {
+      pending.add(id);
+      return;
+    }
+    if (note.nextAt && Date.parse(note.nextAt) > now()) {
+      pending.add(id);
+      return;
+    }
+    if (delivering.has(id)) return;
+    delivering.add(id);
+    const attempt = (note.attempts ?? 0) + 1;
+    try {
+      const text = JSON.stringify(bodyFor(rec));
+      const headers = { "Content-Type": "application/json", "X-Flow-Weaver-Run": id, "X-Flow-Weaver-Status": rec.status, "X-Flow-Weaver-Attempt": String(attempt) };
+      if (opts.token) headers["X-Flow-Weaver-Signature"] = `sha256=${createHmac("sha256", opts.token).update(text).digest("hex")}`;
+      let error = "";
+      let status;
+      try {
+        const target = await callbackTarget(note.callbackUrl, opts.policy);
+        if ("refused" in target) throw new Error(`callbackUrl refused at delivery: ${target.refused}`);
+        status = await postCallback(target, headers, text, ATTEMPT_TIMEOUT_MS);
+        if (status >= 200 && status < 300) {
+          await coordinator.keep(id, "http", { ...note, attempts: attempt, delivered: new Date(now()).toISOString() });
+          pending.delete(id);
+          opts.onCallback?.({ runId: id, url: note.callbackUrl, ok: true, status, attempt });
+          return;
+        }
+        error = status >= 300 && status < 400 ? `callback answered ${status}, redirects are not followed` : `callback answered ${status}`;
+      } catch (e) {
+        error = getErrorMessage(e);
+      }
+      const gaveUp = attempt >= CALLBACK_BACKOFF_MS.length;
+      const next = { ...note, attempts: attempt, lastError: error, ...gaveUp ? { gaveUp: new Date(now()).toISOString() } : { nextAt: new Date(now() + CALLBACK_BACKOFF_MS[attempt - 1]).toISOString() } };
+      if (await coordinator.record(id)) await coordinator.keep(id, "http", next);
+      if (gaveUp) pending.delete(id);
+      else pending.add(id);
+      opts.onCallback?.({ runId: id, url: note.callbackUrl, ok: false, status, error, attempt, gaveUp });
+    } finally {
+      delivering.delete(id);
+    }
+  }
+  return {
+    deliver,
+    /** A run now owes a callback: remember it, and try at once. */
+    owe(id) {
+      pending.add(id);
+      void deliver(id);
+    },
+    /** Find the runs of these workflows that still owe a callback, as when the API starts. */
+    async scan(workflowNames) {
+      for (const s of await coordinator.list()) {
+        if (!workflowNames.has(s.workflowName)) continue;
+        const note = await coordinator.kept(s.runId, "http");
+        if (note?.callbackUrl && !note.delivered && !note.gaveUp) pending.add(s.runId);
+      }
+    },
+    /** Try every callback still owed. */
+    async deliverPending() {
+      for (const id of [...pending]) await deliver(id);
+    },
+    /** The runs still owing a callback. */
+    pending: () => [...pending]
+  };
+}
+
+// src/server/run-driver.ts
+function createRunDriver(opts) {
+  const { dir, coordinator } = opts;
+  const live = /* @__PURE__ */ new Map();
+  const agentEvents = /* @__PURE__ */ new Map();
+  const subs = /* @__PURE__ */ new Map();
+  let profilesCache;
+  const callbacks = createCallbackDelivery({
+    coordinator,
+    policy: opts.callbacks,
+    token: opts.token,
+    inFlight: (id) => live.has(id),
+    outputs: (result) => dataOf(result),
+    onCallback: opts.onCallback
+  });
+  function profiles() {
+    const file = path2.join(dir, ".flowweaver", "agents.yaml");
+    let mtime;
+    try {
+      mtime = fs3.statSync(file).mtimeMs;
+    } catch {
+      mtime = 0;
+    }
+    if (!profilesCache || profilesCache.mtime !== mtime) profilesCache = { mtime, profiles: loadAgentProfiles(dir) };
+    return profilesCache.profiles;
+  }
+  async function snapshot(id, base = "") {
+    const l = live.get(id);
+    const rec = await coordinator.record(id);
+    return runView(id, base, l, rec);
+  }
+  async function listRuns(workflow, base) {
+    const seen = /* @__PURE__ */ new Set();
+    const runs = [];
+    for (const l of live.values()) {
+      if (workflow && l.workflow !== workflow) continue;
+      const s = await snapshot(l.id, base);
+      if (s) {
+        runs.push(s);
+        seen.add(l.id);
+      }
+    }
+    const names = opts.workflowNames();
+    for (const r of await coordinator.list()) {
+      if (seen.has(r.runId) || !names.has(r.workflowName)) continue;
+      if (workflow && r.workflowName !== workflow) continue;
+      const s = await snapshot(r.runId, base);
+      if (s) runs.push(s);
+    }
+    runs.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+    return { count: runs.length, runs };
+  }
+  function push(id, msg) {
+    const set = subs.get(id);
+    if (!set?.size) return;
+    const line = `data: ${JSON.stringify(msg)}
+
+`;
+    for (const res of set) res.write(line);
+  }
+  async function announce(id) {
+    const run = await snapshot(id);
+    push(id, { type: "run", run });
+    if (run) {
+      try {
+        opts.onRun?.(run);
+      } catch {
+      }
+    }
+  }
+  async function drive(l, segment) {
+    live.set(l.id, l);
+    const onEvent = (ev) => {
+      const entry = { t: ev.timestamp, e: ev.data ?? ev };
+      l.events.push(entry);
+      push(l.id, { type: "event", ...entry });
+    };
+    try {
+      await segment(l, onEvent);
+      live.delete(l.id);
+    } catch (err) {
+      if (await coordinator.record(l.id)) live.delete(l.id);
+      else l.error = getErrorMessage(err);
+    }
+    await announce(l.id);
+    void afterSegment(l.id);
+  }
+  async function afterSegment(id) {
+    const rec = await coordinator.record(id);
+    if (!rec) return;
+    if (rec.status === "completed" || rec.status === "failed" || rec.status === "cancelled") {
+      void callbacks.deliver(id);
+      return;
+    }
+    if (!opts.agents || rec.status !== "waiting" || rec.gate?.kind !== "agent") return;
+    try {
+      const step = await answerAgentGate(coordinator, id, {
+        projectDir: dir,
+        env: opts.env,
+        profiles: profiles(),
+        provider: opts.agentProvider,
+        outputSchema: (r) => outputShape(r),
+        onEvent: (e) => {
+          const entry = { t: Date.now(), e };
+          (agentEvents.get(id) ?? agentEvents.set(id, []).get(id)).push(entry);
+          push(id, { ...e, t: entry.t });
+        }
+      });
+      await announce(id);
+      if (step.kind === "answer") await resume(id, { answer: step.answer });
+      else if (step.kind === "reject") await resume(id, { reject: step.reason });
+    } catch (err) {
+      if (await noteAnswerMisfit(coordinator, id, err)) await announce(id);
+    }
+  }
+  async function outputShape(rec) {
+    try {
+      const parsed = await parseWorkflow(rec.filePath, { workflowName: rec.workflowName, projectDir: path2.dirname(rec.filePath) });
+      if (parsed.errors.length || !rec.gate) return void 0;
+      const inst = parsed.ast.instances.find((i) => i.id === rec.gate.node);
+      const nt = inst ? parsed.ast.nodeTypes.find((n) => n.name === inst.nodeType) ?? parsed.ast.nodeTypes.find((n) => n.functionName === inst.nodeType) : void 0;
+      const types = Object.fromEntries(rec.gate.outputs.map((o) => [o, nt?.outputs?.[o]?.tsType ?? "unknown"]));
+      return { schema: gateOutputSchemas(parsed.ast, rec.gate.node, rec.filePath), types };
+    } catch {
+      return void 0;
+    }
+  }
+  function admit() {
+    if (live.size >= opts.maxInFlight) throw new HttpError(503, "BUSY", `${live.size} runs are in flight, the limit here. Try again shortly`, void 0, { "Retry-After": "2" });
+  }
+  async function start(endpoint, id, params, mocks) {
+    await drive({ id, workflow: endpoint.name, params, startedAt: Date.now(), events: [], abort: new AbortController() }, (l, onEvent) => coordinator.start(
+      { filePath: endpoint.filePath, workflowName: endpoint.functionName, params, runId: id, mocks, agents: opts.agents ? "auto" : "manual", origin: opts.origin ?? "http" },
+      { onEvent, trace: opts.trace === true, abortSignal: l.abort.signal }
+    ));
+  }
+  async function resume(id, input) {
+    if (live.has(id)) throw new HttpError(409, "RUN_IN_FLIGHT", "the run is already resuming");
+    const rec = await coordinator.record(id);
+    if (rec?.gate && isAnswering(rec.agent, rec.gate.id)) throw new HttpError(409, "AGENT_ANSWERING", `agent profile ${rec.agent.profile} is answering this gate`);
+    const resolve2 = "reject" in input ? { reject: input.reject } : { answer: input.answer };
+    await coordinator.checkResume({ runId: id, input: resolve2 });
+    if (!rec) throw new RunNotFoundError(id);
+    await drive({ id, workflow: rec.workflowName, params: rec.params, startedAt: Date.parse(rec.createdAt), events: [], abort: new AbortController() }, (l, onEvent) => coordinator.resume({ runId: id, input: resolve2 }, { onEvent, trace: opts.trace === true, abortSignal: l.abort.signal }));
+  }
+  async function cancel(id) {
+    const l = live.get(id);
+    if (l) {
+      l.abort.abort();
+      return;
+    }
+    if ((await coordinator.record(id))?.status === "waiting") {
+      await coordinator.cancel(id);
+      await announce(id);
+      void callbacks.deliver(id);
+    }
+  }
+  async function tick() {
+    let moved;
+    try {
+      moved = await coordinator.tick();
+    } catch {
+      return;
+    }
+    for (const run of [...moved.woke, ...moved.timedOut]) {
+      await announce(run.runId);
+      await afterSegment(run.runId);
+    }
+  }
+  async function follow(req, res, id, base) {
+    const first = await snapshot(id, base);
+    const kept = await coordinator.trace(id);
+    res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" });
+    res.write(`data: ${JSON.stringify({ type: "run", run: first })}
+
+`);
+    const entries = [];
+    for (const e of [...kept, ...live.get(id)?.events ?? []]) entries.push({ t: e.t, line: JSON.stringify({ type: "event", ...e }) });
+    for (const a of agentEvents.get(id) ?? []) entries.push({ t: a.t, line: JSON.stringify({ ...a.e, t: a.t }) });
+    entries.sort((a, b) => a.t - b.t);
+    for (const e of entries) res.write(`data: ${e.line}
+
+`);
+    res.write(`data: ${JSON.stringify({ type: "synced" })}
+
+`);
+    const set = subs.get(id) ?? subs.set(id, /* @__PURE__ */ new Set()).get(id);
+    set.add(res);
+    req.on("close", () => {
+      set.delete(res);
+      if (!set.size) subs.delete(id);
+    });
+  }
+  return {
+    callbacks,
+    admit,
+    start,
+    resume,
+    cancel,
+    tick,
+    snapshot,
+    listRuns,
+    follow,
+    /** The parameters of a run this process is driving, before the store has its record. */
+    inFlightParams: (id) => live.get(id)?.params,
+    /** Stop what is in flight and end every stream. */
+    close() {
+      for (const l of live.values()) l.abort.abort();
+      for (const set of subs.values()) for (const res of set) res.end();
+      subs.clear();
+    }
+  };
+}
+
+// src/server/transport.ts
+async function fetchAdapter(handle, request3, opts) {
+  const url = new URL(request3.url);
+  const headers = {};
+  request3.headers.forEach((v, k) => {
+    headers[k.toLowerCase()] = v;
+  });
+  const closeListeners = [];
+  request3.signal?.addEventListener("abort", () => closeListeners.forEach((f) => f()));
+  const req = {
+    method: request3.method,
+    url: url.pathname + url.search,
+    headers,
+    async *[Symbol.asyncIterator]() {
+      if (!request3.body) return;
+      const reader = request3.body.getReader();
+      for (; ; ) {
+        const { value, done } = await reader.read();
+        if (done) return;
+        yield value;
+      }
+    },
+    on: (_e, l) => closeListeners.push(l)
+  };
+  const encoder = new TextEncoder();
+  let controller;
+  let status = 200;
+  const outHeaders = new Headers();
+  let resolveResponse;
+  const response = new Promise((r) => {
+    resolveResponse = r;
+  });
+  const stream = new ReadableStream({ start(c) {
+    controller = c;
+  }, cancel() {
+    closeListeners.forEach((f) => f());
+  } });
+  let sent = false, ended = false;
+  const send = () => {
+    if (sent) return;
+    sent = true;
+    resolveResponse(new Response(status === 204 || status === 304 ? null : stream, { status, headers: outHeaders }));
+  };
+  const res = {
+    get headersSent() {
+      return sent;
+    },
+    writeHead(s, h) {
+      status = s;
+      for (const [k, v] of Object.entries(h ?? {})) outHeaders.set(k, String(v));
+      send();
+      return this;
+    },
+    setHeader(k, v) {
+      outHeaders.set(k, v);
+      return this;
+    },
+    write(chunk) {
+      send();
+      controller?.enqueue(encoder.encode(chunk));
+      return true;
+    },
+    end(chunk) {
+      if (ended) return this;
+      if (chunk) this.write(chunk);
+      send();
+      ended = true;
+      try {
+        controller?.close();
+      } catch {
+      }
+      return this;
+    }
+  };
+  void handle(req, res, opts).then((handled) => {
+    if (!handled && !sent) {
+      status = 404;
+      outHeaders.set("Content-Type", "application/json");
+      res.end(JSON.stringify({ error: { code: "NOT_FOUND", message: `no route for ${request3.method} ${url.pathname}` } }));
+    } else if (!ended) res.end();
+  }).catch((err) => {
+    if (!sent) {
+      status = 500;
+      res.end(JSON.stringify({ error: { code: "INTERNAL", message: getErrorMessage(err) } }));
+    } else res.end();
+  });
+  return response;
+}
+
+// src/server/api.ts
+var DEFAULT_MAX_BODY = 1024 * 1024;
+function createWorkflowApi(options) {
+  const dir = path3.resolve(options.dir);
+  const registry = new WorkflowRegistry(dir);
+  const coordinator = createLocalCoordinator(options.store ? { store: options.store } : { rootDir: options.runsDir ?? defaultRunsDir(dir) });
+  let compiled = [];
+  let routeProblems = [];
+  let readyPromise;
+  const legacy = options.legacyRoutes !== false;
+  const agentsOn = options.agents !== false;
+  const runs = createRunDriver({
+    dir,
+    coordinator,
+    workflowNames: () => new Set(registry.getAllEndpoints().map((e) => e.functionName)),
+    agents: agentsOn,
+    env: options.env,
+    agentProvider: options.agentProvider,
+    trace: options.trace,
+    origin: options.origin,
+    maxInFlight: options.maxInFlight ?? 32,
+    onRun: options.onRun,
+    callbacks: options.callbacks,
+    token: options.token,
+    onCallback: options.onCallback
+  });
+  let sweeper;
+  const ctx = {
+    registry,
+    coordinator,
+    runs,
+    token: options.token,
+    dev: options.dev,
+    docs: options.docs,
+    legacy,
+    agents: agentsOn,
+    maxBody: options.maxBodyBytes ?? DEFAULT_MAX_BODY,
+    maxWait: options.maxWaitMs ?? 6e4,
+    callbackPolicy: options.callbacks,
+    mounted: () => ({ compiled, problems: routeProblems }),
+    openapi: (serverUrl, base) => openapi(serverUrl, base)
+  };
+  function compileRoutes() {
+    ({ compiled, problems: routeProblems } = mountRoutes(registry.getAllEndpoints()));
+  }
+  async function ready() {
+    readyPromise ??= (async () => {
+      await registry.initialize();
+      compileRoutes();
+      if (options.watch) await registry.startWatching(compileRoutes);
+      await reclaimStaleAgentAnswers(coordinator);
+      await runs.callbacks.scan(new Set(registry.getAllEndpoints().map((e) => e.functionName)));
+      const every = options.callbacks?.sweepMs ?? 3e3;
+      sweeper = setInterval(() => {
+        void sweep();
+      }, every);
+      sweeper.unref?.();
+    })();
+    return readyPromise;
+  }
+  async function sweep() {
+    await runs.tick();
+    await runs.callbacks.deliverPending();
+  }
+  async function handle(req, res, opts = {}) {
+    await ready();
+    const base = (opts.basePath ?? "").replace(/\/$/, "");
+    const url = new URL(req.url ?? "/", "http://x");
+    let p = url.pathname;
+    if (base && p.startsWith(base)) p = p.slice(base.length) || "/";
+    const method = (req.method ?? "GET").toUpperCase();
+    try {
+      for (const c of compiled) {
+        if (c.route.method !== method) continue;
+        const m = p.match(c.regex);
+        if (!m) continue;
+        cors(req, res, options.cors);
+        await declaredRoute(ctx, req, res, c, m, url, base, opts.body);
+        return true;
+      }
+      if (method === "OPTIONS" && (compiled.some((c) => p.match(c.regex)) || isReserved(p))) {
+        cors(req, res, options.cors);
+        res.writeHead(204);
+        res.end();
+        return true;
+      }
+      if (!isReserved(p)) return false;
+      cors(req, res, options.cors);
+      const open = p === "/health" || options.docs && (p === "/docs" || p === "/openapi.json");
+      if (!open && !authorized(req, options.token)) throw new HttpError(401, "UNAUTHORIZED", "a bearer token is required");
+      if (await serveCatalog(ctx, req, res, method, p, url, base, opts.body)) return true;
+      if (await serveRuns(ctx, req, res, method, p, url, base, opts.body)) return true;
+      throw new HttpError(404, "NOT_FOUND", `no route for ${method} ${p}`);
+    } catch (err) {
+      const e = errorToHttp(err);
+      const body = { error: { code: e.code, message: e.message, ...e.details !== void 0 ? { details: e.details } : {}, ...options.dev && err instanceof Error && err.stack ? { stack: err.stack } : {} } };
+      if (!res.headersSent) json(res, e.status, body, e.headers ?? {});
+      else res.end();
+      return true;
+    }
+  }
+  function openapi(serverUrl, base = "") {
+    return buildOpenApi({ endpoints: registry.getAllEndpoints(), mounted: compiled.map((c) => ({ endpoint: c.endpoint, route: c.route, keys: c.keys })), legacy, secured: !!options.token, serverUrl, base });
+  }
+  const api = {
+    ready,
+    handle,
+    node: () => (req, res) => {
+      handle(req, res).then((handled) => {
+        if (!handled && !res.headersSent) json(res, 404, { error: { code: "NOT_FOUND", message: `no route for ${req.method} ${req.url}` } });
+      }).catch((err) => {
+        if (!res.headersSent) json(res, 500, { error: { code: "INTERNAL", message: getErrorMessage(err) } });
+      });
+    },
+    express: () => (req, res, next) => {
+      handle(req, res, { basePath: req.baseUrl ?? "" }).then((handled) => {
+        if (!handled) next();
+      }).catch(next);
+    },
+    fetch: (request3, opts) => fetchAdapter(handle, request3, opts),
+    openapi: (serverUrl) => openapi(serverUrl),
+    routes: () => ({
+      routes: compiled.map((c) => ({ method: c.route.method, path: c.route.path, workflow: c.endpoint.name, file: c.endpoint.filePath, mode: c.route.mode ?? "sync", auth: c.route.auth ?? "bearer", callback: !!c.route.callback, gates: c.endpoint.gates ?? 0 })),
+      problems: routeProblems
+    }),
+    endpoints: () => registry.getAllEndpoints(),
+    deliverCallbacks: sweep,
+    tick: runs.tick,
+    close: async () => {
+      if (sweeper) clearInterval(sweeper);
+      sweeper = void 0;
+      await registry.stopWatching();
+      runs.close();
+    }
+  };
+  return api;
+}
+
+export {
+  WorkflowRegistry,
+  buildOpenApi,
+  isLoopback,
+  RESERVED_PATHS,
+  planRoutes,
+  gateOutputSchemas,
+  workflowParamsSchema,
+  createWorkflowApi
+};