bullpane 0.6.3 → 0.7.1

package/dist/server.mjs

@@ -451,6 +451,38 @@ var createFlowEdgeSchema = z.object({
   to: z.string().min(1),
   label: z.string().max(120).nullable().optional()
 });
+function flowMapNodeId(ref) {
+  return `${ref.connectionId}:${ref.queueName}`;
+}
+var flowMapNodeRefSchema = z.object({
+  connectionId: z.string().min(1).max(64),
+  queueName: z.string().min(1).max(255)
+});
+var createFlowMapSchema = z.object({
+  name: z.string().trim().min(1).max(80),
+  description: z.string().max(500).nullable().optional(),
+  parentId: z.string().nullable().optional()
+});
+var updateFlowMapSchema = z.object({
+  name: z.string().trim().min(1).max(80).optional(),
+  description: z.string().max(500).nullable().optional(),
+  /** null moves the map to the root */
+  parentId: z.string().nullable().optional(),
+  position: z.number().int().min(0).optional()
+});
+var addFlowMapNodeSchema = flowMapNodeRefSchema.extend({
+  x: z.number().finite().nullable().optional(),
+  y: z.number().finite().nullable().optional()
+});
+var saveFlowMapLayoutSchema = z.object({
+  positions: z.array(z.object({ nodeId: z.string().min(1).max(320), x: z.number().finite(), y: z.number().finite() })).max(2e3)
+});
+var createFlowMapEdgeSchema = z.object({
+  from: flowMapNodeRefSchema,
+  to: flowMapNodeRefSchema,
+  label: z.string().max(120).nullable().optional()
+});
+var updateFlowMapEdgeSchema = z.object({ label: z.string().max(120).nullable() });
 var jobTreeQuerySchema = z.object({
   /** hard cap on jobs read; the walk is breadth-first so the cap keeps the top of the tree */
   maxNodes: z.coerce.number().int().min(1).max(500).default(200),
@@ -4005,6 +4037,9 @@ __export(schema_mysql_exports, {
   auditLog: () => auditLog,
   connections: () => connections,
   flowEdges: () => flowEdges,
+  flowMapEdges: () => flowMapEdges,
+  flowMapNodes: () => flowMapNodes,
+  flowMaps: () => flowMaps,
   folderQueues: () => folderQueues,
   folders: () => folders,
   hiddenQueues: () => hiddenQueues,
@@ -4201,6 +4236,48 @@ var flowEdges = mysqlTable(
   },
   (t) => [uniqueIndex("flow_edges_unique").on(t.connectionId, t.fromQueue, t.toQueue)]
 );
+var flowMaps = mysqlTable(
+  "flow_maps",
+  {
+    id: id(),
+    name: varchar("name", { length: 80 }).notNull(),
+    description: varchar("description", { length: 500 }),
+    parentId: varchar("parent_id", { length: 36 }),
+    position: int("position").notNull().default(0),
+    createdAt: createdAt(),
+    updatedAt: datetime("updated_at", { mode: "date", fsp: 3 }).notNull()
+  },
+  (t) => [index("flow_maps_parent_id_idx").on(t.parentId)]
+);
+var flowMapNodes = mysqlTable(
+  "flow_map_nodes",
+  {
+    mapId: varchar("map_id", { length: 36 }).notNull(),
+    connectionId: varchar("connection_id", { length: 36 }).notNull(),
+    queueName: varchar("queue_name", { length: 255 }).notNull(),
+    x: double("x"),
+    y: double("y")
+  },
+  (t) => [primaryKey({ columns: [t.mapId, t.connectionId, t.queueName] }), index("flow_map_nodes_connection_idx").on(t.connectionId)]
+);
+var flowMapEdges = mysqlTable(
+  "flow_map_edges",
+  {
+    id: id(),
+    mapId: varchar("map_id", { length: 36 }).notNull(),
+    fromConnectionId: varchar("from_connection_id", { length: 36 }).notNull(),
+    fromQueue: varchar("from_queue", { length: 255 }).notNull(),
+    toConnectionId: varchar("to_connection_id", { length: 36 }).notNull(),
+    toQueue: varchar("to_queue", { length: 255 }).notNull(),
+    label: varchar("label", { length: 120 }),
+    createdAt: createdAt()
+  },
+  (t) => [
+    uniqueIndex("flow_map_edges_unique").on(t.mapId, t.fromConnectionId, t.fromQueue, t.toConnectionId, t.toQueue),
+    index("flow_map_edges_from_conn_idx").on(t.fromConnectionId),
+    index("flow_map_edges_to_conn_idx").on(t.toConnectionId)
+  ]
+);
 var mcpClients = mysqlTable(
   "mcp_clients",
   {
@@ -4256,6 +4333,9 @@ __export(schema_sqlite_exports, {
   auditLog: () => auditLog2,
   connections: () => connections2,
   flowEdges: () => flowEdges2,
+  flowMapEdges: () => flowMapEdges2,
+  flowMapNodes: () => flowMapNodes2,
+  flowMaps: () => flowMaps2,
   folderQueues: () => folderQueues2,
   folders: () => folders2,
   hiddenQueues: () => hiddenQueues2,
@@ -4471,6 +4551,48 @@ var settings2 = sqliteTable("settings", {
   key: text2("key").primaryKey(),
   value: text2("value").notNull()
 });
+var flowMaps2 = sqliteTable(
+  "flow_maps",
+  {
+    id: id2(),
+    name: text2("name").notNull(),
+    description: text2("description"),
+    parentId: text2("parent_id"),
+    position: integer("position").notNull().default(0),
+    createdAt: createdAt2(),
+    updatedAt: timestamp("updated_at").notNull()
+  },
+  (t) => [index2("flow_maps_parent_id_idx").on(t.parentId)]
+);
+var flowMapNodes2 = sqliteTable(
+  "flow_map_nodes",
+  {
+    mapId: text2("map_id").notNull(),
+    connectionId: text2("connection_id").notNull(),
+    queueName: text2("queue_name").notNull(),
+    x: real("x"),
+    y: real("y")
+  },
+  (t) => [primaryKey2({ columns: [t.mapId, t.connectionId, t.queueName] }), index2("flow_map_nodes_connection_idx").on(t.connectionId)]
+);
+var flowMapEdges2 = sqliteTable(
+  "flow_map_edges",
+  {
+    id: id2(),
+    mapId: text2("map_id").notNull(),
+    fromConnectionId: text2("from_connection_id").notNull(),
+    fromQueue: text2("from_queue").notNull(),
+    toConnectionId: text2("to_connection_id").notNull(),
+    toQueue: text2("to_queue").notNull(),
+    label: text2("label"),
+    createdAt: createdAt2()
+  },
+  (t) => [
+    uniqueIndex2("flow_map_edges_unique").on(t.mapId, t.fromConnectionId, t.fromQueue, t.toConnectionId, t.toQueue),
+    index2("flow_map_edges_from_conn_idx").on(t.fromConnectionId),
+    index2("flow_map_edges_to_conn_idx").on(t.toConnectionId)
+  ]
+);
 
 // apps/server/src/db/schema.ts
 var users3 = users;
@@ -4488,6 +4610,9 @@ var settings3 = settings;
 var mcpClients3 = mcpClients;
 var mcpAuthCodes3 = mcpAuthCodes;
 var mcpGrants3 = mcpGrants;
+var flowMaps3 = flowMaps;
+var flowMapNodes3 = flowMapNodes;
+var flowMapEdges3 = flowMapEdges;
 var current = "mysql";
 function schemaDialect() {
   return current;
@@ -4509,6 +4634,9 @@ function useSchema(dialect) {
   mcpClients3 = s.mcpClients;
   mcpAuthCodes3 = s.mcpAuthCodes;
   mcpGrants3 = s.mcpGrants;
+  flowMaps3 = s.flowMaps;
+  flowMapNodes3 = s.flowMapNodes;
+  flowMapEdges3 = s.flowMapEdges;
   current = dialect;
 }
 
@@ -5590,7 +5718,17 @@ var UNAUDITED = /* @__PURE__ */ new Set([
   "POST /api/connections/test",
   "POST /api/setup",
   "POST /api/alerts/:id/test",
-  "POST /api/license/refresh"
+  "POST /api/license/refresh",
+  "POST /api/flow-maps",
+  "PATCH /api/flow-maps/:id",
+  "DELETE /api/flow-maps/:id",
+  "POST /api/flow-maps/:id/nodes",
+  "DELETE /api/flow-maps/:id/nodes/:nodeId",
+  "PUT /api/flow-maps/:id/layout",
+  "POST /api/flow-maps/:id/edges",
+  "PATCH /api/flow-maps/:id/edges/:edgeId",
+  "DELETE /api/flow-maps/:id/edges/:edgeId",
+  "POST /api/flow-maps/:id/copy"
 ]);
 function actionFor(method, routePattern) {
   if (!routePattern) return null;
@@ -6652,9 +6790,213 @@ async function connectionRoutes(app) {
   });
 }
 
+// apps/server/src/ee/routes/flowMaps.ts
+var copyFlowMapSchema = createFlowMapSchema.omit({ description: true }).partial({ name: true });
+async function flowMapRoutes(app) {
+  const gate = requireFeature("flows");
+  const viewer = [requireAuth, gate, requireRole("viewer")];
+  const operator = [requireAuth, gate, requireRole("operator")];
+  app.get("/flow-maps", { preHandler: viewer }, async () => app.ctx.flowMaps.list());
+  app.post("/flow-maps", { preHandler: operator }, async (request, reply) => {
+    const map = await app.ctx.flowMaps.create(createFlowMapSchema.parse(request.body));
+    reply.status(201);
+    return map;
+  });
+  app.get("/flow-maps/:id", { preHandler: viewer }, async (request) => app.ctx.flowMaps.get(request.params.id));
+  app.patch(
+    "/flow-maps/:id",
+    { preHandler: operator },
+    async (request) => app.ctx.flowMaps.update(request.params.id, updateFlowMapSchema.parse(request.body ?? {}))
+  );
+  app.delete("/flow-maps/:id", { preHandler: operator }, async (request) => {
+    await app.ctx.flowMaps.remove(request.params.id);
+    return { ok: true };
+  });
+  app.post(
+    "/flow-maps/:id/nodes",
+    { preHandler: operator },
+    async (request) => app.ctx.flowMaps.addNode(request.params.id, addFlowMapNodeSchema.parse(request.body))
+  );
+  app.delete(
+    "/flow-maps/:id/nodes/:nodeId",
+    { preHandler: operator },
+    async (request) => app.ctx.flowMaps.removeNode(request.params.id, request.params.nodeId)
+  );
+  app.put("/flow-maps/:id/layout", { preHandler: operator }, async (request) => {
+    await app.ctx.flowMaps.saveLayout(request.params.id, saveFlowMapLayoutSchema.parse(request.body));
+    return { ok: true };
+  });
+  app.post("/flow-maps/:id/edges", { preHandler: operator }, async (request, reply) => {
+    const map = await app.ctx.flowMaps.addEdge(request.params.id, createFlowMapEdgeSchema.parse(request.body));
+    reply.status(201);
+    return map;
+  });
+  app.patch(
+    "/flow-maps/:id/edges/:edgeId",
+    { preHandler: operator },
+    async (request) => app.ctx.flowMaps.updateEdge(request.params.id, request.params.edgeId, updateFlowMapEdgeSchema.parse(request.body))
+  );
+  app.delete(
+    "/flow-maps/:id/edges/:edgeId",
+    { preHandler: operator },
+    async (request) => app.ctx.flowMaps.removeEdge(request.params.id, request.params.edgeId)
+  );
+  app.post("/flow-maps/:id/copy", { preHandler: operator }, async (request, reply) => {
+    const map = await app.ctx.flowMaps.copy(request.params.id, copyFlowMapSchema.parse(request.body ?? {}));
+    reply.status(201);
+    return map;
+  });
+}
+
 // apps/server/src/ee/routes/flows.ts
 import { z as z4 } from "zod";
-var flowsQuerySchema = z4.object({ sample: z4.coerce.number().int().min(10).max(2e3).default(200) });
+
+// apps/server/src/ee/services/flows.ts
+import { and as and3, eq as eq3 } from "drizzle-orm";
+import { nanoid as nanoid2 } from "nanoid";
+var FLOW_CACHE_TTL_MS = 3e4;
+var FLOW_CONCURRENCY = 5;
+var DEFAULT_FLOW_SAMPLE = 200;
+function detectedEdgeId(from, to) {
+  return `d:${from}->${to}`;
+}
+function toFlowEdgeDto(row) {
+  return { id: row.id, from: row.fromQueue, to: row.toQueue, source: "manual", evidence: 0, label: row.label ?? null };
+}
+async function mapWithConcurrency(items, limit, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (next < items.length) {
+      const index3 = next++;
+      results[index3] = await fn(items[index3]);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+var FlowsService = class {
+  constructor(db, connections5) {
+    this.db = db;
+    this.connections = connections5;
+  }
+  cache = /* @__PURE__ */ new Map();
+  async getGraph(connectionId, sample) {
+    const row = await this.connections.getRow(connectionId);
+    const [detected, manual] = await Promise.all([this.detected(row, sample), this.manualEdges(connectionId)]);
+    const nodeIds = new Set(detected.nodes.map((n) => n.id));
+    const nodes = [...detected.nodes];
+    for (const edge of manual) {
+      for (const name of [edge.from, edge.to]) {
+        if (!nodeIds.has(name)) {
+          nodeIds.add(name);
+          nodes.push({ id: name, queueName: name, counts: { ...EMPTY_COUNTS }, isPaused: false });
+        }
+      }
+    }
+    return {
+      connectionId,
+      nodes,
+      edges: [...detected.edges, ...manual],
+      sampledJobs: detected.sampledJobs
+    };
+  }
+  /**
+   * The detected (FlowProducer) edges of one connection, from the same 30 s
+   * cache as getGraph, so flow maps and the /flows page share one sample.
+   * Edge ends are queue names. Rejects when the connection is down.
+   */
+  async detectedEdges(row, sample = DEFAULT_FLOW_SAMPLE) {
+    return (await this.detected(row, sample)).edges;
+  }
+  invalidate(connectionId) {
+    this.cache.delete(connectionId);
+  }
+  detected(row, sample) {
+    const cached = this.cache.get(row.id);
+    const now = Date.now();
+    if (cached && cached.sample === sample && now - cached.at < FLOW_CACHE_TTL_MS) return cached.value;
+    const value = withRedis(() => this.computeDetected(this.connections.inspectorFor(row), sample));
+    this.cache.set(row.id, { at: now, sample, value });
+    value.catch(() => this.cache.delete(row.id));
+    return value;
+  }
+  async computeDetected(inspector, sample) {
+    const names = await inspector.discoverQueues();
+    if (names.length === 0) return { nodes: [], edges: [], sampledJobs: 0 };
+    const stats = await inspector.getQueueStats(names);
+    const nodes = names.map((name) => ({
+      id: name,
+      queueName: name,
+      counts: stats[name]?.counts ?? { ...EMPTY_COUNTS },
+      isPaused: stats[name]?.isPaused ?? false
+    }));
+    const samples = await mapWithConcurrency(
+      names,
+      FLOW_CONCURRENCY,
+      (name) => inspector.sampleFlowEdges(name, { sample })
+    );
+    const edgeMap = /* @__PURE__ */ new Map();
+    let sampledJobs = 0;
+    for (const result of samples) {
+      sampledJobs += result.sampled;
+      for (const e of result.edges) {
+        const id3 = detectedEdgeId(e.childQueue, e.parentQueue);
+        const existing = edgeMap.get(id3);
+        if (existing) {
+          existing.evidence += e.count;
+        } else {
+          edgeMap.set(id3, {
+            id: id3,
+            from: e.childQueue,
+            to: e.parentQueue,
+            source: "detected",
+            evidence: e.count,
+            label: null
+          });
+        }
+      }
+    }
+    return { nodes, edges: [...edgeMap.values()], sampledJobs };
+  }
+  async manualEdges(connectionId) {
+    const rows = await this.db.select().from(flowEdges3).where(eq3(flowEdges3.connectionId, connectionId));
+    return rows.map(toFlowEdgeDto);
+  }
+  async createManualEdge(input) {
+    await this.connections.getRow(input.connectionId);
+    if (input.from === input.to) throw conflict("A queue cannot flow into itself");
+    const existing = await this.db.select({ id: flowEdges3.id }).from(flowEdges3).where(
+      and3(
+        eq3(flowEdges3.connectionId, input.connectionId),
+        eq3(flowEdges3.fromQueue, input.from),
+        eq3(flowEdges3.toQueue, input.to)
+      )
+    ).limit(1);
+    if (existing[0]) throw conflict("This edge already exists");
+    const id3 = nanoid2();
+    await this.db.insert(flowEdges3).values({
+      id: id3,
+      connectionId: input.connectionId,
+      fromQueue: input.from,
+      toQueue: input.to,
+      label: input.label ?? null,
+      createdAt: /* @__PURE__ */ new Date()
+    });
+    const rows = await this.db.select().from(flowEdges3).where(eq3(flowEdges3.id, id3)).limit(1);
+    const row = rows[0];
+    if (!row) throw notFound("Flow edge");
+    return toFlowEdgeDto(row);
+  }
+  async deleteManualEdge(id3) {
+    const rows = await this.db.select({ id: flowEdges3.id }).from(flowEdges3).where(eq3(flowEdges3.id, id3)).limit(1);
+    if (!rows[0]) throw notFound("Flow edge");
+    await this.db.delete(flowEdges3).where(eq3(flowEdges3.id, id3));
+  }
+};
+
+// apps/server/src/ee/routes/flows.ts
+var flowsQuerySchema = z4.object({ sample: z4.coerce.number().int().min(10).max(2e3).default(DEFAULT_FLOW_SAMPLE) });
 async function flowRoutes(app) {
   const gate = requireFeature("flows");
   const viewer = [requireAuth, gate, requireRole("viewer")];
@@ -7148,7 +7490,7 @@ async function ssoRoutes(app) {
 
 // apps/server/src/ee/mcp/service.ts
 import { createHash as createHash2, createHmac, hkdfSync as hkdfSync2, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
-import { nanoid as nanoid2 } from "nanoid";
+import { nanoid as nanoid3 } from "nanoid";
 var MCP_SETTINGS_KEY = "mcp.max_access";
 var MCP_SCOPES = { read: "queues:read", write: "queues:write" };
 var ACCESS_TTL_S = 60 * 60;
@@ -7431,7 +7773,7 @@ var McpService = class {
     const challenge = b64url(createHash2("sha256").update(p.code_verifier).digest());
     if (!safeEqual2(challenge, row.codeChallenge)) throw new OAuthError(400, "invalid_grant", "PKCE verification failed");
     const refresh = random("bprt_");
-    const grantId = nanoid2();
+    const grantId = nanoid3();
     await this.store.insertGrant({
       id: grantId,
       clientId: row.clientId,
@@ -7654,6 +7996,7 @@ async function apiPlugin(app) {
   await app.register(jobRoutes);
   await app.register(groupRoutes);
   await app.register(flowRoutes);
+  await app.register(flowMapRoutes);
   await app.register(folderRoutes);
   await app.register(alertRoutes);
   await app.register(userRoutes);
@@ -7663,8 +8006,8 @@ async function apiPlugin(app) {
 }
 
 // apps/server/src/ee/services/audit.ts
-import { and as and3, asc, desc as desc2, eq as eq3, gte, lt as lt3, lte, or, sql } from "drizzle-orm";
-import { nanoid as nanoid3 } from "nanoid";
+import { and as and4, asc, desc as desc2, eq as eq4, gte, lt as lt3, lte, or, sql } from "drizzle-orm";
+import { nanoid as nanoid4 } from "nanoid";
 var MAX_ERROR = 500;
 var MAX_UA = 255;
 var MAX_JOB_ID = 255;
@@ -7748,7 +8091,7 @@ var AuditService = class {
   async record(input) {
     try {
       await this.db.insert(auditLog3).values({
-        id: nanoid3(),
+        id: nanoid4(),
         createdAt: input.createdAt ?? /* @__PURE__ */ new Date(),
         actorId: input.actor?.id ?? null,
         // Denormalised on purpose: the row must still name the person after the
@@ -7780,22 +8123,22 @@ var AuditService = class {
    */
   async list(query) {
     const filters = [];
-    if (query.actorId) filters.push(eq3(auditLog3.actorId, query.actorId));
-    if (query.action) filters.push(eq3(auditLog3.action, query.action));
-    if (query.connectionId) filters.push(eq3(auditLog3.connectionId, query.connectionId));
-    if (query.queueName) filters.push(eq3(auditLog3.queueName, query.queueName));
-    if (query.jobId) filters.push(eq3(auditLog3.jobId, query.jobId));
-    if (query.result) filters.push(eq3(auditLog3.result, query.result));
+    if (query.actorId) filters.push(eq4(auditLog3.actorId, query.actorId));
+    if (query.action) filters.push(eq4(auditLog3.action, query.action));
+    if (query.connectionId) filters.push(eq4(auditLog3.connectionId, query.connectionId));
+    if (query.queueName) filters.push(eq4(auditLog3.queueName, query.queueName));
+    if (query.jobId) filters.push(eq4(auditLog3.jobId, query.jobId));
+    if (query.result) filters.push(eq4(auditLog3.result, query.result));
     if (query.from) filters.push(gte(auditLog3.createdAt, new Date(query.from)));
     if (query.to) filters.push(lt3(auditLog3.createdAt, new Date(query.to)));
     if (query.cursor) {
       const c = decodeCursor(query.cursor);
       if (c) {
-        const keyset = or(lt3(auditLog3.createdAt, c.createdAt), and3(eq3(auditLog3.createdAt, c.createdAt), lt3(auditLog3.id, c.id)));
+        const keyset = or(lt3(auditLog3.createdAt, c.createdAt), and4(eq4(auditLog3.createdAt, c.createdAt), lt3(auditLog3.id, c.id)));
         if (keyset) filters.push(keyset);
       }
     }
-    const where = filters.length === 0 ? void 0 : filters.length === 1 ? filters[0] : and3(...filters);
+    const where = filters.length === 0 ? void 0 : filters.length === 1 ? filters[0] : and4(...filters);
     const rows = await this.db.select().from(auditLog3).where(where).orderBy(desc2(auditLog3.createdAt), desc2(auditLog3.id)).limit(query.limit + 1);
     const page = rows.slice(0, query.limit);
     const last = page[page.length - 1];
@@ -7860,8 +8203,8 @@ var AuditService = class {
 };
 
 // apps/server/src/services/connections.ts
-import { and as and4, eq as eq4, inArray } from "drizzle-orm";
-import { nanoid as nanoid4 } from "nanoid";
+import { and as and5, eq as eq5, inArray, or as or2 } from "drizzle-orm";
+import { nanoid as nanoid5 } from "nanoid";
 var STATUS_TTL_MS = 1e4;
 var SCHEDULER_FANOUT_CONCURRENCY = 6;
 var SCHEDULERS_PER_QUEUE_CAP = 500;
@@ -7914,7 +8257,7 @@ var ConnectionsService = class {
     return this.db.select().from(connections3).orderBy(connections3.position, connections3.createdAt);
   }
   async getRow(id3) {
-    const rows = await this.db.select().from(connections3).where(eq4(connections3.id, id3)).limit(1);
+    const rows = await this.db.select().from(connections3).where(eq5(connections3.id, id3)).limit(1);
     const row = rows[0];
     if (!row) throw notFound("Connection");
     return row;
@@ -7929,7 +8272,7 @@ var ConnectionsService = class {
     return Promise.all(rows.map(async (row) => toConnectionDto(row, await this.getStatus(row))));
   }
   async create(input) {
-    const id3 = nanoid4();
+    const id3 = nanoid5();
     const siblings = await this.db.select({ id: connections3.id }).from(connections3);
     await this.db.insert(connections3).values({
       id: id3,
@@ -7966,7 +8309,7 @@ var ConnectionsService = class {
     const ordered = [...ids, ...rows.filter((r) => !ids.includes(r.id)).map((r) => r.id)];
     await this.db.transaction(async (tx) => {
       for (const [index3, id3] of ordered.entries()) {
-        await tx.update(connections3).set({ position: index3 }).where(eq4(connections3.id, id3));
+        await tx.update(connections3).set({ position: index3 }).where(eq5(connections3.id, id3));
       }
     });
     return this.list();
@@ -7982,7 +8325,7 @@ var ConnectionsService = class {
     if (input.cluster !== void 0) patch.cluster = input.cluster;
     if (input.queueFilter !== void 0) patch.queueFilter = input.queueFilter;
     if (Object.keys(patch).length > 0) {
-      await this.db.update(connections3).set(patch).where(eq4(connections3.id, id3));
+      await this.db.update(connections3).set(patch).where(eq5(connections3.id, id3));
     }
     await this.pool.evict(id3);
     this.notifyEvict(id3);
@@ -7995,11 +8338,13 @@ var ConnectionsService = class {
     await this.pool.evict(id3);
     this.notifyEvict(id3);
     this.statusCache.delete(id3);
-    await this.db.delete(folderQueues3).where(eq4(folderQueues3.connectionId, id3));
-    await this.db.delete(hiddenQueues3).where(eq4(hiddenQueues3.connectionId, id3));
-    await this.db.delete(alerts3).where(eq4(alerts3.connectionId, id3));
-    await this.db.delete(flowEdges3).where(eq4(flowEdges3.connectionId, id3));
-    await this.db.delete(connections3).where(eq4(connections3.id, id3));
+    await this.db.delete(folderQueues3).where(eq5(folderQueues3.connectionId, id3));
+    await this.db.delete(hiddenQueues3).where(eq5(hiddenQueues3.connectionId, id3));
+    await this.db.delete(alerts3).where(eq5(alerts3.connectionId, id3));
+    await this.db.delete(flowEdges3).where(eq5(flowEdges3.connectionId, id3));
+    await this.db.delete(flowMapEdges3).where(or2(eq5(flowMapEdges3.fromConnectionId, id3), eq5(flowMapEdges3.toConnectionId, id3)));
+    await this.db.delete(flowMapNodes3).where(eq5(flowMapNodes3.connectionId, id3));
+    await this.db.delete(connections3).where(eq5(connections3.id, id3));
   }
   inspectorFor(row) {
     return this.pool.get({
@@ -8056,12 +8401,12 @@ var ConnectionsService = class {
   // -------------------------------------------------------------------------
   /** Names hidden on this connection, as a Set for O(1) filtering. */
   async hiddenQueueNames(connectionId) {
-    const rows = await this.db.select({ queueName: hiddenQueues3.queueName }).from(hiddenQueues3).where(eq4(hiddenQueues3.connectionId, connectionId));
+    const rows = await this.db.select({ queueName: hiddenQueues3.queueName }).from(hiddenQueues3).where(eq5(hiddenQueues3.connectionId, connectionId));
     return new Set(rows.map((r) => r.queueName));
   }
   /** The hidden list for the UI, newest first, with the display name of who hid it. */
   async listHiddenQueues(connectionId) {
-    const rows = await this.db.select().from(hiddenQueues3).where(eq4(hiddenQueues3.connectionId, connectionId)).orderBy(hiddenQueues3.hiddenAt);
+    const rows = await this.db.select().from(hiddenQueues3).where(eq5(hiddenQueues3.connectionId, connectionId)).orderBy(hiddenQueues3.hiddenAt);
     const ids = [...new Set(rows.map((r) => r.hiddenBy).filter((v) => !!v))];
     const names = /* @__PURE__ */ new Map();
     if (ids.length > 0) {
@@ -8080,7 +8425,7 @@ var ConnectionsService = class {
   /** Idempotent: hiding an already hidden queue is a no-op, not a 409. */
   async hideQueue(connectionId, queueName, userId) {
     await this.getRow(connectionId);
-    const existing = await this.db.select({ queueName: hiddenQueues3.queueName }).from(hiddenQueues3).where(and4(eq4(hiddenQueues3.connectionId, connectionId), eq4(hiddenQueues3.queueName, queueName))).limit(1);
+    const existing = await this.db.select({ queueName: hiddenQueues3.queueName }).from(hiddenQueues3).where(and5(eq5(hiddenQueues3.connectionId, connectionId), eq5(hiddenQueues3.queueName, queueName))).limit(1);
     if (existing.length === 0) {
       await this.db.insert(hiddenQueues3).values({ connectionId, queueName, hiddenAt: /* @__PURE__ */ new Date(), hiddenBy: userId });
     }
@@ -8089,11 +8434,11 @@ var ConnectionsService = class {
   /** Idempotent too: unhiding something that is not hidden succeeds. */
   async unhideQueue(connectionId, queueName) {
     await this.getRow(connectionId);
-    await this.db.delete(hiddenQueues3).where(and4(eq4(hiddenQueues3.connectionId, connectionId), eq4(hiddenQueues3.queueName, queueName)));
+    await this.db.delete(hiddenQueues3).where(and5(eq5(hiddenQueues3.connectionId, connectionId), eq5(hiddenQueues3.queueName, queueName)));
     return this.listHiddenQueues(connectionId);
   }
   async isQueueHidden(connectionId, queueName) {
-    const rows = await this.db.select({ queueName: hiddenQueues3.queueName }).from(hiddenQueues3).where(and4(eq4(hiddenQueues3.connectionId, connectionId), eq4(hiddenQueues3.queueName, queueName))).limit(1);
+    const rows = await this.db.select({ queueName: hiddenQueues3.queueName }).from(hiddenQueues3).where(and5(eq5(hiddenQueues3.connectionId, connectionId), eq5(hiddenQueues3.queueName, queueName))).limit(1);
     return rows.length > 0;
   }
   /**
@@ -8193,7 +8538,7 @@ var ConnectionsService = class {
   }
   /** Used by seeding: does a connection with this name exist? */
   async findByName(name) {
-    const rows = await this.db.select().from(connections3).where(and4(eq4(connections3.name, name))).limit(1);
+    const rows = await this.db.select().from(connections3).where(and5(eq5(connections3.name, name))).limit(1);
     return rows[0] ?? null;
   }
 };
@@ -8731,13 +9076,13 @@ var AttentionService = class {
 };
 
 // apps/server/src/services/settings-store.ts
-import { eq as eq5 } from "drizzle-orm";
+import { eq as eq6 } from "drizzle-orm";
 var DrizzleSettingsStore = class {
   constructor(db) {
     this.db = db;
   }
   async get(key) {
-    const rows = await this.db.select().from(settings3).where(eq5(settings3.key, key)).limit(1);
+    const rows = await this.db.select().from(settings3).where(eq6(settings3.key, key)).limit(1);
     const value = rows[0]?.value;
     return value === void 0 || value === "" ? null : value;
   }
@@ -8755,148 +9100,512 @@ var DrizzleSettingsStore = class {
     await this.db.insert(settings3).values({ key, value }).onDuplicateKeyUpdate({ set: { value } });
   }
   async delete(key) {
-    await this.db.delete(settings3).where(eq5(settings3.key, key));
+    await this.db.delete(settings3).where(eq6(settings3.key, key));
   }
 };
 
-// apps/server/src/ee/services/flows.ts
-import { and as and5, eq as eq6 } from "drizzle-orm";
-import { nanoid as nanoid5 } from "nanoid";
-var FLOW_CACHE_TTL_MS = 3e4;
-var FLOW_CONCURRENCY = 5;
-function detectedEdgeId(from, to) {
-  return `d:${from}->${to}`;
+// apps/server/src/ee/services/flowMaps.ts
+import { and as and6, eq as eq7, inArray as inArray2, isNull as isNull2, or as or3 } from "drizzle-orm";
+import { nanoid as nanoid6 } from "nanoid";
+var DETECTED_MAP_PREFIX = "detected:";
+var DETECTED_WAIT_MS = 3e3;
+var NAME_MAX = 80;
+var detectedMapReadOnly = () => new HttpError(409, "detected_map_read_only", "Detected maps are computed from BullMQ flows and cannot be edited. Copy it to edit it.");
+function isDetectedMapId(id3) {
+  return id3.startsWith(DETECTED_MAP_PREFIX);
+}
+function detectedMapId(connectionId, rootQueue) {
+  return `${DETECTED_MAP_PREFIX}${connectionId}:${rootQueue}`;
+}
+function parseNodeId(nodeId) {
+  const i = nodeId.indexOf(":");
+  if (i <= 0 || i === nodeId.length - 1) return null;
+  return { connectionId: nodeId.slice(0, i), queueName: nodeId.slice(i + 1) };
+}
+function detectedComponents(edges) {
+  const parent = /* @__PURE__ */ new Map();
+  const find = (q) => {
+    let r = q;
+    while (parent.get(r) !== r) r = parent.get(r);
+    let c = q;
+    while (c !== r) {
+      const next = parent.get(c);
+      parent.set(c, r);
+      c = next;
+    }
+    return r;
+  };
+  for (const e of edges) {
+    for (const q of [e.from, e.to]) if (!parent.has(q)) parent.set(q, q);
+    const a = find(e.from);
+    const b = find(e.to);
+    if (a !== b) parent.set(a, b);
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const q of parent.keys()) {
+    const r = find(q);
+    const g = groups.get(r) ?? { queues: [], edges: [] };
+    g.queues.push(q);
+    groups.set(r, g);
+  }
+  for (const e of edges) groups.get(find(e.from))?.edges.push(e);
+  const out = [];
+  for (const g of groups.values()) {
+    if (g.queues.length < 2) continue;
+    const outgoing = new Set(g.edges.map((e) => e.from));
+    const incoming = /* @__PURE__ */ new Map();
+    for (const e of g.edges) incoming.set(e.to, (incoming.get(e.to) ?? 0) + e.evidence);
+    const sinks = g.queues.filter((q) => !outgoing.has(q));
+    const candidates = sinks.length > 0 ? sinks : g.queues;
+    candidates.sort((a, b) => (incoming.get(b) ?? 0) - (incoming.get(a) ?? 0) || a.localeCompare(b));
+    out.push({ root: candidates[0], queues: g.queues.sort((a, b) => a.localeCompare(b)), edges: g.edges });
+  }
+  return out.sort((a, b) => a.root.localeCompare(b.root));
+}
+function within(promise, ms) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error("still sampling")), ms);
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
 }
-function toFlowEdgeDto(row) {
-  return { id: row.id, from: row.fromQueue, to: row.toQueue, source: "manual", evidence: 0, label: row.label ?? null };
+function toDetectedMapEdge(connectionId, e) {
+  const from = flowMapNodeId({ connectionId, queueName: e.to });
+  const to = flowMapNodeId({ connectionId, queueName: e.from });
+  return { id: detectedEdgeId(from, to), from, to, source: "detected", label: null, evidence: e.evidence };
 }
-async function mapWithConcurrency(items, limit, fn) {
-  const results = new Array(items.length);
-  let next = 0;
-  const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
-    while (next < items.length) {
-      const index3 = next++;
-      results[index3] = await fn(items[index3]);
-    }
-  });
-  await Promise.all(workers);
-  return results;
+function toManualMapEdge(row) {
+  return {
+    id: row.id,
+    from: flowMapNodeId({ connectionId: row.fromConnectionId, queueName: row.fromQueue }),
+    to: flowMapNodeId({ connectionId: row.toConnectionId, queueName: row.toQueue }),
+    source: "manual",
+    label: row.label ?? null,
+    evidence: 0
+  };
 }
-var FlowsService = class {
-  constructor(db, connections5) {
-    this.db = db;
-    this.connections = connections5;
-  }
-  cache = /* @__PURE__ */ new Map();
-  async getGraph(connectionId, sample) {
-    const row = await this.connections.getRow(connectionId);
-    const [detected, manual] = await Promise.all([this.detected(row, sample), this.manualEdges(connectionId)]);
-    const nodeIds = new Set(detected.nodes.map((n) => n.id));
-    const nodes = [...detected.nodes];
-    for (const edge of manual) {
-      for (const name of [edge.from, edge.to]) {
-        if (!nodeIds.has(name)) {
-          nodeIds.add(name);
-          nodes.push({ id: name, queueName: name, counts: { ...EMPTY_COUNTS }, isPaused: false });
-        }
+function manualSummary(row) {
+  return {
+    id: row.id,
+    kind: "manual",
+    name: row.name,
+    description: row.description ?? null,
+    parentId: row.parentId ?? null,
+    position: row.position,
+    connectionId: null
+  };
+}
+function sameRef(a, b) {
+  return a.connectionId === b.connectionId && a.queueName === b.queueName;
+}
+var FlowMapsService = class {
+  constructor(db, connections5, flows) {
+    this.db = db;
+    this.connections = connections5;
+    this.flows = flows;
+  }
+  // ---------------------------------------------------------------------------
+  // reads
+  // ---------------------------------------------------------------------------
+  async list() {
+    const rows = await this.db.select().from(flowMaps3);
+    rows.sort(
+      (a, b) => (a.parentId ?? "").localeCompare(b.parentId ?? "") || a.position - b.position || a.name.localeCompare(b.name) || a.id.localeCompare(b.id)
+    );
+    const nodeCount = /* @__PURE__ */ new Map();
+    const edgeCount = /* @__PURE__ */ new Map();
+    if (rows.length > 0) {
+      const ids = rows.map((r) => r.id);
+      for (const n of await this.db.select({ mapId: flowMapNodes3.mapId }).from(flowMapNodes3).where(inArray2(flowMapNodes3.mapId, ids))) {
+        nodeCount.set(n.mapId, (nodeCount.get(n.mapId) ?? 0) + 1);
+      }
+      for (const e of await this.db.select({ mapId: flowMapEdges3.mapId }).from(flowMapEdges3).where(inArray2(flowMapEdges3.mapId, ids))) {
+        edgeCount.set(e.mapId, (edgeCount.get(e.mapId) ?? 0) + 1);
       }
     }
+    const maps = rows.map((r) => ({ ...manualSummary(r), nodeCount: nodeCount.get(r.id) ?? 0, edgeCount: edgeCount.get(r.id) ?? 0 }));
+    let detectedComplete = true;
+    const perConnection = await Promise.all(
+      (await this.connections.listRows()).map(async (row) => {
+        try {
+          return { row, components: detectedComponents(await within(this.flows.detectedEdges(row), DETECTED_WAIT_MS)) };
+        } catch {
+          detectedComplete = false;
+          return { row, components: [] };
+        }
+      })
+    );
+    for (const { row, components } of perConnection) {
+      components.forEach((c, position) => {
+        maps.push({
+          id: detectedMapId(row.id, c.root),
+          kind: "detected",
+          name: c.root,
+          description: null,
+          parentId: null,
+          position,
+          connectionId: row.id,
+          nodeCount: c.queues.length,
+          edgeCount: c.edges.length
+        });
+      });
+    }
+    return { maps, detectedComplete };
+  }
+  async get(id3) {
+    return this.build(await this.source(id3));
+  }
+  /** What a map is made of (no Redis counts): the table rows, or the detected component. */
+  async source(id3) {
+    if (isDetectedMapId(id3)) return this.detectedSource(id3);
+    const row = await this.getRow(id3);
+    const nodes = await this.db.select().from(flowMapNodes3).where(eq7(flowMapNodes3.mapId, id3));
+    const manualEdges = await this.db.select().from(flowMapEdges3).where(eq7(flowMapEdges3.mapId, id3));
+    nodes.sort((a, b) => a.connectionId.localeCompare(b.connectionId) || a.queueName.localeCompare(b.queueName));
+    manualEdges.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime() || a.id.localeCompare(b.id));
     return {
-      connectionId,
-      nodes,
-      edges: [...detected.edges, ...manual],
-      sampledJobs: detected.sampledJobs
+      summary: manualSummary(row),
+      nodes: nodes.map((n) => ({ connectionId: n.connectionId, queueName: n.queueName, x: n.x ?? null, y: n.y ?? null })),
+      manualEdges
     };
   }
-  invalidate(connectionId) {
-    this.cache.delete(connectionId);
-  }
-  detected(row, sample) {
-    const cached = this.cache.get(row.id);
-    const now = Date.now();
-    if (cached && cached.sample === sample && now - cached.at < FLOW_CACHE_TTL_MS) return cached.value;
-    const value = withRedis(() => this.computeDetected(this.connections.inspectorFor(row), sample));
-    this.cache.set(row.id, { at: now, sample, value });
-    value.catch(() => this.cache.delete(row.id));
-    return value;
+  async detectedSource(id3) {
+    const ref = parseNodeId(id3.slice(DETECTED_MAP_PREFIX.length));
+    if (!ref) throw notFound("Flow map");
+    const row = await this.connections.getRow(ref.connectionId);
+    let edges;
+    try {
+      edges = await this.flows.detectedEdges(row);
+    } catch {
+      throw notFound("Flow map");
+    }
+    const components = detectedComponents(edges);
+    const position = components.findIndex((c) => c.root === ref.queueName);
+    const component = components[position];
+    if (!component) throw notFound("Flow map");
+    return {
+      summary: { id: id3, kind: "detected", name: component.root, description: null, parentId: null, position, connectionId: row.id },
+      nodes: component.queues.map((queueName) => ({ connectionId: row.id, queueName, x: null, y: null })),
+      manualEdges: [],
+      detectedEdges: component.edges
+    };
   }
-  async computeDetected(inspector, sample) {
-    const names = await inspector.discoverQueues();
-    if (names.length === 0) return { nodes: [], edges: [], sampledJobs: 0 };
-    const stats = await inspector.getQueueStats(names);
-    const nodes = names.map((name) => ({
-      id: name,
-      queueName: name,
-      counts: stats[name]?.counts ?? { ...EMPTY_COUNTS },
-      isPaused: stats[name]?.isPaused ?? false
-    }));
-    const samples = await mapWithConcurrency(
-      names,
-      FLOW_CONCURRENCY,
-      (name) => inspector.sampleFlowEdges(name, { sample })
+  /**
+   * Live counts + detected edges for a map's nodes: per connection, one
+   * getQueueStats for only the queues on the map. Anything that cannot be read
+   * (connection deleted or down, queue not discovered) is a `missing` node,
+   * never an error: a map is a drawing first.
+   */
+  async build(src) {
+    const byConnection = /* @__PURE__ */ new Map();
+    for (const n of src.nodes) {
+      const list = byConnection.get(n.connectionId) ?? [];
+      list.push(n);
+      byConnection.set(n.connectionId, list);
+    }
+    const rows = new Map((await this.connections.listRows()).map((r) => [r.id, r]));
+    const live = /* @__PURE__ */ new Map();
+    const detectedEdges = [];
+    await Promise.all(
+      [...byConnection.entries()].map(async ([connectionId, nodes2]) => {
+        const row = rows.get(connectionId);
+        if (!row) return;
+        await Promise.all([this.readCounts(row, nodes2, live), this.readDetected(row, src, detectedEdges)]);
+      })
     );
-    const edgeMap = /* @__PURE__ */ new Map();
-    let sampledJobs = 0;
-    for (const result of samples) {
-      sampledJobs += result.sampled;
-      for (const e of result.edges) {
-        const id3 = detectedEdgeId(e.childQueue, e.parentQueue);
-        const existing = edgeMap.get(id3);
-        if (existing) {
-          existing.evidence += e.count;
-        } else {
-          edgeMap.set(id3, {
-            id: id3,
-            from: e.childQueue,
-            to: e.parentQueue,
-            source: "detected",
-            evidence: e.count,
-            label: null
-          });
+    const nodes = src.nodes.map((n) => {
+      const id3 = flowMapNodeId(n);
+      return {
+        id: id3,
+        connectionId: n.connectionId,
+        queueName: n.queueName,
+        x: n.x,
+        y: n.y,
+        ...live.get(id3) ?? {
+          connectionName: rows.get(n.connectionId)?.name ?? n.connectionId,
+          counts: { ...EMPTY_COUNTS },
+          isPaused: false,
+          missing: true
         }
+      };
+    });
+    const onMap = new Set(nodes.map((n) => n.id));
+    const manual = src.manualEdges.map(toManualMapEdge);
+    const drawn = new Set(manual.map((e) => `${e.from}->${e.to}`));
+    const edges = [
+      ...manual,
+      ...detectedEdges.filter((e) => onMap.has(e.from) && onMap.has(e.to) && !drawn.has(`${e.from}->${e.to}`))
+    ];
+    return { ...src.summary, nodeCount: nodes.length, edgeCount: edges.length, nodes, edges };
+  }
+  async readCounts(row, nodes, live) {
+    try {
+      const inspector = this.connections.inspectorFor(row);
+      const discovered = new Set(await withRedis(() => inspector.discoverQueues()));
+      const present = [...new Set(nodes.map((n) => n.queueName))].filter((q) => discovered.has(q));
+      if (present.length === 0) return;
+      const stats = await withRedis(() => inspector.getQueueStats(present));
+      for (const q of present) {
+        const s = stats[q];
+        if (!s) continue;
+        live.set(flowMapNodeId({ connectionId: row.id, queueName: q }), {
+          connectionName: row.name,
+          counts: s.counts,
+          isPaused: s.isPaused,
+          missing: false
+        });
       }
+    } catch {
     }
-    return { nodes, edges: [...edgeMap.values()], sampledJobs };
   }
-  async manualEdges(connectionId) {
-    const rows = await this.db.select().from(flowEdges3).where(eq6(flowEdges3.connectionId, connectionId));
-    return rows.map(toFlowEdgeDto);
+  async readDetected(row, src, out) {
+    if (src.detectedEdges) {
+      if (src.summary.connectionId === row.id) out.push(...src.detectedEdges.map((e) => toDetectedMapEdge(row.id, e)));
+      return;
+    }
+    try {
+      const edges = await within(this.flows.detectedEdges(row), DETECTED_WAIT_MS);
+      out.push(...edges.map((e) => toDetectedMapEdge(row.id, e)));
+    } catch {
+    }
   }
-  async createManualEdge(input) {
+  // ---------------------------------------------------------------------------
+  // writes (manual maps only, except copy)
+  // ---------------------------------------------------------------------------
+  async getRow(id3) {
+    const rows = await this.db.select().from(flowMaps3).where(eq7(flowMaps3.id, id3)).limit(1);
+    const row = rows[0];
+    if (!row) throw notFound("Flow map");
+    return row;
+  }
+  /** The row of a map a write may touch: 409 for a detected id, 404 for an unknown one. */
+  async writable(id3) {
+    if (isDetectedMapId(id3)) throw detectedMapReadOnly();
+    return this.getRow(id3);
+  }
+  async touch(id3) {
+    await this.db.update(flowMaps3).set({ updatedAt: /* @__PURE__ */ new Date() }).where(eq7(flowMaps3.id, id3));
+  }
+  /** New maps go to the bottom of their level. */
+  async nextPosition(parentId) {
+    const siblings = await this.db.select({ id: flowMaps3.id }).from(flowMaps3).where(parentId ? eq7(flowMaps3.parentId, parentId) : isNull2(flowMaps3.parentId));
+    return siblings.length;
+  }
+  async insertMap(input) {
+    const parentId = input.parentId ?? null;
+    if (parentId) await this.getRow(parentId);
+    const id3 = nanoid6();
+    const now = /* @__PURE__ */ new Date();
+    await this.db.insert(flowMaps3).values({
+      id: id3,
+      name: input.name,
+      description: input.description ?? null,
+      parentId,
+      position: await this.nextPosition(parentId),
+      createdAt: now,
+      updatedAt: now
+    });
+    return id3;
+  }
+  async create(input) {
+    return this.get(await this.insertMap(input));
+  }
+  async update(id3, input) {
+    await this.writable(id3);
+    if (input.parentId) await this.assertNoCycle(id3, input.parentId);
+    const patch = { updatedAt: /* @__PURE__ */ new Date() };
+    if (input.name !== void 0) patch.name = input.name;
+    if (input.description !== void 0) patch.description = input.description;
+    if (input.parentId !== void 0) patch.parentId = input.parentId;
+    if (input.position !== void 0) patch.position = input.position;
+    await this.db.update(flowMaps3).set(patch).where(eq7(flowMaps3.id, id3));
+    return this.get(id3);
+  }
+  /** Moving `id` under `parentId` must not put it under itself or one of its descendants. */
+  async assertNoCycle(id3, parentId) {
+    if (isDetectedMapId(parentId)) throw notFound("Flow map");
+    const all = await this.db.select({ id: flowMaps3.id, parentId: flowMaps3.parentId }).from(flowMaps3);
+    const parentOf = new Map(all.map((r) => [r.id, r.parentId ?? null]));
+    if (!parentOf.has(parentId)) throw notFound("Flow map");
+    let cursor = parentId;
+    for (let steps = 0; cursor !== null && steps <= all.length; steps++) {
+      if (cursor === id3) throw conflict("A flow map cannot be moved under itself or one of its own maps");
+      cursor = parentOf.get(cursor) ?? null;
+    }
+  }
+  async remove(id3) {
+    const row = await this.writable(id3);
+    await this.db.transaction(async (tx) => {
+      await tx.update(flowMaps3).set({ parentId: row.parentId ?? null, updatedAt: /* @__PURE__ */ new Date() }).where(eq7(flowMaps3.parentId, id3));
+      await tx.delete(flowMapEdges3).where(eq7(flowMapEdges3.mapId, id3));
+      await tx.delete(flowMapNodes3).where(eq7(flowMapNodes3.mapId, id3));
+      await tx.delete(flowMaps3).where(eq7(flowMaps3.id, id3));
+    });
+  }
+  async findNode(mapId, ref) {
+    const rows = await this.db.select().from(flowMapNodes3).where(and6(eq7(flowMapNodes3.mapId, mapId), eq7(flowMapNodes3.connectionId, ref.connectionId), eq7(flowMapNodes3.queueName, ref.queueName))).limit(1);
+    return rows[0] ?? null;
+  }
+  /** Puts a queue on the map if it is not there yet. Returns true when it was added. */
+  async ensureNode(mapId, ref, pos = {}) {
+    if (await this.findNode(mapId, ref)) return false;
+    await this.db.insert(flowMapNodes3).values({
+      mapId,
+      connectionId: ref.connectionId,
+      queueName: ref.queueName,
+      x: pos.x ?? null,
+      y: pos.y ?? null
+    });
+    return true;
+  }
+  async addNode(id3, input) {
+    await this.writable(id3);
     await this.connections.getRow(input.connectionId);
-    if (input.from === input.to) throw conflict("A queue cannot flow into itself");
-    const existing = await this.db.select({ id: flowEdges3.id }).from(flowEdges3).where(
-      and5(
-        eq6(flowEdges3.connectionId, input.connectionId),
-        eq6(flowEdges3.fromQueue, input.from),
-        eq6(flowEdges3.toQueue, input.to)
+    const added = await this.ensureNode(id3, input, input);
+    if (!added && (input.x !== void 0 || input.y !== void 0)) {
+      const patch = {};
+      if (input.x !== void 0) patch.x = input.x;
+      if (input.y !== void 0) patch.y = input.y;
+      await this.db.update(flowMapNodes3).set(patch).where(and6(eq7(flowMapNodes3.mapId, id3), eq7(flowMapNodes3.connectionId, input.connectionId), eq7(flowMapNodes3.queueName, input.queueName)));
+    }
+    await this.touch(id3);
+    return this.get(id3);
+  }
+  async removeNode(id3, nodeId) {
+    await this.writable(id3);
+    const ref = parseNodeId(nodeId);
+    if (!ref || !await this.findNode(id3, ref)) throw notFound("Queue on this flow map");
+    await this.db.transaction(async (tx) => {
+      await tx.delete(flowMapEdges3).where(
+        and6(
+          eq7(flowMapEdges3.mapId, id3),
+          or3(
+            and6(eq7(flowMapEdges3.fromConnectionId, ref.connectionId), eq7(flowMapEdges3.fromQueue, ref.queueName)),
+            and6(eq7(flowMapEdges3.toConnectionId, ref.connectionId), eq7(flowMapEdges3.toQueue, ref.queueName))
+          )
+        )
+      );
+      await tx.delete(flowMapNodes3).where(and6(eq7(flowMapNodes3.mapId, id3), eq7(flowMapNodes3.connectionId, ref.connectionId), eq7(flowMapNodes3.queueName, ref.queueName)));
+    });
+    await this.touch(id3);
+    return this.get(id3);
+  }
+  async saveLayout(id3, input) {
+    await this.writable(id3);
+    const known = new Set(
+      (await this.db.select({ connectionId: flowMapNodes3.connectionId, queueName: flowMapNodes3.queueName }).from(flowMapNodes3).where(eq7(flowMapNodes3.mapId, id3))).map(
+        (n) => flowMapNodeId(n)
       )
-    ).limit(1);
-    if (existing[0]) throw conflict("This edge already exists");
-    const id3 = nanoid5();
-    await this.db.insert(flowEdges3).values({
-      id: id3,
-      connectionId: input.connectionId,
-      fromQueue: input.from,
-      toQueue: input.to,
-      label: input.label ?? null,
-      createdAt: /* @__PURE__ */ new Date()
+    );
+    const positions = /* @__PURE__ */ new Map();
+    for (const p of input.positions) if (known.has(p.nodeId)) positions.set(p.nodeId, { x: p.x, y: p.y });
+    await this.db.transaction(async (tx) => {
+      for (const [nodeId, pos] of positions) {
+        const ref = parseNodeId(nodeId);
+        await tx.update(flowMapNodes3).set(pos).where(and6(eq7(flowMapNodes3.mapId, id3), eq7(flowMapNodes3.connectionId, ref.connectionId), eq7(flowMapNodes3.queueName, ref.queueName)));
+      }
+      await tx.update(flowMaps3).set({ updatedAt: /* @__PURE__ */ new Date() }).where(eq7(flowMaps3.id, id3));
     });
-    const rows = await this.db.select().from(flowEdges3).where(eq6(flowEdges3.id, id3)).limit(1);
+  }
+  async findEdge(mapId, from, to) {
+    const rows = await this.db.select().from(flowMapEdges3).where(
+      and6(
+        eq7(flowMapEdges3.mapId, mapId),
+        eq7(flowMapEdges3.fromConnectionId, from.connectionId),
+        eq7(flowMapEdges3.fromQueue, from.queueName),
+        eq7(flowMapEdges3.toConnectionId, to.connectionId),
+        eq7(flowMapEdges3.toQueue, to.queueName)
+      )
+    ).limit(1);
+    return rows[0] ?? null;
+  }
+  /**
+   * Idempotent on the full (from, to) refs, connection included: the same queue
+   * name on two connections is two different nodes, and an edge may go from one
+   * connection to another (Redis → Postgres included).
+   */
+  async addEdge(id3, input) {
+    await this.writable(id3);
+    if (sameRef(input.from, input.to)) throw conflict("A queue cannot flow into itself");
+    await this.connections.getRow(input.from.connectionId);
+    if (input.to.connectionId !== input.from.connectionId) await this.connections.getRow(input.to.connectionId);
+    await this.ensureNode(id3, input.from);
+    await this.ensureNode(id3, input.to);
+    const existing = await this.findEdge(id3, input.from, input.to);
+    if (existing) {
+      if (input.label !== void 0) await this.db.update(flowMapEdges3).set({ label: input.label }).where(eq7(flowMapEdges3.id, existing.id));
+    } else {
+      await this.db.insert(flowMapEdges3).values({
+        id: nanoid6(),
+        mapId: id3,
+        fromConnectionId: input.from.connectionId,
+        fromQueue: input.from.queueName,
+        toConnectionId: input.to.connectionId,
+        toQueue: input.to.queueName,
+        label: input.label ?? null,
+        createdAt: /* @__PURE__ */ new Date()
+      });
+    }
+    await this.touch(id3);
+    return this.get(id3);
+  }
+  async edgeOf(mapId, edgeId) {
+    const rows = await this.db.select().from(flowMapEdges3).where(and6(eq7(flowMapEdges3.mapId, mapId), eq7(flowMapEdges3.id, edgeId))).limit(1);
     const row = rows[0];
-    if (!row) throw notFound("Flow edge");
-    return toFlowEdgeDto(row);
+    if (!row) throw notFound("Flow map edge");
+    return row;
   }
-  async deleteManualEdge(id3) {
-    const rows = await this.db.select({ id: flowEdges3.id }).from(flowEdges3).where(eq6(flowEdges3.id, id3)).limit(1);
-    if (!rows[0]) throw notFound("Flow edge");
-    await this.db.delete(flowEdges3).where(eq6(flowEdges3.id, id3));
+  async updateEdge(id3, edgeId, input) {
+    await this.writable(id3);
+    await this.edgeOf(id3, edgeId);
+    await this.db.update(flowMapEdges3).set({ label: input.label }).where(eq7(flowMapEdges3.id, edgeId));
+    await this.touch(id3);
+    return this.get(id3);
+  }
+  async removeEdge(id3, edgeId) {
+    await this.writable(id3);
+    await this.edgeOf(id3, edgeId);
+    await this.db.delete(flowMapEdges3).where(eq7(flowMapEdges3.id, edgeId));
+    await this.touch(id3);
+    return this.get(id3);
+  }
+  /**
+   * A new manual map with the same queues and positions. Works on detected maps
+   * too (that is how one becomes editable). A manual map's drawn edges come
+   * along; detected edges are not turned into manual ones, they keep being drawn
+   * from the live sample.
+   */
+  async copy(id3, input) {
+    const src = await this.source(id3);
+    const name = input.name ?? `${src.summary.name} (copy)`.slice(0, NAME_MAX);
+    const newId = await this.insertMap({ name, description: src.summary.description, parentId: input.parentId ?? null });
+    await this.db.transaction(async (tx) => {
+      if (src.nodes.length > 0) {
+        await tx.insert(flowMapNodes3).values(src.nodes.map((n) => ({ mapId: newId, connectionId: n.connectionId, queueName: n.queueName, x: n.x, y: n.y })));
+      }
+      if (src.manualEdges.length > 0) {
+        const now = /* @__PURE__ */ new Date();
+        await tx.insert(flowMapEdges3).values(
+          src.manualEdges.map((e) => ({
+            id: nanoid6(),
+            mapId: newId,
+            fromConnectionId: e.fromConnectionId,
+            fromQueue: e.fromQueue,
+            toConnectionId: e.toConnectionId,
+            toQueue: e.toQueue,
+            label: e.label ?? null,
+            createdAt: now
+          }))
+        );
+      }
+    });
+    return this.get(newId);
   }
 };
 
 // apps/server/src/ee/services/folders.ts
-import { eq as eq7, inArray as inArray2 } from "drizzle-orm";
-import { nanoid as nanoid6 } from "nanoid";
+import { eq as eq8, inArray as inArray3 } from "drizzle-orm";
+import { nanoid as nanoid7 } from "nanoid";
 var FoldersService = class {
   constructor(db) {
     this.db = db;
@@ -8908,7 +9617,7 @@ var FoldersService = class {
     const rows = await this.db.select().from(folders3).orderBy(folders3.position, folders3.name);
     if (rows.length === 0) return [];
     const refs = await this.db.select().from(folderQueues3).where(
-      inArray2(
+      inArray3(
         folderQueues3.folderId,
         rows.map((r) => r.id)
       )
@@ -8922,10 +9631,10 @@ var FoldersService = class {
     return rows.map((row) => toFolderDto(row, byFolder.get(row.id) ?? []));
   }
   async get(id3) {
-    const rows = await this.db.select().from(folders3).where(eq7(folders3.id, id3)).limit(1);
+    const rows = await this.db.select().from(folders3).where(eq8(folders3.id, id3)).limit(1);
     const row = rows[0];
     if (!row) throw notFound("Folder");
-    const refs = await this.db.select().from(folderQueues3).where(eq7(folderQueues3.folderId, id3));
+    const refs = await this.db.select().from(folderQueues3).where(eq8(folderQueues3.folderId, id3));
     return toFolderDto(
       row,
       refs.map((r) => ({ connectionId: r.connectionId, queueName: r.queueName }))
@@ -8933,7 +9642,7 @@ var FoldersService = class {
   }
   async create(input) {
     if (input.parentId) await this.get(input.parentId);
-    const id3 = nanoid6();
+    const id3 = nanoid7();
     const siblings = await this.db.select({ id: folders3.id }).from(folders3);
     await this.db.insert(folders3).values({
       id: id3,
@@ -8956,21 +9665,21 @@ var FoldersService = class {
     if (input.parentId !== void 0) patch.parentId = input.parentId;
     if (input.position !== void 0) patch.position = input.position;
     if (Object.keys(patch).length > 0) {
-      await this.db.update(folders3).set(patch).where(eq7(folders3.id, id3));
+      await this.db.update(folders3).set(patch).where(eq8(folders3.id, id3));
     }
     return this.get(id3);
   }
   async remove(id3) {
     await this.get(id3);
-    await this.db.update(folders3).set({ parentId: null }).where(eq7(folders3.parentId, id3));
-    await this.db.delete(folderQueues3).where(eq7(folderQueues3.folderId, id3));
-    await this.db.delete(folders3).where(eq7(folders3.id, id3));
+    await this.db.update(folders3).set({ parentId: null }).where(eq8(folders3.parentId, id3));
+    await this.db.delete(folderQueues3).where(eq8(folderQueues3.folderId, id3));
+    await this.db.delete(folders3).where(eq8(folders3.id, id3));
   }
   async setQueues(id3, queues) {
     await this.get(id3);
     const unique = /* @__PURE__ */ new Map();
     for (const q of queues) unique.set(`${q.connectionId}|${q.queueName}`, q);
-    await this.db.delete(folderQueues3).where(eq7(folderQueues3.folderId, id3));
+    await this.db.delete(folderQueues3).where(eq8(folderQueues3.folderId, id3));
     if (unique.size > 0) {
       await this.db.insert(folderQueues3).values([...unique.values()].map((q) => ({ folderId: id3, connectionId: q.connectionId, queueName: q.queueName })));
     }
@@ -9184,8 +9893,8 @@ function buildPostgresWarnings(info, error) {
 }
 
 // apps/server/src/ee/services/sso.ts
-import { asc as asc2, eq as eq8 } from "drizzle-orm";
-import { nanoid as nanoid7 } from "nanoid";
+import { asc as asc2, eq as eq9 } from "drizzle-orm";
+import { nanoid as nanoid8 } from "nanoid";
 var REQUIRE_SSO_KEY = "sso.require_sso";
 var AUTO_PROVISION_KEY = "sso.auto_provision";
 var AUTO_PROVISION_DOMAINS_KEY = "sso.auto_provision_domains";
@@ -9227,7 +9936,7 @@ var SsoService = class {
     return rows.map((r) => this.toDto(r));
   }
   async getRow(id3) {
-    const rows = await this.db.select().from(ssoProviders3).where(eq8(ssoProviders3.id, id3)).limit(1);
+    const rows = await this.db.select().from(ssoProviders3).where(eq9(ssoProviders3.id, id3)).limit(1);
     const row = rows[0];
     if (!row) throw notFound("SSO provider");
     return row;
@@ -9236,7 +9945,7 @@ var SsoService = class {
     return this.toDto(await this.getRow(id3));
   }
   async create(input) {
-    const id3 = nanoid7();
+    const id3 = nanoid8();
     const now = /* @__PURE__ */ new Date();
     const { config, secretEnc } = this.splitSecret(input.kind, input.config);
     await this.db.insert(ssoProviders3).values({
@@ -9265,19 +9974,19 @@ var SsoService = class {
     }
     if (Object.keys(patch).length > 0) {
       patch.updatedAt = /* @__PURE__ */ new Date();
-      await this.db.update(ssoProviders3).set(patch).where(eq8(ssoProviders3.id, id3));
+      await this.db.update(ssoProviders3).set(patch).where(eq9(ssoProviders3.id, id3));
     }
     return this.get(id3);
   }
   async remove(id3) {
     const row = await this.getRow(id3);
     if (row.enabled && await this.requireSso()) {
-      const others = (await this.db.select().from(ssoProviders3).where(eq8(ssoProviders3.enabled, true))).filter((r) => r.id !== id3);
+      const others = (await this.db.select().from(ssoProviders3).where(eq9(ssoProviders3.enabled, true))).filter((r) => r.id !== id3);
       if (others.length === 0) {
         throw conflict('This is the only enabled SSO provider and "require SSO" is on. Turn that off before deleting it.');
       }
     }
-    await this.db.delete(ssoProviders3).where(eq8(ssoProviders3.id, id3));
+    await this.db.delete(ssoProviders3).where(eq9(ssoProviders3.id, id3));
   }
   /**
    * Pulls the write-only secret out of a config object, encrypts it, and
@@ -9312,7 +10021,7 @@ var SsoService = class {
   }
   async setRequireSso(value) {
     if (value) {
-      const enabled = await this.db.select().from(ssoProviders3).where(eq8(ssoProviders3.enabled, true));
+      const enabled = await this.db.select().from(ssoProviders3).where(eq9(ssoProviders3.enabled, true));
       if (enabled.length === 0) {
         throw conflict("Add and enable an SSO provider before requiring SSO, or nobody will be able to sign in.");
       }
@@ -9375,7 +10084,7 @@ var SsoService = class {
    * IdP: the button label is enough to start the flow.
    */
   async loginOptions() {
-    const rows = await this.db.select().from(ssoProviders3).where(eq8(ssoProviders3.enabled, true)).orderBy(asc2(ssoProviders3.createdAt));
+    const rows = await this.db.select().from(ssoProviders3).where(eq9(ssoProviders3.enabled, true)).orderBy(asc2(ssoProviders3.createdAt));
     const providers = rows.map((r) => ({ id: r.id, kind: r.kind, name: r.name }));
     const requireSso = providers.length > 0 && await this.requireSso();
     return {
@@ -9393,7 +10102,7 @@ var SsoService = class {
   async resolveUser(email) {
     const normalised = email.trim().toLowerCase();
     if (!normalised) return null;
-    const rows = await this.db.select().from(users3).where(eq8(users3.email, normalised)).limit(1);
+    const rows = await this.db.select().from(users3).where(eq9(users3.email, normalised)).limit(1);
     const row = rows[0];
     return row ? toUserDto(row) : null;
   }
@@ -9422,6 +10131,9 @@ function textResult(value, isError = false) {
 }
 async function forward(ctx, req) {
   const { status, body } = await ctx.call(req);
+  return apiResult(status, body);
+}
+function apiResult(status, body) {
   if (status >= 400) {
     const b = body ?? {};
     const hint = status === 403 ? " (MCP calls act with your role, capped to the access this connection was given: read = viewer, write = operator)" : "";
@@ -9444,6 +10156,23 @@ var zConn = z10.object({ connection_id: z10.string().min(1) });
 var zQueue = zConn.extend({ queue: z10.string().min(1) });
 var zJob = zQueue.extend({ job_id: z10.string().min(1) });
 var zState = z10.enum(JOB_STATES);
+var zMap = z10.object({ map_id: z10.string().min(1) });
+var mapPath = (a) => `/api/flow-maps/${seg(a.map_id)}`;
+async function connectionOrDefault(ctx, given) {
+  if (given) return { id: given };
+  const res = await ctx.call({ method: "GET", url: "/api/connections" });
+  if (res.status >= 400) return { error: apiResult(res.status, res.body) };
+  const list = Array.isArray(res.body) ? res.body : [];
+  if (list.length === 1) return { id: list[0].id };
+  if (list.length === 0) return { error: textResult("validation: Bullpane has no connection yet; add one in the dashboard first.", true) };
+  const names = list.map((c) => `${c.name} (${c.id})`).join(", ");
+  return {
+    error: textResult(
+      `validation: connection_id is required: this installation has ${list.length} connections (${names}). Pass the connection of each queue; list_connections shows them.`,
+      true
+    )
+  };
+}
 var ro = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false };
 var rw = (destructive, idempotent) => ({ readOnlyHint: false, destructiveHint: destructive, idempotentHint: idempotent, openWorldHint: false });
 function tool(def) {
@@ -9718,6 +10447,158 @@ var MCP_TOOLS = [
     schema: zQueue.extend({ group_id: z10.string().min(1).max(200) }),
     run: (a, ctx) => forward(ctx, { method: "POST", url: `${queuePath(a)}/groups/${seg(a.group_id)}/resume` })
   }),
+  // ----- flow maps (Pro): drawings of a process, read and write -----
+  tool({
+    name: "list_flow_maps",
+    title: "List flow maps",
+    description: "Lists the flow maps: named diagrams of the queues one process goes through. kind manual = drawn by people (nested by parentId, like folders); kind detected = computed, read-only, one per group of queues linked by BullMQ FlowProducer parents. Use get_flow_map for a map's queues, arrows and live counts.",
+    access: "read",
+    inputSchema: object({}, []),
+    annotations: ro,
+    schema: z10.object({}),
+    run: (_a, ctx) => forward(ctx, { method: "GET", url: "/api/flow-maps" })
+  }),
+  tool({
+    name: "get_flow_map",
+    title: "Get flow map",
+    description: "One flow map: its queues (node id = connectionId:queueName) with live job counts, and its arrows (edges, from \u2192 to). source manual = drawn, with an edge id for remove_flow_edge; source detected = seen in BullMQ flows, not removable. missing: true means the queue was not found on its connection.",
+    access: "read",
+    inputSchema: object({ map_id: str4("Flow map id, from list_flow_maps") }, ["map_id"]),
+    annotations: ro,
+    schema: zMap,
+    run: (a, ctx) => forward(ctx, { method: "GET", url: mapPath(a) })
+  }),
+  tool({
+    name: "create_flow_map",
+    title: "Create flow map",
+    description: "Creates an empty flow map to draw a process on. Then call add_flow_edge once per hop (work goes from_queue \u2192 to_queue): queues not on the map yet are added automatically, so the edges alone draw the whole process. Use add_flow_queue only for a queue with no arrow. parent_id nests it under another map.",
+    access: "write",
+    inputSchema: object(
+      { name: str4("Map name, e.g. the process: Checkout", { maxLength: 80 }), description: str4("What the process does", { maxLength: 500 }), parent_id: str4("Manual map to nest it under") },
+      ["name"]
+    ),
+    annotations: rw(false, false),
+    schema: z10.object({ name: z10.string().trim().min(1).max(80), description: z10.string().max(500).optional(), parent_id: z10.string().min(1).optional() }),
+    run: (a, ctx) => forward(ctx, { method: "POST", url: "/api/flow-maps", body: { name: a.name, description: a.description, parentId: a.parent_id } })
+  }),
+  tool({
+    name: "update_flow_map",
+    title: "Rename or move flow map",
+    description: "Renames a manual flow map, changes its description, or moves it under another map (parent_id; null moves it to the top level). Detected maps are read-only: copy_flow_map them first.",
+    access: "write",
+    inputSchema: object(
+      {
+        map_id: str4("Flow map id"),
+        name: str4("New name", { maxLength: 80 }),
+        description: { type: ["string", "null"], description: "New description; null clears it" },
+        parent_id: { type: ["string", "null"], description: "Map to move it under; null = top level" }
+      },
+      ["map_id"]
+    ),
+    annotations: rw(false, true),
+    schema: zMap.extend({ name: z10.string().trim().min(1).max(80).optional(), description: z10.string().max(500).nullable().optional(), parent_id: z10.string().min(1).nullable().optional() }),
+    run: (a, ctx) => forward(ctx, { method: "PATCH", url: mapPath(a), body: { name: a.name, description: a.description, parentId: a.parent_id } })
+  }),
+  tool({
+    name: "delete_flow_map",
+    title: "Delete flow map",
+    description: "Deletes a manual flow map and its drawing. Only the drawing: no queue or job is touched. Maps nested under it move up one level.",
+    access: "write",
+    inputSchema: object({ map_id: str4("Flow map id") }, ["map_id"]),
+    annotations: rw(true, true),
+    schema: zMap,
+    run: (a, ctx) => forward(ctx, { method: "DELETE", url: mapPath(a) })
+  }),
+  tool({
+    name: "add_flow_queue",
+    title: "Add queue to flow map",
+    description: "Puts a queue on a manual flow map. Idempotent. Not needed for queues that have an arrow: add_flow_edge adds both ends. The queue does not have to exist yet (it shows as missing). connection_id may be omitted when Bullpane has exactly one connection.",
+    access: "write",
+    inputSchema: object({ map_id: str4("Flow map id"), queue: str4("Queue name"), connection_id: str4("Connection of the queue, from list_connections (optional with a single connection)") }, ["map_id", "queue"]),
+    annotations: rw(false, true),
+    schema: zMap.extend({ queue: z10.string().min(1).max(255), connection_id: z10.string().min(1).optional() }),
+    run: async (a, ctx) => {
+      const conn = await connectionOrDefault(ctx, a.connection_id);
+      if ("error" in conn) return conn.error;
+      return forward(ctx, { method: "POST", url: `${mapPath(a)}/nodes`, body: { connectionId: conn.id, queueName: a.queue } });
+    }
+  }),
+  tool({
+    name: "remove_flow_queue",
+    title: "Remove queue from flow map",
+    description: "Takes a queue off a manual flow map, with the drawn arrows touching it. Only the drawing: the queue itself is untouched. connection_id may be omitted when Bullpane has exactly one connection.",
+    access: "write",
+    inputSchema: object({ map_id: str4("Flow map id"), queue: str4("Queue name"), connection_id: str4("Connection of the queue (optional with a single connection)") }, ["map_id", "queue"]),
+    annotations: rw(true, true),
+    schema: zMap.extend({ queue: z10.string().min(1).max(255), connection_id: z10.string().min(1).optional() }),
+    run: async (a, ctx) => {
+      const conn = await connectionOrDefault(ctx, a.connection_id);
+      if ("error" in conn) return conn.error;
+      return forward(ctx, { method: "DELETE", url: `${mapPath(a)}/nodes/${seg(flowMapNodeId({ connectionId: conn.id, queueName: a.queue }))}` });
+    }
+  }),
+  tool({
+    name: "add_flow_edge",
+    title: "Draw an arrow on a flow map",
+    description: "Draws one hop of a process on a manual flow map: work goes from from_queue to to_queue (the producer side to the consumer side). Call it once per hop; queues not on the map yet are added automatically. Idempotent: drawing the same arrow again only updates its label. The two queues may be on different connections (another Redis, or Postgres): pass from_connection_id and to_connection_id. Each may be omitted only when Bullpane has exactly one connection.",
+    access: "write",
+    inputSchema: object(
+      {
+        map_id: str4("Flow map id"),
+        from_queue: str4("Queue the work comes from"),
+        to_queue: str4("Queue the work goes to"),
+        label: str4("Short text on the arrow, e.g. 'per item' or 'on failure'", { maxLength: 120 }),
+        from_connection_id: str4("Connection of from_queue, from list_connections (optional with a single connection)"),
+        to_connection_id: str4("Connection of to_queue (optional with a single connection)")
+      },
+      ["map_id", "from_queue", "to_queue"]
+    ),
+    annotations: rw(false, true),
+    schema: zMap.extend({
+      from_queue: z10.string().min(1).max(255),
+      to_queue: z10.string().min(1).max(255),
+      label: z10.string().max(120).optional(),
+      from_connection_id: z10.string().min(1).optional(),
+      to_connection_id: z10.string().min(1).optional()
+    }),
+    run: async (a, ctx) => {
+      let fallback = null;
+      const pick = async (given) => {
+        if (given) return { id: given };
+        fallback ??= await connectionOrDefault(ctx, void 0);
+        return fallback;
+      };
+      const from = await pick(a.from_connection_id);
+      if ("error" in from) return from.error;
+      const to = await pick(a.to_connection_id);
+      if ("error" in to) return to.error;
+      return forward(ctx, {
+        method: "POST",
+        url: `${mapPath(a)}/edges`,
+        body: { from: { connectionId: from.id, queueName: a.from_queue }, to: { connectionId: to.id, queueName: a.to_queue }, label: a.label }
+      });
+    }
+  }),
+  tool({
+    name: "remove_flow_edge",
+    title: "Remove an arrow from a flow map",
+    description: "Removes a drawn arrow (source manual) from a manual flow map; its edge id is in get_flow_map. The queues stay on the map. Detected arrows cannot be removed.",
+    access: "write",
+    inputSchema: object({ map_id: str4("Flow map id"), edge_id: str4("Edge id, from get_flow_map") }, ["map_id", "edge_id"]),
+    annotations: rw(true, true),
+    schema: zMap.extend({ edge_id: z10.string().min(1) }),
+    run: (a, ctx) => forward(ctx, { method: "DELETE", url: `${mapPath(a)}/edges/${seg(a.edge_id)}` })
+  }),
+  tool({
+    name: "copy_flow_map",
+    title: "Copy flow map",
+    description: "Copies a flow map into a new manual one with the same queues and positions (and drawn arrows). This is how a detected map becomes editable; its detected arrows keep being shown live, they are not copied.",
+    access: "write",
+    inputSchema: object({ map_id: str4("Flow map id to copy (manual or detected)"), name: str4("Name of the copy (default: '<name> (copy)')", { maxLength: 80 }), parent_id: str4("Manual map to nest the copy under") }, ["map_id"]),
+    annotations: rw(false, false),
+    schema: zMap.extend({ name: z10.string().trim().min(1).max(80).optional(), parent_id: z10.string().min(1).optional() }),
+    run: (a, ctx) => forward(ctx, { method: "POST", url: `${mapPath(a)}/copy`, body: { name: a.name, parentId: a.parent_id } })
+  }),
   // ----- destructive: a link, never an action -----
   tool({
     name: "request_destructive_action",
@@ -9933,7 +10814,7 @@ This connection has ${caller.access} access as ${caller.user.email}.`
 }
 
 // apps/server/src/ee/mcp/store.ts
-import { and as and6, desc as desc3, eq as eq9, lt as lt4, notInArray } from "drizzle-orm";
+import { and as and7, desc as desc3, eq as eq10, lt as lt4, notInArray } from "drizzle-orm";
 function affectedRows(result) {
   const header = Array.isArray(result) ? result[0] : result;
   if (typeof header !== "object" || header === null) return 0;
@@ -9949,7 +10830,7 @@ var DrizzleMcpStore = class {
     await this.db.insert(mcpClients3).values(row);
   }
   async getClient(id3) {
-    const rows = await this.db.select().from(mcpClients3).where(eq9(mcpClients3.id, id3)).limit(1);
+    const rows = await this.db.select().from(mcpClients3).where(eq10(mcpClients3.id, id3)).limit(1);
     return rows[0] ?? null;
   }
   async countClients() {
@@ -9957,16 +10838,16 @@ var DrizzleMcpStore = class {
   }
   async purgeUnusedClients(before) {
     const used = this.db.selectDistinct({ id: mcpGrants3.clientId }).from(mcpGrants3);
-    await this.db.delete(mcpClients3).where(and6(lt4(mcpClients3.createdAt, before), notInArray(mcpClients3.id, used)));
+    await this.db.delete(mcpClients3).where(and7(lt4(mcpClients3.createdAt, before), notInArray(mcpClients3.id, used)));
   }
   async insertCode(row) {
     await this.db.insert(mcpAuthCodes3).values(row);
   }
   async consumeCode(codeHash) {
-    const rows = await this.db.select().from(mcpAuthCodes3).where(eq9(mcpAuthCodes3.codeHash, codeHash)).limit(1);
+    const rows = await this.db.select().from(mcpAuthCodes3).where(eq10(mcpAuthCodes3.codeHash, codeHash)).limit(1);
     const row = rows[0];
     if (!row) return null;
-    const res = await this.db.delete(mcpAuthCodes3).where(eq9(mcpAuthCodes3.codeHash, codeHash));
+    const res = await this.db.delete(mcpAuthCodes3).where(eq10(mcpAuthCodes3.codeHash, codeHash));
     return affectedRows(res) === 1 ? row : null;
   }
   async purgeExpiredCodes(now) {
@@ -9976,40 +10857,40 @@ var DrizzleMcpStore = class {
     await this.db.insert(mcpGrants3).values(row);
   }
   async findGrantByRefresh(refreshHash) {
-    const rows = await this.db.select().from(mcpGrants3).where(eq9(mcpGrants3.refreshHash, refreshHash)).limit(1);
+    const rows = await this.db.select().from(mcpGrants3).where(eq10(mcpGrants3.refreshHash, refreshHash)).limit(1);
     return rows[0] ?? null;
   }
   async findGrantByPrevRefresh(refreshHash) {
-    const rows = await this.db.select().from(mcpGrants3).where(eq9(mcpGrants3.prevRefreshHash, refreshHash)).limit(1);
+    const rows = await this.db.select().from(mcpGrants3).where(eq10(mcpGrants3.prevRefreshHash, refreshHash)).limit(1);
     return rows[0] ?? null;
   }
   async rotateRefresh(grantId, oldHash, newHash, expiresAt) {
-    const res = await this.db.update(mcpGrants3).set({ refreshHash: newHash, prevRefreshHash: oldHash, refreshExpiresAt: expiresAt }).where(and6(eq9(mcpGrants3.id, grantId), eq9(mcpGrants3.refreshHash, oldHash)));
+    const res = await this.db.update(mcpGrants3).set({ refreshHash: newHash, prevRefreshHash: oldHash, refreshExpiresAt: expiresAt }).where(and7(eq10(mcpGrants3.id, grantId), eq10(mcpGrants3.refreshHash, oldHash)));
     return affectedRows(res) === 1;
   }
   async getGrantWithUser(grantId) {
-    const rows = await this.db.select({ grant: mcpGrants3, user: users3, clientName: mcpClients3.name, redirectUris: mcpClients3.redirectUris }).from(mcpGrants3).innerJoin(users3, eq9(mcpGrants3.userId, users3.id)).innerJoin(mcpClients3, eq9(mcpGrants3.clientId, mcpClients3.id)).where(eq9(mcpGrants3.id, grantId)).limit(1);
+    const rows = await this.db.select({ grant: mcpGrants3, user: users3, clientName: mcpClients3.name, redirectUris: mcpClients3.redirectUris }).from(mcpGrants3).innerJoin(users3, eq10(mcpGrants3.userId, users3.id)).innerJoin(mcpClients3, eq10(mcpGrants3.clientId, mcpClients3.id)).where(eq10(mcpGrants3.id, grantId)).limit(1);
     return rows[0] ?? null;
   }
   async touchGrant(grantId, at) {
-    await this.db.update(mcpGrants3).set({ lastUsedAt: at }).where(eq9(mcpGrants3.id, grantId));
+    await this.db.update(mcpGrants3).set({ lastUsedAt: at }).where(eq10(mcpGrants3.id, grantId));
   }
   async deleteGrant(grantId) {
-    await this.db.delete(mcpGrants3).where(eq9(mcpGrants3.id, grantId));
+    await this.db.delete(mcpGrants3).where(eq10(mcpGrants3.id, grantId));
   }
   async deleteGrantsForUser(userId) {
-    await this.db.delete(mcpGrants3).where(eq9(mcpGrants3.userId, userId));
+    await this.db.delete(mcpGrants3).where(eq10(mcpGrants3.userId, userId));
   }
   async listGrants(userId) {
-    const q = this.db.select({ grant: mcpGrants3, user: users3, clientName: mcpClients3.name, redirectUris: mcpClients3.redirectUris }).from(mcpGrants3).innerJoin(users3, eq9(mcpGrants3.userId, users3.id)).innerJoin(mcpClients3, eq9(mcpGrants3.clientId, mcpClients3.id));
-    const rows = await (userId ? q.where(eq9(mcpGrants3.userId, userId)) : q).orderBy(desc3(mcpGrants3.createdAt)).limit(500);
+    const q = this.db.select({ grant: mcpGrants3, user: users3, clientName: mcpClients3.name, redirectUris: mcpClients3.redirectUris }).from(mcpGrants3).innerJoin(users3, eq10(mcpGrants3.userId, users3.id)).innerJoin(mcpClients3, eq10(mcpGrants3.clientId, mcpClients3.id));
+    const rows = await (userId ? q.where(eq10(mcpGrants3.userId, userId)) : q).orderBy(desc3(mcpGrants3.createdAt)).limit(500);
     return rows;
   }
 };
 
 // apps/server/src/services/users.ts
-import { and as and7, eq as eq10, isNull as isNull2 } from "drizzle-orm";
-import { nanoid as nanoid8 } from "nanoid";
+import { and as and8, eq as eq11, isNull as isNull3 } from "drizzle-orm";
+import { nanoid as nanoid9 } from "nanoid";
 var UsersService = class {
   constructor(db) {
     this.db = db;
@@ -10022,13 +10903,13 @@ var UsersService = class {
     return rows.map(toUserDto);
   }
   async getRow(id3) {
-    const rows = await this.db.select().from(users3).where(eq10(users3.id, id3)).limit(1);
+    const rows = await this.db.select().from(users3).where(eq11(users3.id, id3)).limit(1);
     const row = rows[0];
     if (!row) throw notFound("User");
     return row;
   }
   async findByEmail(email) {
-    const rows = await this.db.select().from(users3).where(eq10(users3.email, email.toLowerCase())).limit(1);
+    const rows = await this.db.select().from(users3).where(eq11(users3.email, email.toLowerCase())).limit(1);
     return rows[0] ?? null;
   }
   async create(input) {
@@ -10037,7 +10918,7 @@ var UsersService = class {
     if (existing) {
       throw conflict(existing.disabledAt ? "A disabled user has this email. Re-enable that account instead of creating a new one." : "A user with this email already exists");
     }
-    const id3 = nanoid8();
+    const id3 = nanoid9();
     await this.db.insert(users3).values({
       id: id3,
       email,
@@ -10069,16 +10950,16 @@ var UsersService = class {
       patch.disabledAt = input.disabled ? /* @__PURE__ */ new Date() : null;
     }
     if (Object.keys(patch).length > 0) {
-      await this.db.update(users3).set(patch).where(eq10(users3.id, id3));
+      await this.db.update(users3).set(patch).where(eq11(users3.id, id3));
     }
     return toUserDto(await this.getRow(id3));
   }
   async touchLogin(id3, at = /* @__PURE__ */ new Date()) {
-    await this.db.update(users3).set({ lastLoginAt: at }).where(eq10(users3.id, id3));
+    await this.db.update(users3).set({ lastLoginAt: at }).where(eq11(users3.id, id3));
   }
   /** Active admins only: a disabled admin cannot log in, so it does not keep the install manageable. */
   async adminCount() {
-    return (await this.db.select({ id: users3.id }).from(users3).where(and7(eq10(users3.role, "admin"), isNull2(users3.disabledAt)))).length;
+    return (await this.db.select({ id: users3.id }).from(users3).where(and8(eq11(users3.role, "admin"), isNull3(users3.disabledAt)))).length;
   }
 };
 
@@ -10118,6 +10999,7 @@ async function buildApp(opts) {
   const health = new HealthService(connections5);
   connections5.onEvict((id3) => health.evict(id3));
   const flows = new FlowsService(db, connections5);
+  const flowMaps4 = new FlowMapsService(db, connections5, flows);
   const alerts4 = new AlertsService(db, connections5, folders4);
   const audit = new AuditService(db, app.log);
   const attention = new AttentionService(new DrizzleSettingsStore(db));
@@ -10134,6 +11016,7 @@ async function buildApp(opts) {
     folders: folders4,
     health,
     flows,
+    flowMaps: flowMaps4,
     alerts: alerts4,
     alertsEngine,
     audit,