qlogicagent 2.12.11 → 2.12.13

package/dist/types/orchestration/workflow/capability-catalog.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Capability Catalog (spec D24) — THE single source of truth for "what can a workflow node
+ * actually reference". One catalog feeds five consumers: the AI graph builder's prompt +
+ * list_capabilities tool, the canvas "+" suggestions, the advanced node library, the node
+ * config dropdowns, and Hub bundle `requires` verification.
+ *
+ * Channels are deliberately ABSENT here: the engine is channel-opaque (delivery lives in the
+ * gateway), so the gateway merges its own channel registry into `workflow.capabilities` /
+ * `x/workflow.chat` responses. Everything else enumerates REAL runtime state — no static lists.
+ */
+import type { ToolDefinition } from "../../protocol/wire/chat-types.js";
+export type CapabilityCategory = "agent" | "tool" | "skill" | "mcp" | "memory" | "channel" | "control";
+export interface CapabilityEntry {
+    category: CapabilityCategory;
+    /** Workflow node kind that uses this capability. */
+    kind: string;
+    /** Concrete reference: tool name / agent id / "server.tool" / memory op / channel name. */
+    id: string;
+    /** Human-readable name for pickers and the AI prompt. */
+    label: string;
+    description?: string;
+    /** JSON schema of the underlying callable's input (tools/mcp), when known. */
+    paramsSchema?: Record<string, unknown>;
+    /** Prefill for add_node params when the user picks this entry. */
+    paramsTemplate?: Record<string, unknown>;
+}
+export interface CapabilityCatalogDeps {
+    getToolManifest(): ToolDefinition[];
+    /** Available agent ids a workflow `agent` node can target (self first). */
+    listAgentIds(): {
+        id: string;
+        name?: string;
+    }[];
+    /** Project root for project-scoped skill resolution. */
+    projectRoot: string;
+}
+/** Enumerate every capability a workflow in `projectRoot` can reference right now. */
+export declare function buildCapabilityCatalog(deps: CapabilityCatalogDeps): CapabilityEntry[];
+/**
+ * Compact catalog text for the AI graph builder's system prompt: category headers + `id — desc`
+ * lines, hard-capped per category so huge tool sets don't blow the prompt (the agent uses the
+ * list_capabilities tool for the long tail).
+ */
+export declare function renderCatalogForPrompt(entries: CapabilityEntry[], perCategoryCap?: number): string;
+/** Refs the validator extracts from a def to check against the catalog (anti-hallucination). */
+export declare function collectCapabilityRefs(def: {
+    nodes: {
+        id: string;
+        kind: string;
+        params?: Record<string, unknown>;
+    }[];
+}): {
+    category: CapabilityCategory;
+    ref: string;
+    nodeId: string;
+}[];
+/** Validate def refs against the catalog. Returns human-readable errors (empty = clean). */
+export declare function validateCapabilityRefs(def: {
+    nodes: {
+        id: string;
+        kind: string;
+        params?: Record<string, unknown>;
+    }[];
+}, entries: CapabilityEntry[]): string[];

package/dist/types/orchestration/workflow/expression.d.ts

@@ -37,6 +37,14 @@ export interface ExpressionContext {
  * Returns the raw value (object/array/number/string/boolean/null/undefined).
  */
 export declare function evaluateExpression(body: string, ctx: ExpressionContext): unknown;
+/**
+ * Static syntax+semantics gate: is `body` a valid expression of THIS language (no evaluation)?
+ * Beyond the grammar, it statically enforces what evalNode would reject at run time anyway:
+ * known context roots, whitelist function names, and "$node(...) is the only callable".
+ * Returns null when valid, else the error message. The n8n expression converter uses this as
+ * its single-track output gate — anything it emits must pass here.
+ */
+export declare function validateExpressionSyntax(body: string): string | null;
 /**
  * Resolve a binding template:
  *   - exactly `{{ expr }}` (whole string) → returns the raw evaluated value (keeps type)

package/dist/types/orchestration/workflow/host-executors.d.ts

@@ -9,7 +9,7 @@
  * to the host. fail-loud — invoking a host-backed kind with no host throws (no silent fallback).
  */
 import type { NodeExecutor } from "./node-schema.js";
-/** The host-backed kinds. Register these into a NodeRegistry to enable agent/tool/http/mcp/channel. */
+/** The host-backed kinds. Register these into a NodeRegistry to enable agent/tool/http/mcp/channel/skill/memory/subworkflow/approval. */
 export declare const hostExecutors: Record<string, NodeExecutor>;
 /** Host-backed kind names (used by callers to know which kinds need a host). */
 export declare const HOST_BACKED_KINDS: string[];

package/dist/types/orchestration/workflow/n8n-expression.d.ts

@@ -0,0 +1,48 @@
+/**
+ * n8n expression → restricted-language converter (IT-11, spec D35).
+ *
+ * n8n expressions are arbitrary JS inside `={{ }}`; our language is a fixed grammar
+ * (path access + literal + whitelist functions — see expression.ts, D6 hard line: NO eval).
+ * So conversion is a CURATED rewrite of the safe overlap, gated by our own parser:
+ * every rewritten body must pass `validateExpressionSyntax` or the whole parameter is
+ * flagged "manual" — we never emit anything our language can't parse, and we never
+ * approximate semantics silently.
+ *
+ * Convertible subset (n8n → ours):
+ *   $json.path / $json["k"]                     → unchanged
+ *   $node["X"].json.y                           → $node("X").output.default[0].json.y
+ *   $('X').item.json.y / $('X').first().json.y  → $node("X").output.default[0].json.y
+ *   $items("X")[i].json.y                       → $node("X").output.default[i].json.y
+ *   $input.item.json / $input.first().json      → $json
+ *   $now                                        → $now (note: n8n is Luxon, ours is Date)
+ * Anything else ($today, $binary, $workflow, .method() calls, operators, …) → manual.
+ */
+export type ExpressionConversion = {
+    ok: true;
+    converted: string;
+    notes: string[];
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Convert one n8n parameter STRING. n8n marks expression strings with a leading `=`;
+ * inside, `{{ }}` segments are evaluated and the rest is literal text. Strings without
+ * the `=` prefix are plain literals (returned unchanged, not counted as conversions).
+ */
+export declare function convertN8nExpression(raw: string): ExpressionConversion | null;
+export interface ParamConversionStats {
+    converted: number;
+    manual: Array<{
+        path: string;
+        raw: string;
+        reason: string;
+    }>;
+    notes: string[];
+}
+/**
+ * Deep-walk a params object converting every n8n expression string in place (returns a new
+ * object). Unconvertible expressions KEEP their raw n8n text (visible, greppable) and are
+ * reported in `stats.manual` — explicit degradation, never silent loss.
+ */
+export declare function convertN8nParams(params: Record<string, unknown>, stats: ParamConversionStats, basePath?: string): Record<string, unknown>;

package/dist/types/orchestration/workflow/n8n-import.d.ts

@@ -1,34 +1,67 @@
 /**
  * n8n workflow JSON import — read-format-only translator (plan M5 §2.1: "导入 n8n workflow JSON
- * (读格式,不打包其代码)").
+ * (读格式,不打包其代码)"), deepened for IT-11 (spec D35).
  *
  * Converts an n8n workflow export (its public JSON shape: `nodes` + `connections`) into our own
  * WorkflowDef. This reads n8n's data FORMAT only — it links/embeds NONE of n8n's runtime code, so
  * the SUL licensing concern (plan §2.1 / risk register) does not apply.
  *
- * Fail-loud, single-track (§1.5): the type map is CURATED. An unknown node type, an unmodeled
- * multi-output port, a connection referencing a missing node, or a malformed top-level shape is
- * REJECTED with a clear error — never silently coerced to a generic/passthrough fallback. The
- * converted def is returned raw; the caller runs it through `validateWorkflowDef` (every write path
- * does) so graph invariants are enforced by the single existing gate, not duplicated here.
+ * Error model (IT-11): STRUCTURAL problems (malformed JSON, duplicate/missing node names, dangling
+ * connections) stay fail-loud — the graph identity itself is broken, nothing useful survives.
+ * SEMANTIC gaps (unmapped node type, inconvertible expression, Code-node JS) DEGRADE EXPLICITLY:
+ * the node lands as kind "manual" (its executor throws at run time — never silently passes
+ * through), the original n8n type/params are preserved for the human, and every degradation is
+ * itemized in the returned ConversionReport. Nothing is silently dropped; no JS is ever executed
+ * (D6 hard line — n8n Code nodes are flagged manual, not emulated).
  *
- * Out of scope (intentionally, to avoid fabricating config): deriving a workflow-level TriggerDef
- * from n8n's structured trigger params. Recognized trigger nodes map to our `trigger` entry kind
- * (preserving their original type + params for visibility); the real schedule/webhook TriggerDef is
- * set afterward through the validated set_trigger channel.
+ * Credentials: n8n nodes carry `credentials: {type: {id,name}}` references. The secrets are NOT
+ * in the export — we extract them as CredentialRequirement entries (mapped to vault types, D29)
+ * so the import UI can walk the user through re-binding.
  */
 import type { WorkflowDef } from "./node-schema.js";
+export interface N8nNodeReport {
+    id: string;
+    n8nType: string;
+    /** converted=faithful; partial=landed but params need attention; manual=placeholder node; skipped=annotation dropped. */
+    outcome: "converted" | "partial" | "manual" | "skipped";
+    notes: string[];
+}
+export interface N8nCredentialRequirement {
+    nodeId: string;
+    n8nCredentialType: string;
+    /** n8n-side display name of the credential (helps the user recognize which secret to re-create). */
+    label?: string;
+    /** Suggested vault credential type (D29). */
+    suggestedVaultType: string;
+}
+export interface N8nConversionReport {
+    /** full=everything faithful; partial=some degradations; manual=at least one manual placeholder. */
+    status: "full" | "partial" | "manual";
+    nodes: N8nNodeReport[];
+    expressions: {
+        converted: number;
+        manual: Array<{
+            nodeId: string;
+            path: string;
+            raw: string;
+            reason: string;
+        }>;
+    };
+    credentials: N8nCredentialRequirement[];
+    notes: string[];
+}
 export interface N8nImportResult {
     name: string;
     def: WorkflowDef;
+    report: N8nConversionReport;
 }
-/** Thrown when an n8n workflow cannot be faithfully translated. Carries every problem found. */
+/** Thrown when an n8n workflow is STRUCTURALLY untranslatable. Carries every problem found. */
 export declare class N8nImportError extends Error {
     readonly errors: string[];
     constructor(errors: string[]);
 }
 /**
- * Convert an n8n workflow (a JSON string or already-parsed object) into a WorkflowDef.
+ * Convert an n8n workflow (a JSON string or already-parsed object) into a WorkflowDef + report.
  * The returned def is NOT yet graph-validated — pass it to `validateWorkflowDef` / a controller
  * write path, which is the single existing invariant gate.
  */

package/dist/types/orchestration/workflow/node-schema.d.ts

@@ -25,6 +25,20 @@ export interface WorkflowNodeDef {
     inPorts?: PortDef[];
     joinPolicy?: "all" | "any";
     maxIterations?: number;
+    /** Retry the executor on failure: total attempts = maxTries (≥1); exponential backoff from backoffMs (default 1000). */
+    retry?: {
+        maxTries: number;
+        backoffMs?: number;
+    };
+    /** Per-attempt deadline; the executor's signal aborts when exceeded (counts as a failure → retry applies). */
+    timeoutMs?: number;
+    /**
+     * What a FINAL failure (after retries) does to the run:
+     *   "stop"(default)= run fails loud; "continue" = node marked failed, fires no ports
+     *   (downstream skips), other branches keep running; "errorPort" = a DataItem with the
+     *   error routes out the "error" port (wire an error-handler/notify subgraph to it).
+     */
+    onError?: "stop" | "continue" | "errorPort";
 }
 /** A data edge (carries DataItem[]). fromPort/toPort default "default". */
 export interface DataEdge {
@@ -44,6 +58,8 @@ export interface WorkflowDef {
 export interface ExecutorContext {
     nodeId: string;
     kind: string;
+    /** Owning workflow id (def.id) — lets host-backed nodes (approval) tag outbound notifications. */
+    workflowId?: string;
     /** 0-based; increments per loop iteration (drives the cache key, spec §A5). */
     runIndex: number;
     vars: Record<string, unknown>;
@@ -76,6 +92,20 @@ export interface ExecutorHost {
     invokeMcp(req: McpHostRequest): Promise<DataItem[]>;
     /** Send a message out through a channel (飞书/微信/…) via the openclaw channel layer. */
     sendChannel(req: ChannelHostRequest): Promise<DataItem[]>;
+    /** Project-scoped memory (memdir) read/write/search for the `memory` kind (spec D25). */
+    memory?(req: MemoryHostRequest): Promise<DataItem[]>;
+    /** Run another workflow as a step (D34); the host enforces cycle guards. */
+    runSubworkflow?(req: SubworkflowHostRequest): Promise<DataItem[]>;
+    /**
+     * Human-in-the-loop approval (D34): notify the owner and AWAIT the decision in-memory
+     * (the run stays "running"; the node shows pending). A restart loses pending approvals —
+     * the run then fails loud (durable suspended-run resumption is a tracked follow-up).
+     */
+    approval?(req: ApprovalHostRequest): Promise<{
+        approved: boolean;
+        decidedAt: string;
+        note?: string;
+    }>;
 }
 export interface AgentHostRequest {
     agentId?: string;
@@ -94,6 +124,8 @@ export interface HttpHostRequest {
     url: string;
     headers?: Record<string, string>;
     body?: unknown;
+    /** Vault credential to inject as auth headers at execution time (D29; resolved host-side). */
+    credentialId?: string;
     signal?: AbortSignal;
 }
 export interface McpHostRequest {
@@ -109,6 +141,39 @@ export interface ChannelHostRequest {
     input: DataItem[];
     signal?: AbortSignal;
 }
+export interface SubworkflowHostRequest {
+    workflowId: string;
+    /** The calling workflow's id — joins the cycle-guard chain so top-level runs count too. */
+    callerWorkflowId?: string;
+    /** Cross-project call target; absent = the calling workflow's own project root. */
+    projectId?: string;
+    /** Becomes the sub-run's $trigger payload (falls back to the upstream item's json). */
+    payload?: Record<string, unknown>;
+    input: DataItem[];
+    signal?: AbortSignal;
+}
+export interface ApprovalHostRequest {
+    nodeId: string;
+    /** Owning workflow id so the approval surface can name/locate the workflow. */
+    workflowId?: string;
+    /** Plain-language question shown to the owner (默认 "继续执行?"). */
+    prompt?: string;
+    /** Auto-deny deadline; default 24h. */
+    timeoutMs?: number;
+    input: DataItem[];
+    signal?: AbortSignal;
+}
+export interface MemoryHostRequest {
+    op: "read" | "write" | "search";
+    /** Topic-file name; absent → operate on the always-visible index. */
+    key?: string;
+    /** Content for `write` (falls back to the upstream item's json when omitted). */
+    value?: unknown;
+    /** Query for `search`. */
+    query?: string;
+    input: DataItem[];
+    signal?: AbortSignal;
+}
 export interface NodeExecResult {
     /** outPort → DataItem[]. */
     outputs: PortMap;

package/dist/types/orchestration/workflow/qla-executor-host.d.ts

@@ -8,7 +8,8 @@
  * (`findTool`). fail-loud everywhere: unknown tool, missing channel host, or any rejection throws.
  */
 import type { RuntimeToolContract } from "../../runtime/ports/index.js";
-import type { ExecutorHost } from "./node-schema.js";
+import { type DataItem } from "./data-item.js";
+import type { ExecutorHost, MemoryHostRequest, SubworkflowHostRequest, ApprovalHostRequest } from "./node-schema.js";
 /** Injected boundary capabilities — supplied by the handler host that owns the real runners. */
 export interface QlaExecutorHostDeps {
     /** Run one agent turn (spawn external ACP agent + sendTask). Returns the agent's text output. */
@@ -36,6 +37,24 @@ export interface QlaExecutorHostDeps {
     }) => Promise<unknown>;
     /** Tool lookup supplied by the runtime host. */
     findTool: (name: string) => RuntimeToolContract | undefined;
+    /**
+     * Project-scoped memory backend for the `memory` kind (spec D25). The handler host wires
+     * the owning project root's memdir; absent → memory nodes fail-loud.
+     */
+    memory?: (req: MemoryHostRequest) => Promise<DataItem[]>;
+    /** Run another workflow as a step (D34); the handler enforces cycle guards. */
+    runSubworkflow?: (req: SubworkflowHostRequest) => Promise<DataItem[]>;
+    /** Human-in-the-loop approval (D34): notify + await the owner's decision. */
+    approval?: (req: ApprovalHostRequest) => Promise<{
+        approved: boolean;
+        decidedAt: string;
+        note?: string;
+    }>;
+    /**
+     * Vault credential → auth headers, resolved at EXECUTION time only (D29). Absent ⇒ http
+     * nodes carrying credentialId fail-loud (never silently unauthenticated).
+     */
+    resolveCredentialHeaders?: (credentialId: string) => Record<string, string>;
     /** fetch impl; defaults to global fetch. Injectable for tests. */
     fetchImpl?: typeof fetch;
 }

package/dist/types/orchestration/workflow/run-history-store.d.ts

@@ -26,6 +26,13 @@ export interface RunNodeRecord {
     executed: boolean;
     /** Truncated JSON preview of the node's output items (port → items[].json). */
     preview: string;
+    seq?: number;
+    startedAt?: string;
+    durationMs?: number;
+    attempts?: number;
+    cacheHit?: boolean;
+    /** Per-node disposition; "failed" with a surviving run = onError errorPort/continue (D32). */
+    nodeStatus?: "completed" | "failed";
 }
 export interface RunHistoryEntry {
     runId: string;
@@ -40,7 +47,7 @@ export interface RunHistoryEntry {
 }
 /** Summary row for list views — full node outputs stay behind get(). */
 export type RunHistorySummary = Omit<RunHistoryEntry, "nodes">;
-/** Build per-node output previews from a settled RunResult. */
+/** Build per-node output previews (+ D33 trace stats) from a settled RunResult. */
 export declare function buildNodeRecords(result: RunResult): Record<string, RunNodeRecord>;
 export declare class WorkflowRunHistoryStore {
     private readonly cwd;

package/dist/types/orchestration/workflow/workflow-audit-store.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Workflow audit log (IT-12, spec D38): WHO did WHAT to WHICH workflow WHEN —
+ * configuration/lifecycle changes only. Runs are deliberately NOT duplicated here:
+ * WorkflowRunHistoryStore is already the complete run audit (trigger/timing/status/per-node);
+ * a timeline UI merges both sources.
+ *
+ * Storage: append-only JSONL at `<project>/.qlogicagent/workflows/audit.jsonl` (project-level
+ * single file — the natural unit for a cross-workflow timeline). Entries are never rewritten.
+ */
+export interface WorkflowAuditEntry {
+    ts: string;
+    /** Owning user id (resolveActiveOwnerUserId) at the time of the action. */
+    actor: string;
+    /** e.g. created / updated / patched / activated / deactivated / published / archived /
+     *  reverted / deleted / imported / duplicated / permissionGranted / publishedToHub */
+    action: string;
+    workflowId: string;
+    detail?: Record<string, unknown>;
+}
+export declare class WorkflowAuditStore {
+    private readonly file;
+    /** `rootDir` = the project's workflows dir (same root the WorkflowStore uses). */
+    constructor(rootDir: string);
+    /**
+     * Append one entry. Failures are LOUD on stderr but never break the business write that
+     * triggered them (an audit-log disk error must not corrupt a successful state change).
+     */
+    append(entry: WorkflowAuditEntry): void;
+    /** Newest-first entries, optionally filtered to one workflow. Malformed lines are skipped loud. */
+    list(workflowId?: string, limit?: number): WorkflowAuditEntry[];
+}

package/dist/types/orchestration/workflow/workflow-bundle.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Portable workflow bundle (spec D23) — THE single serialization format shared by
+ * export / import / save-as(duplicate) / Hub publish / Hub apply. Two invariants:
+ *
+ * 1. SANITIZED: credentials never leave the machine inside a bundle. Any params key that
+ *    looks credential-shaped has its VALUE stripped and is recorded as a CredentialRequirement
+ *    the importer must re-bind. Unknown-but-suspicious shapes fail toward stripping (§1.5:
+ *    never silently carry a secret out).
+ * 2. SELF-DESCRIBING: `requires` lists the capabilities (tool/agent/mcp/channel/skill) the
+ *    graph references, so an importer (or the Hub apply checklist) can verify bindings
+ *    BEFORE activating instead of failing mid-run.
+ */
+import type { WorkflowDef } from "./node-schema.js";
+import type { TriggerDef } from "./workflow-trigger.js";
+import type { ConcurrencyPolicy, WorkflowRecord } from "./workflow-store.js";
+export declare const WORKFLOW_BUNDLE_SCHEMA_VERSION = 2;
+export interface CapabilityRequirement {
+    category: "agent" | "tool" | "skill" | "mcp" | "memory" | "channel";
+    kind: string;
+    /** Concrete capability reference (tool name / agent id / "server.tool" / channel name). */
+    ref: string;
+    /** Human-readable label shown in the apply/bind checklist. */
+    label: string;
+    nodeIds: string[];
+}
+export interface CredentialRequirement {
+    /** Best-effort type hint; v1 marks all stripped values "custom" (vault types land in IT-7). */
+    type: "apiKey" | "bearer" | "basic" | "oauth2" | "custom";
+    /** Where the value was stripped from, e.g. `节点「发飞书」 params.headers.Authorization`. */
+    label: string;
+    nodeIds: string[];
+}
+export interface WorkflowBundle {
+    schemaVersion: typeof WORKFLOW_BUNDLE_SCHEMA_VERSION;
+    name: string;
+    description?: string;
+    def: WorkflowDef;
+    trigger?: TriggerDef;
+    concurrency?: ConcurrencyPolicy;
+    requires: CapabilityRequirement[];
+    credentialsRequired: CredentialRequirement[];
+    meta?: {
+        author?: string;
+        tags?: string[];
+        category?: string;
+        version?: string;
+        source?: "native" | "n8n";
+    };
+}
+/** Placeholder left where a credential value was stripped (visibly broken > silently leaked). */
+export declare const STRIPPED_CREDENTIAL_PLACEHOLDER = "__CREDENTIAL_REQUIRED__";
+/** Derive the capability requirements a graph references (host-backed kinds only). */
+export declare function deriveRequirements(def: WorkflowDef): CapabilityRequirement[];
+/** Serialize a stored record into a sanitized, self-describing portable bundle. */
+export declare function toWorkflowBundle(record: WorkflowRecord): WorkflowBundle;
+export interface ParsedBundle {
+    name: string;
+    def: WorkflowDef;
+    trigger?: TriggerDef;
+    concurrency?: ConcurrencyPolicy;
+    requires: CapabilityRequirement[];
+    credentialsRequired: CredentialRequirement[];
+}
+/** Parse + validate an incoming bundle payload. fail-loud on malformed shapes (§1.5). */
+export declare function fromWorkflowBundle(payload: unknown): ParsedBundle;

package/dist/types/orchestration/workflow/workflow-controller.d.ts

@@ -42,6 +42,8 @@ export interface RunContext {
     payload?: Record<string, unknown>;
     /** Cancellation propagated to the runtime and host-backed node executors. */
     signal?: AbortSignal;
+    /** The record's unattended capability grant at run start (D30; feeds the permission gate). */
+    permissionScope?: WorkflowRecord["permissionScope"];
 }
 /** Per-node lifecycle status surfaced for live canvas coloring (not durable; fire-and-forget). */
 export type NodeRunStatus = "running" | "completed" | "failed";
@@ -61,6 +63,8 @@ export interface CreateInput {
     def: WorkflowDef;
     concurrency?: ConcurrencyPolicy;
     active?: boolean;
+    /** Owning user (D38); the handler stamps resolveActiveOwnerUserId(). */
+    owner?: string;
 }
 /** Result of a `patch()` call (spec §C `WorkflowToolResult`). */
 export type PatchOutcome = {
@@ -88,8 +92,15 @@ export declare class WorkflowController {
      *  trigger path — manual RPC, cron scheduler, IM, webhook — is captured alike. */
     runHistory?: WorkflowRunHistoryStore | undefined);
     create(input: CreateInput): Promise<WorkflowRecord>;
-    update(id: string, patch: Partial<Pick<WorkflowRecord, "name" | "def" | "concurrency" | "active">>): Promise<WorkflowRecord>;
+    update(id: string, patch: Partial<Pick<WorkflowRecord, "name" | "def" | "concurrency" | "active" | "permissionScope">>): Promise<WorkflowRecord>;
     setActive(id: string, active: boolean): Promise<WorkflowRecord>;
+    /**
+     * Publish (D31): snapshot the current draft (`def`) as the version triggers execute.
+     * Editing the draft afterwards never touches the running version until the next publish.
+     */
+    publish(id: string): Promise<WorkflowRecord>;
+    /** Archive (D31): keep the data, kill the lifecycle (deactivates; activation/publish refuse). */
+    archive(id: string, archived: boolean): Promise<WorkflowRecord>;
     /**
      * Revert a workflow to a stored revision snapshot (undo 基座). Git-revert semantics:
      * the snapshot's def/name/trigger are re-applied as a NEW revision (rev bumps), so
@@ -104,7 +115,11 @@ export declare class WorkflowController {
      */
     importN8n(id: string, json: string | unknown, opts?: {
         concurrency?: ConcurrencyPolicy;
-    }): Promise<WorkflowRecord>;
+        owner?: string;
+    }): Promise<{
+        record: WorkflowRecord;
+        report: import("./n8n-import.js").N8nConversionReport;
+    }>;
     /** Load a single record or throw (fail-loud lookup; used by the scheduler to re-read triggers). */
     get(id: string): Promise<WorkflowRecord>;
     /**
@@ -125,7 +140,9 @@ export declare class WorkflowController {
      */
     patch(id: string, env: PatchEnvelope): Promise<PatchOutcome>;
     /** Trigger a run, honoring the workflow's concurrency policy (spec §B5). */
-    run(id: string, trigger?: TriggerEvent): Promise<RunOutcome>;
+    run(id: string, trigger?: TriggerEvent, opts?: {
+        recordHistory?: boolean;
+    }): Promise<RunOutcome>;
     /**
      * Wrap a run with durable history recording (when wired). Lives at this choke point —
      * not in the RPC handler — so cron/IM/webhook runs are recorded identically to manual

package/dist/types/orchestration/workflow/workflow-patch.d.ts

@@ -64,6 +64,15 @@ export type WorkflowPatch = {
         name?: string;
         active?: boolean;
     };
+} | {
+    op: "set_node_options";
+    nodeId: string;
+    retry?: {
+        maxTries: number;
+        backoffMs?: number;
+    } | null;
+    timeoutMs?: number | null;
+    onError?: "stop" | "continue" | "errorPort" | null;
 };
 /** A patch + concurrency/scope envelope (spec §C). `scope` present ⇒ scoped (框选) edit. */
 export interface PatchEnvelope {

package/dist/types/orchestration/workflow/workflow-runtime.d.ts

@@ -46,6 +46,20 @@ export declare class WorkflowPauseSignal extends Error {
 export declare class WorkflowRunCanceled extends Error {
     constructor(message?: string);
 }
+/** Per-node execution stats for the run trace (D33, IT-9). */
+export interface NodeRunStats {
+    /** Execution order (1-based; cache hits count too — they advance the dag). */
+    seq: number;
+    startedAt: string;
+    finishedAt: string;
+    durationMs: number;
+    /** Executor attempts actually made (≥1; >1 means retries happened). */
+    attempts: number;
+    /** True when the content-addressed cache satisfied this node (no executor invocation). */
+    cacheHit: boolean;
+    /** Final per-node disposition (errorPort/continue keep the run alive but mark failed). */
+    status: "completed" | "failed";
+}
 export interface RunResult {
     status: "completed" | "failed" | "paused";
     /** nodeId → its output PortMap. */
@@ -55,6 +69,8 @@ export interface RunResult {
     progress: ReturnType<DagScheduler["getProgress"]>;
     /** Set when status === "paused": the node the run suspended at. */
     pausedAt?: string;
+    /** Ordered per-node trace (D33): timing, attempts, cache hits, disposition. */
+    nodeStats: Record<string, NodeRunStats>;
 }
 export interface WorkflowRuntimeOptions {
     registry?: NodeRegistry;
@@ -95,6 +111,9 @@ export declare class WorkflowRuntime {
     private readonly loopBackOf;
     /** Cooperative pause request; honored before the next node executes. */
     private pauseRequested;
+    /** Per-node trace (D33): seq/timing/attempts/cacheHit/disposition, keyed by nodeId. */
+    private readonly nodeStats;
+    private statsSeq;
     /** True once the durable checkpoint has been loaded into `cache` (load once per instance). */
     private checkpointLoaded;
     constructor(def: WorkflowDef, opts?: WorkflowRuntimeOptions);
@@ -136,5 +155,7 @@ export declare class WorkflowRuntime {
     private isCanceled;
     private canceledError;
     private throwIfCanceled;
+    /** Cancel-aware sleep for retry backoff: aborts immediately when the run is canceled. */
+    private cancellableDelay;
     private buildDag;
 }

package/dist/types/orchestration/workflow/workflow-scheduler.d.ts

@@ -38,6 +38,18 @@ export interface SchedulerDeps {
     onRunStarted?: (workflowId: string, triggerType: string) => void;
     onRunCompleted?: (outcome: RunOutcome, triggerType: string) => void;
     onRunFailed?: (workflowId: string, triggerType: string, err: unknown) => void;
+    /**
+     * Trigger rate-limit (D32/§B5 防洪): minimum ms between UNATTENDED fires (webhook/IM/cron) of
+     * the same workflow. A fire inside the window is DROPPED — loudly, via onTriggerDropped (dead
+     * letter), never silently. Manual/intent (attended) fires are exempt. Default 0 (off) — the
+     * production assembly (ensureWorkflowRoot) opts in explicitly; rate policy is the host's call.
+     */
+    minTriggerIntervalMs?: number;
+    /** Dead-letter surface for rate-limited drops. Required when minTriggerIntervalMs > 0. */
+    onTriggerDropped?: (workflowId: string, triggerType: string, detail: {
+        sinceLastMs: number;
+        minIntervalMs: number;
+    }) => void;
 }
 export declare class WorkflowScheduler {
     private readonly controller;
@@ -50,6 +62,10 @@ export declare class WorkflowScheduler {
     private readonly triggers;
     /** Active cron arms keyed by workflow id. */
     private readonly cronArms;
+    /** Last unattended fire per workflow (rate-limit window anchor, D32). */
+    private readonly lastFireAt;
+    private readonly minTriggerIntervalMs;
+    private readonly onTriggerDropped?;
     private started;
     constructor(deps: SchedulerDeps);
     /** Load every active workflow and arm its trigger (spec §B4 restart re-registration). */
@@ -86,5 +102,10 @@ export declare class WorkflowScheduler {
     private registerTrigger;
     private armCron;
     private fireCron;
+    /**
+     * Unattended-fire rate limit (D32): true ⇒ proceed (and anchor the window); false ⇒ DROPPED,
+     * surfaced via onTriggerDropped (dead letter) — never silent.
+     */
+    private passesRateLimit;
     private runWithLifecycle;
 }