@xyne/workflow-sdk 3.2.15 → 3.2.16

package/dist/router/workflow-router.js

@@ -27,6 +27,7 @@ import { OPERATOR_DESCRIPTORS } from '../types/operators.js';
 import { getAvailableContext } from '../engine/available-context.js';
 import { isExecutable } from '../common/executable-check.js';
 import { createEventChannel } from '../runtime/execution-event-bus.js';
+import { AccessDeniedError, ResourceNotFoundError } from '../authz/default.js';
 // ─── Helpers ───
 function ok(body) {
     return { status: 200, body };
@@ -43,16 +44,22 @@ function badRequest(msg) {
 function error(status, msg) {
     return { status, body: { error: msg } };
 }
-function authMetadata(auth) {
-    return auth?.metadata ?? {};
-}
 /** Format a single SSE message. */
 function formatSSE(event, data) {
     return `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
 }
 // ─── Router Factory ───
-export function createWorkflowRouter(runtime, _opts) {
+export function createWorkflowRouter(
+// `any` for services: the router never touches TServices, only forwards ctx.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+runtime, 
+// `authenticate` is invoked by the host glue, not the factory (see file header).
+_opts) {
     const routes = [];
+    // Authenticated route handlers always receive a resolved ctx — the host runs
+    // `authenticate` before dispatch. Unauthenticated routes never forward `auth`
+    // to a guarded runtime call, so this narrowing is sound.
+    const asCtx = (auth) => auth;
     // ─── Workflow CRUD ───
     routes.push({
         method: 'GET',
@@ -66,7 +73,7 @@ export function createWorkflowRouter(runtime, _opts) {
                 filter.limit = Number(q['limit']);
             if (typeof q['offset'] === 'string')
                 filter.offset = Number(q['offset']);
-            const workflows = await runtime.listWorkflows(authMetadata(auth), filter);
+            const workflows = await runtime.listWorkflows(asCtx(auth), filter);
             return ok({ workflows });
         },
     });
@@ -76,27 +83,25 @@ export function createWorkflowRouter(runtime, _opts) {
         method: 'GET',
         path: '/workflows/counts',
         handler: async (_req, auth) => {
-            const counts = await runtime.workflowCounts(authMetadata(auth));
+            const counts = await runtime.workflowCounts(asCtx(auth));
             return ok(counts);
         },
     });
     routes.push({
         method: 'GET',
         path: '/workflows/:id',
-        handler: async (req) => {
+        handler: async (req, auth) => {
             const id = req.params['id'];
             if (!id)
                 return badRequest('Missing workflow ID');
-            const workflow = await runtime.getWorkflow(id);
-            if (!workflow)
-                return notFound(`Workflow ${id} not found`);
-            return ok(workflow);
+            // Missing → ResourceNotFoundError → 404 at the wrapper below.
+            return ok(await runtime.getWorkflow(asCtx(auth), id));
         },
     });
     routes.push({
         method: 'POST',
         path: '/workflows',
-        handler: async (req, _auth) => {
+        handler: async (req, auth) => {
             const body = req.body;
             if (!body || !body['name'] || !body['config']) {
                 return badRequest('Body must contain "name" and "config"');
@@ -105,16 +110,19 @@ export function createWorkflowRouter(runtime, _opts) {
                 return badRequest('Body must contain a "folderId" (every workflow belongs to a folder)');
             }
             try {
-                const workflow = await runtime.createWorkflow({
+                const workflow = await runtime.createWorkflow(asCtx(auth), {
                     name: body['name'],
                     config: body['config'],
                     metadata: body['metadata'] ?? undefined,
                     summary: typeof body['summary'] === 'string' ? body['summary'] : null,
                     folderId: body['folderId'],
+                    attributes: body['attributes'],
                 });
                 return created(workflow);
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 return error(400, err instanceof Error ? err.message : 'Create failed');
             }
         },
@@ -122,7 +130,7 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'PUT',
         path: '/workflows/:id',
-        handler: async (req, _auth) => {
+        handler: async (req, auth) => {
             const id = req.params['id'];
             if (!id)
                 return badRequest('Missing workflow ID');
@@ -142,10 +150,12 @@ export function createWorkflowRouter(runtime, _opts) {
                 }
                 if (typeof body['folderId'] === 'string')
                     input.folderId = body['folderId'];
-                const workflow = await runtime.updateWorkflow(id, input);
+                const workflow = await runtime.updateWorkflow(asCtx(auth), id, input);
                 return ok(workflow);
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 if (err instanceof Error && err.message.includes('not found')) {
                     return notFound(err.message);
                 }
@@ -158,10 +168,31 @@ export function createWorkflowRouter(runtime, _opts) {
         method: 'GET',
         path: '/folders',
         handler: async (_req, auth) => {
-            const folders = await runtime.listFolders(authMetadata(auth));
+            const folders = await runtime.listFolders(asCtx(auth));
             return ok({ folders });
         },
     });
+    routes.push({
+        method: 'GET',
+        path: '/folders/:id',
+        handler: async (req, auth) => {
+            const id = req.params['id'];
+            if (!id)
+                return badRequest('Missing folder ID');
+            // Missing → ResourceNotFoundError → 404 at the wrapper below.
+            return ok(await runtime.getFolder(asCtx(auth), id));
+        },
+    });
+    // What may this caller do at the top level? Folder and workflow rows carry
+    // their own `permittedActions`, but a root-level "New folder" button has no
+    // row to read — this is that decision, and it is the same one create enforces.
+    routes.push({
+        method: 'GET',
+        path: '/capabilities',
+        handler: async (_req, auth) => {
+            return ok({ permittedActions: await runtime.capabilities(asCtx(auth)) });
+        },
+    });
     routes.push({
         method: 'POST',
         path: '/folders',
@@ -172,14 +203,17 @@ export function createWorkflowRouter(runtime, _opts) {
             }
             const parentId = typeof body['parentId'] === 'string' ? body['parentId'] : null;
             try {
-                const folder = await runtime.createFolder({
+                const folder = await runtime.createFolder(asCtx(auth), {
                     name: body['name'],
-                    metadata: authMetadata(auth),
+                    ...(body['metadata'] ? { metadata: body['metadata'] } : {}),
                     parentId,
+                    attributes: body['attributes'],
                 });
                 return created(folder);
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 return error(400, err instanceof Error ? err.message : 'Create failed');
             }
         },
@@ -187,7 +221,7 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'PUT',
         path: '/folders/:id',
-        handler: async (req) => {
+        handler: async (req, auth) => {
             const id = req.params['id'];
             if (!id)
                 return badRequest('Missing folder ID');
@@ -201,10 +235,12 @@ export function createWorkflowRouter(runtime, _opts) {
                 update.parentId = typeof body['parentId'] === 'string' ? body['parentId'] : null;
             }
             try {
-                await runtime.updateFolder(id, update);
+                await runtime.updateFolder(asCtx(auth), id, update);
                 return ok({ updated: true });
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 return error(400, err instanceof Error ? err.message : 'Update failed');
             }
         },
@@ -217,10 +253,12 @@ export function createWorkflowRouter(runtime, _opts) {
             if (!id)
                 return badRequest('Missing folder ID');
             try {
-                await runtime.deleteFolder(id, authMetadata(auth));
+                await runtime.deleteFolder(asCtx(auth), id);
                 return ok({ deleted: true });
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 const msg = err instanceof Error ? err.message : 'Delete failed';
                 // Folder still holds workflows — conflict, not a generic failure.
                 if (msg.includes('not empty'))
@@ -242,10 +280,12 @@ export function createWorkflowRouter(runtime, _opts) {
             if (folders.length === 0 && workflows.length === 0)
                 return badRequest('Nothing to move');
             try {
-                await runtime.moveBatch(authMetadata(auth), { folders, workflows });
+                await runtime.moveBatch(asCtx(auth), { folders, workflows });
                 return ok({ moved: folders.length + workflows.length });
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 return error(400, err instanceof Error ? err.message : 'Move failed');
             }
         },
@@ -267,15 +307,17 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'POST',
         path: '/workflows/:id/activate',
-        handler: async (req, _auth) => {
+        handler: async (req, auth) => {
             const id = req.params['id'];
             if (!id)
                 return badRequest('Missing workflow ID');
             try {
-                await runtime.activateWorkflow(id);
+                await runtime.activateWorkflow(asCtx(auth), id);
                 return ok({ activated: true });
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 return error(400, err instanceof Error ? err.message : 'Activation failed');
             }
         },
@@ -283,15 +325,17 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'POST',
         path: '/workflows/:id/deactivate',
-        handler: async (req, _auth) => {
+        handler: async (req, auth) => {
             const id = req.params['id'];
             if (!id)
                 return badRequest('Missing workflow ID');
             try {
-                await runtime.deactivateWorkflow(id);
+                await runtime.deactivateWorkflow(asCtx(auth), id);
                 return ok({ deactivated: true });
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 return error(400, err instanceof Error ? err.message : 'Deactivation failed');
             }
         },
@@ -300,16 +344,18 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'POST',
         path: '/workflows/:id/trigger',
-        handler: async (req, _auth) => {
+        handler: async (req, auth) => {
             const id = req.params['id'];
             if (!id)
                 return badRequest('Missing workflow ID');
             try {
                 const payload = req.body ?? {};
-                const executionId = await runtime.triggerManual(id, payload);
+                const executionId = await runtime.triggerManual(asCtx(auth), id, payload);
                 return created({ executionId });
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 if (err instanceof Error && err.message.includes('not found')) {
                     return notFound(err.message);
                 }
@@ -321,7 +367,8 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'POST',
         path: '/uploads',
-        handler: async (req, auth) => {
+        // TODO(uploads): guard/scope via the authorizer once uploads are ACL-modeled.
+        handler: async (req, _auth) => {
             if (!runtime.storage) {
                 return error(501, 'No StorageAdapter configured — file uploads are disabled');
             }
@@ -340,7 +387,10 @@ export function createWorkflowRouter(runtime, _opts) {
                     }
                 }
             }
-            const scope = auth?.metadata ?? {};
+            // TODO(uploads): uploads are not yet ACL-scoped. The storage scope must be
+            // produceable from BOTH a caller (here) and a workflow (execution-time
+            // writes have no caller) — designed in the uploads pass. Empty for now.
+            const scope = {};
             try {
                 const attachments = [];
                 for (const file of files) {
@@ -353,6 +403,8 @@ export function createWorkflowRouter(runtime, _opts) {
                 return created({ attachments });
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 return error(500, err instanceof Error ? err.message : 'Upload failed');
             }
         },
@@ -394,6 +446,8 @@ export function createWorkflowRouter(runtime, _opts) {
                 };
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 return error(500, err instanceof Error ? err.message : 'Download failed');
             }
         },
@@ -403,20 +457,20 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'GET',
         path: '/executions/pending-approvals',
-        handler: async (req) => {
+        handler: async (req, auth) => {
             const limit = typeof req.query['limit'] === 'string' ? Number(req.query['limit']) : undefined;
-            const items = await runtime.listPendingApprovals(limit);
+            const items = await runtime.listPendingApprovals(asCtx(auth), limit);
             return ok({ items });
         },
     });
     routes.push({
         method: 'GET',
         path: '/executions/:execId',
-        handler: async (req) => {
+        handler: async (req, auth) => {
             const execId = req.params['execId'];
             if (!execId)
                 return badRequest('Missing execution ID');
-            const detail = await runtime.getExecutionDetail(execId);
+            const detail = await runtime.getExecutionDetail(asCtx(auth), execId);
             if (!detail)
                 return notFound(`Execution ${execId} not found`);
             return ok({
@@ -426,13 +480,14 @@ export function createWorkflowRouter(runtime, _opts) {
                 triggerData: detail.triggerData,
                 summary: detail.summary,
                 name: detail.name,
+                permittedActions: detail.permittedActions,
             });
         },
     });
     routes.push({
         method: 'POST',
         path: '/executions/:execId/resume',
-        handler: async (req, _auth) => {
+        handler: async (req, auth) => {
             const execId = req.params['execId'];
             if (!execId)
                 return badRequest('Missing execution ID');
@@ -453,10 +508,12 @@ export function createWorkflowRouter(runtime, _opts) {
                 resumeInput.nodePath = body['nodePath'];
             }
             try {
-                await runtime.resume(execId, resumeInput);
+                await runtime.resume(asCtx(auth), execId, resumeInput);
                 return ok({ resumed: true });
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 if (err instanceof Error && err.message.includes('not found')) {
                     return notFound(err.message);
                 }
@@ -471,7 +528,7 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'GET',
         path: '/executions/:execId/steps/:stepName/events',
-        handler: async (req) => {
+        handler: async (req, auth) => {
             const execId = req.params['execId'];
             const stepName = req.params['stepName'];
             if (!execId || !stepName)
@@ -481,7 +538,7 @@ export function createWorkflowRouter(runtime, _opts) {
             if (after && isNaN(after.getTime())) {
                 return badRequest('Invalid query param: after must be an ISO 8601 date string');
             }
-            const events = await runtime.getStepEvents(execId, stepName, after);
+            const events = await runtime.getStepEvents(asCtx(auth), execId, stepName, after);
             return ok({ events });
         },
     });
@@ -498,16 +555,15 @@ export function createWorkflowRouter(runtime, _opts) {
             if (isNaN(since.getTime()))
                 return badRequest('Invalid query param: since must be an ISO 8601 date string');
             const rangeDays = typeof rangeDaysStr === 'string' && rangeDaysStr ? parseInt(rangeDaysStr, 10) : 7;
-            const metadata = auth?.metadata ?? {};
             const folderId = typeof req.query['folderId'] === 'string' ? req.query['folderId'] : undefined;
-            const summary = await runtime.getAnalyticsSummary({ since, rangeDays, metadata, ...(folderId ? { folderId } : {}) });
+            const summary = await runtime.getAnalyticsSummary(asCtx(auth), { since, rangeDays, ...(folderId ? { folderId } : {}) });
             return ok(summary);
         },
     });
     routes.push({
         method: 'GET',
         path: '/analytics/top-errors',
-        handler: async (req) => {
+        handler: async (req, auth) => {
             const sinceStr = req.query['since'];
             const limitStr = req.query['limit'];
             const folderIdStr = req.query['folderId'];
@@ -517,7 +573,7 @@ export function createWorkflowRouter(runtime, _opts) {
             const since = sinceDate;
             const limit = typeof limitStr === 'string' && limitStr ? parseInt(limitStr, 10) : 5;
             const folderId = typeof folderIdStr === 'string' ? folderIdStr : undefined;
-            const topErrors = await runtime.getTopErrors({ ...(since ? { since } : {}), limit, ...(folderId !== undefined ? { folderId } : {}) });
+            const topErrors = await runtime.getTopErrors(asCtx(auth), { ...(since ? { since } : {}), limit, ...(folderId !== undefined ? { folderId } : {}) });
             return ok({ topErrors });
         },
     });
@@ -628,7 +684,7 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'GET',
         path: '/executions',
-        handler: async (req) => {
+        handler: async (req, auth) => {
             const query = req.query;
             const params = {};
             if (typeof query['workflowId'] === 'string')
@@ -641,7 +697,7 @@ export function createWorkflowRouter(runtime, _opts) {
                 params.cursor = query['cursor'];
             if (typeof query['folderId'] === 'string')
                 params.folderId = query['folderId'];
-            const result = await runtime.listExecutions(params);
+            const result = await runtime.listExecutions(asCtx(auth), params);
             return ok(result);
         },
     });
@@ -649,7 +705,7 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'POST',
         path: '/executions/:execId/rerun',
-        handler: async (req) => {
+        handler: async (req, auth) => {
             const execId = req.params['execId'];
             if (!execId)
                 return badRequest('Missing execution ID');
@@ -666,10 +722,12 @@ export function createWorkflowRouter(runtime, _opts) {
                 opts.inheritStepState = body['inheritStepState'];
             }
             try {
-                const newExecutionId = await runtime.rerunFromStep(execId, fromStepId, opts);
+                const newExecutionId = await runtime.rerunFromStep(asCtx(auth), execId, fromStepId, opts);
                 return ok({ executionId: newExecutionId });
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 if (err instanceof Error && err.message.includes('not found')) {
                     return notFound(err.message);
                 }
@@ -681,15 +739,17 @@ export function createWorkflowRouter(runtime, _opts) {
     routes.push({
         method: 'POST',
         path: '/executions/:execId/cancel',
-        handler: async (req) => {
+        handler: async (req, auth) => {
             const execId = req.params['execId'];
             if (!execId)
                 return badRequest('Missing execution ID');
             try {
-                await runtime.cancelExecution(execId);
+                await runtime.cancelExecution(asCtx(auth), execId);
                 return ok({ cancelled: true });
             }
             catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
                 if (err instanceof Error && err.message.includes('not found')) {
                     return notFound(err.message);
                 }
@@ -702,10 +762,23 @@ export function createWorkflowRouter(runtime, _opts) {
         method: 'GET',
         path: '/credentials',
         handler: async (_req, auth) => {
-            const credentials = await runtime.listCredentials(authMetadata(auth));
+            const credentials = await runtime.listCredentials(asCtx(auth));
             return ok({ credentials });
         },
     });
+    routes.push({
+        method: 'GET',
+        path: '/credentials/:id',
+        handler: async (req, auth) => {
+            const id = req.params['id'];
+            if (!id)
+                return badRequest('Missing credential id');
+            const cred = await runtime.getCredential(asCtx(auth), id);
+            if (!cred)
+                return notFound(`Credential ${id} not found`);
+            return ok(cred);
+        },
+    });
     routes.push({
         method: 'POST',
         path: '/credentials',
@@ -714,26 +787,45 @@ export function createWorkflowRouter(runtime, _opts) {
             if (!body || !body['name'] || !body['type'] || !body['data']) {
                 return badRequest('Body must contain "name", "type", and "data"');
             }
-            const cred = await runtime.createCredential(authMetadata(auth), body['name'], { type: body['type'], data: body['data'] });
-            return created(cred);
+            try {
+                const cred = await runtime.createCredential(asCtx(auth), {
+                    name: body['name'],
+                    type: body['type'],
+                    data: body['data'],
+                    attributes: body['attributes'],
+                });
+                return created(cred);
+            }
+            catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
+                return error(400, err instanceof Error ? err.message : 'Create failed');
+            }
         },
     });
     routes.push({
         method: 'DELETE',
-        path: '/credentials/:name',
+        path: '/credentials/:id',
         handler: async (req, auth) => {
-            const name = req.params['name'];
-            if (!name)
-                return badRequest('Missing credential name');
-            await runtime.deleteCredential(authMetadata(auth), name);
-            return { status: 204, body: undefined };
+            const id = req.params['id'];
+            if (!id)
+                return badRequest('Missing credential id');
+            try {
+                await runtime.deleteCredential(asCtx(auth), id);
+                return { status: 204, body: undefined };
+            }
+            catch (err) {
+                if (err instanceof AccessDeniedError)
+                    throw err;
+                return notFound(err instanceof Error ? err.message : 'Delete failed');
+            }
         },
     });
     // ─── SSE: Execution Event Stream ───
     routes.push({
         method: 'GET',
         path: '/executions/:execId/stream',
-        handler: async (req) => {
+        handler: async (req, auth) => {
             const execId = req.params['execId'];
             if (!execId)
                 return badRequest('Missing execution ID');
@@ -741,7 +833,7 @@ export function createWorkflowRouter(runtime, _opts) {
             if (!eventBus) {
                 return error(501, 'Event streaming not configured');
             }
-            const detail = await runtime.getExecutionDetail(execId);
+            const detail = await runtime.getExecutionDetail(asCtx(auth), execId);
             if (!detail)
                 return notFound(`Execution ${execId} not found`);
             const isTerminal = ['COMPLETED', 'FAILED', 'CANCELLED'].includes(detail.execution.status);
@@ -844,6 +936,8 @@ export function createWorkflowRouter(runtime, _opts) {
                     }
                 }
                 catch (err) {
+                    if (err instanceof AccessDeniedError)
+                        throw err;
                     const m = err instanceof Error ? err.message : String(err);
                     console.error(`[${tag}] agentLoop failed:`, m);
                     yield formatSSE('error', { error: `LLM call failed: ${m}` });
@@ -870,7 +964,7 @@ export function createWorkflowRouter(runtime, _opts) {
             method: 'POST',
             path: '/ai-builder/chat',
             authenticated: false,
-            handler: async (req) => {
+            handler: async (req, auth) => {
                 const body = req.body;
                 if (!body.messages || !Array.isArray(body.messages)) {
                     return badRequest('messages array is required');
@@ -885,7 +979,7 @@ export function createWorkflowRouter(runtime, _opts) {
                     }
                     // The chat always runs inside a specific run, so we load it server-side
                     // rather than trusting/transferring a large client blob.
-                    const detail = await runtime.getExecutionDetail(approvalBody.executionId);
+                    const detail = await runtime.getExecutionDetail(asCtx(auth), approvalBody.executionId);
                     if (!detail)
                         return notFound(`Execution ${approvalBody.executionId} not found`);
                     const execCtx = {
@@ -976,6 +1070,8 @@ export function createWorkflowRouter(runtime, _opts) {
                         }
                     }
                     catch (err) {
+                        if (err instanceof AccessDeniedError)
+                            throw err;
                         const msg = err instanceof Error ? err.message : String(err);
                         console.error('[approval-ai] agentLoop failed:', msg);
                         return { status: 502, body: { error: `LLM call failed: ${msg}` } };
@@ -1046,6 +1142,8 @@ export function createWorkflowRouter(runtime, _opts) {
                     }
                 }
                 catch (err) {
+                    if (err instanceof AccessDeniedError)
+                        throw err;
                     const msg = err instanceof Error ? err.message : String(err);
                     console.error('[ai-builder] agentLoop failed:', msg);
                     return { status: 502, body: { error: `LLM call failed: ${msg}` } };
@@ -1058,7 +1156,26 @@ export function createWorkflowRouter(runtime, _opts) {
             },
         });
     }
-    return routes;
+    // Uniformly map the runtime's two authorization outcomes to HTTP across every
+    // handler, so enforcement in the runtime surfaces as a proper status rather
+    // than a 500 — and so a new route cannot forget to do it.
+    return routes.map((route) => ({
+        ...route,
+        handler: async (req, auth) => {
+            try {
+                return await route.handler(req, auth);
+            }
+            catch (err) {
+                if (err instanceof AccessDeniedError) {
+                    return { status: 403, body: { error: err.message } };
+                }
+                if (err instanceof ResourceNotFoundError) {
+                    return { status: 404, body: { error: err.message } };
+                }
+                throw err;
+            }
+        },
+    }));
 }
 // ─── AI Builder helpers ───
 const AI_BUILDER_SYSTEM_PROMPT = `You are a workflow automation assistant. Output valid WorkflowConfig JSON.