tinet-agent-cli 0.1.0.dev36__py3-none-any.whl

taco/services/workflow_compiler.py

@@ -0,0 +1,1665 @@
+from __future__ import annotations
+
+import json
+import math
+import re
+from pathlib import Path
+from typing import Any, Mapping
+from urllib.parse import urlsplit
+
+import yaml
+from jsonschema import Draft202012Validator
+
+from taco.core.assets import load_json_asset
+from taco.core.errors import TacoError
+from taco.core.secure_file import SecureFileReadError, read_regular_file
+
+
+_REFERENCE = re.compile(
+    r"\{\{[ \t]{0,16}([A-Za-z][A-Za-z0-9_]{0,49})"
+    r"\.([A-Za-z_][A-Za-z0-9_]{0,29})[ \t]{0,16}\}\}"
+)
+_SECRET_REFERENCE = re.compile(
+    r"\{\{[ \t]{0,16}secrets\.([A-Za-z_][A-Za-z0-9_]{0,29})"
+    r"[ \t]{0,16}\}\}"
+)
+_TEMPLATE = re.compile(r"\{\{[^{}\r\n]{1,128}\}\}")
+_HEADER_NAME = re.compile(r"^[!#$%&'*+.^_`|~0-9A-Za-z-]+$")
+_OUTPUT_FIELDS = frozenset({"body", "status_code", "headers", "files", "data"})
+_HTTP_OUTPUT_FIELDS = _OUTPUT_FIELDS
+_KNOWLEDGE_OUTPUT_FIELDS = frozenset({"result"})
+_LLM_OUTPUT_FIELDS = frozenset({"text"})
+_TEMPLATE_TRANSFORM_OUTPUT_FIELDS = frozenset({"output"})
+_RESERVED_NODE_IDS = frozenset(
+    {
+        "start",
+        "end",
+        "answer",
+        "inputs",
+        "secrets",
+        "sys",
+        "env",
+        "conversation",
+    }
+)
+_INPUT_TYPES = {
+    "string": "text-input",
+    "number": "number",
+    "select": "select",
+}
+_DEFAULT_TIMEOUT = {
+    "connect": 10,
+    "read": 60,
+    "write": 20,
+}
+_DEFAULT_RETRY = {
+    "retry_enabled": True,
+    "max_retries": 3,
+    "retry_interval": 100,
+}
+_NODE_X_GAP = 320
+_MAX_DSL_FILE_SIZE = 1024 * 1024
+_MAX_STRUCTURE_DEPTH = 50
+
+
+class _WorkflowSafeLoader(yaml.SafeLoader):
+    """SafeLoader variant rejecting aliases and duplicate mapping keys."""
+
+    def compose_node(self, parent: Any, index: Any) -> Any:
+        if self.check_event(yaml.AliasEvent):
+            event = self.peek_event()
+            raise yaml.composer.ComposerError(
+                None,
+                None,
+                "YAML alias is not allowed",
+                event.start_mark,
+            )
+        return super().compose_node(parent, index)
+
+    def construct_mapping(
+        self,
+        node: Any,
+        deep: bool = False,
+    ) -> dict[Any, Any]:
+        if not isinstance(node, yaml.MappingNode):
+            return super().construct_mapping(node, deep=deep)
+
+        self.flatten_mapping(node)
+        mapping: dict[Any, Any] = {}
+        for key_node, value_node in node.value:
+            key = self.construct_object(key_node, deep=deep)
+            try:
+                if key in mapping:
+                    raise yaml.constructor.ConstructorError(
+                        "while constructing a mapping",
+                        node.start_mark,
+                        "found duplicate mapping key",
+                        key_node.start_mark,
+                    )
+            except TypeError as error:
+                raise yaml.constructor.ConstructorError(
+                    "while constructing a mapping",
+                    node.start_mark,
+                    "found unhashable mapping key",
+                    key_node.start_mark,
+                ) from error
+            mapping[key] = self.construct_object(value_node, deep=deep)
+        return mapping
+
+
+def compile_workflow(workflow: Mapping[str, Any]) -> dict[str, Any]:
+    """Validate a Workflow/Chatflow DSL object and compile it to a Dify graph."""
+    if not isinstance(workflow, dict):
+        raise _validation_error(["Workflow DSL 必须是对象"])
+
+    try:
+        _validate_json_compatible(workflow)
+    except RecursionError as error:
+        raise _validation_error(["Workflow DSL 嵌套层级过深"]) from error
+    normalized = _normalize_workflow_steps(dict(workflow))
+    kind = normalized.get("kind", "workflow")
+    if kind not in {"workflow", "chatflow"}:
+        raise _validation_error([f"不支持的 kind：{kind}"])
+    _validate_schema(normalized)
+    inputs = normalized["inputs"]
+    source_steps = normalized["nodes"]
+    all_ids = _collect_step_ids(source_steps)
+    _validate_unique_ids(all_ids)
+
+    builder = _GraphBuilder(inputs=inputs)
+    exits = builder.compile_steps(
+        source_steps,
+        predecessors=[("start", "start", "source")],
+    )
+    aggregator_ids = frozenset(
+        node_id
+        for node_id, dify_type in builder.node_types.items()
+        if dify_type == "variable-aggregator"
+    )
+    if kind == "chatflow":
+        terminal = _compile_answer_node(
+            normalized["answer"],
+            position=builder.next_position(),
+            context=_TemplateContext(
+                input_names=frozenset(inputs),
+                node_ids=frozenset(builder.business_node_ids),
+                node_output_fields=dict(builder.node_output_fields),
+                aggregator_ids=aggregator_ids,
+            ),
+        )
+        terminal_type = "answer"
+        terminal_id = "answer"
+    else:
+        terminal = _compile_end_node(
+            normalized["outputs"],
+            position=builder.next_position(),
+            node_ids=frozenset(builder.business_node_ids),
+            node_output_fields=builder.node_output_fields,
+            aggregator_ids=aggregator_ids,
+        )
+        terminal_type = "end"
+        terminal_id = "end"
+    builder.nodes.append(terminal)
+    for source_id, source_type, source_handle in exits:
+        builder.add_edge(
+            source=source_id,
+            target=terminal_id,
+            source_type=source_type,
+            target_type=terminal_type,
+            source_handle=source_handle,
+        )
+    return {
+        "nodes": builder.nodes,
+        "edges": builder.edges,
+        "viewport": {"x": 0, "y": 0, "zoom": 1},
+    }
+
+
+class _GraphBuilder:
+    """Compile TACO IR steps into a Dify graph with control-flow expansion."""
+
+    def __init__(self, *, inputs: dict[str, dict[str, Any]]) -> None:
+        self.inputs = inputs
+        self.input_names = frozenset(inputs)
+        self.nodes: list[dict[str, Any]] = [_compile_start_node(inputs)]
+        self.edges: list[dict[str, Any]] = []
+        self._position = 0
+        self.node_output_fields: dict[str, frozenset[str]] = {}
+        self.node_types: dict[str, str] = {"start": "start"}
+        self.business_node_ids: set[str] = set()
+        self._known_ids: set[str] = {"start"}
+        self._iteration_stack: list[str] = []
+
+    def next_position(self) -> int:
+        self._position += 1
+        return self._position
+
+    def context(self) -> _TemplateContext:
+        aggregator_ids = frozenset(
+            node_id
+            for node_id, dify_type in self.node_types.items()
+            if dify_type == "variable-aggregator"
+        )
+        return _TemplateContext(
+            input_names=self.input_names,
+            node_ids=frozenset(self.business_node_ids),
+            node_output_fields=dict(self.node_output_fields),
+            aggregator_ids=aggregator_ids,
+        )
+
+    @property
+    def _current_iteration_id(self) -> str | None:
+        return self._iteration_stack[-1] if self._iteration_stack else None
+
+    def add_edge(
+        self,
+        *,
+        source: str,
+        target: str,
+        source_type: str,
+        target_type: str,
+        source_handle: str = "source",
+        iteration_id: str | None = None,
+    ) -> None:
+        edge_id = f"{source}-{source_handle}-{target}"
+        data: dict[str, Any] = {
+            "sourceType": source_type,
+            "targetType": target_type,
+        }
+        edge: dict[str, Any] = {
+            "id": edge_id,
+            "type": "custom",
+            "source": source,
+            "sourceHandle": source_handle,
+            "target": target,
+            "targetHandle": "target",
+            "data": data,
+        }
+        if iteration_id:
+            data["isInIteration"] = True
+            data["iteration_id"] = iteration_id
+            edge["zIndex"] = 1002
+        self.edges.append(edge)
+
+    def compile_steps(
+        self,
+        steps: list[dict[str, Any]],
+        *,
+        predecessors: list[tuple[str, str, str]],
+    ) -> list[tuple[str, str, str]]:
+        """Compile steps; predecessors are (id, dify_type, source_handle)."""
+        current = list(predecessors)
+        for step in steps:
+            current = self._compile_one_step(step, predecessors=current)
+        return current
+
+    def _compile_one_step(
+        self,
+        step: dict[str, Any],
+        *,
+        predecessors: list[tuple[str, str, str]],
+    ) -> list[tuple[str, str, str]]:
+        if "branch" in step:
+            return self._compile_branch(step, predecessors=predecessors)
+        if "parallel" in step:
+            return self._compile_parallel(step, predecessors=predecessors)
+        if "iterate" in step:
+            return self._compile_iterate(step, predecessors=predecessors)
+        return self._compile_business(step, predecessors=predecessors)
+
+    def _compile_business(
+        self,
+        step: dict[str, Any],
+        *,
+        predecessors: list[tuple[str, str, str]],
+    ) -> list[tuple[str, str, str]]:
+        compiled, dify_type, output_fields = _compile_step_node(
+            step,
+            position=self.next_position(),
+            context=self.context(),
+        )
+        iteration_id = self._current_iteration_id
+        if iteration_id:
+            compiled["parentId"] = iteration_id
+            compiled["extent"] = "parent"
+            compiled["zIndex"] = 1002
+            compiled["data"]["isInIteration"] = True
+            compiled["data"]["iteration_id"] = iteration_id
+        self.nodes.append(compiled)
+        node_id = step["id"]
+        self._register_node(node_id, dify_type, output_fields)
+        for source_id, source_type, source_handle in predecessors:
+            self.add_edge(
+                source=source_id,
+                target=node_id,
+                source_type=source_type,
+                target_type=dify_type,
+                source_handle=source_handle,
+                iteration_id=iteration_id,
+            )
+        return [(node_id, dify_type, "source")]
+
+    def _compile_branch(
+        self,
+        step: dict[str, Any],
+        *,
+        predecessors: list[tuple[str, str, str]],
+    ) -> list[tuple[str, str, str]]:
+        branch = step["branch"]
+        route_id = step["id"]
+        if_else = _compile_if_else_node(
+            step_id=route_id,
+            when=branch["when"],
+            position=self.next_position(),
+            context=self.context(),
+        )
+        self.nodes.append(if_else)
+        self._register_node(route_id, "if-else", frozenset())
+        for source_id, source_type, source_handle in predecessors:
+            self.add_edge(
+                source=source_id,
+                target=route_id,
+                source_type=source_type,
+                target_type="if-else",
+                source_handle=source_handle,
+            )
+        then_exits = self.compile_steps(
+            branch["then"],
+            predecessors=[(route_id, "if-else", "true")],
+        )
+        else_exits = self.compile_steps(
+            branch["else"],
+            predecessors=[(route_id, "if-else", "false")],
+        )
+        return [*then_exits, *else_exits]
+
+    def _compile_parallel(
+        self,
+        step: dict[str, Any],
+        *,
+        predecessors: list[tuple[str, str, str]],
+    ) -> list[tuple[str, str, str]]:
+        parallel = step["parallel"]
+        fan_id = step["id"]
+        branch_exits: list[tuple[str, str, str]] = []
+        tip_fields: list[tuple[str, frozenset[str]]] = []
+        for branch_steps in parallel["branches"]:
+            exits = self.compile_steps(branch_steps, predecessors=predecessors)
+            if len(exits) != 1:
+                raise _validation_error(
+                    [f"parallel[{fan_id}] 每个分支必须恰好有一个出口节点"]
+                )
+            tip_id, tip_type, tip_handle = exits[0]
+            branch_exits.append((tip_id, tip_type, tip_handle))
+            tip_fields.append((tip_id, self.node_output_fields[tip_id]))
+
+        join_id = parallel.get("join")
+        if not join_id:
+            return branch_exits
+
+        if join_id in self._known_ids:
+            raise _validation_error([f"parallel.join ID 重复：{join_id}"])
+        join_node, join_fields = _compile_variable_aggregator_node(
+            join_id=join_id,
+            tip_fields=tip_fields,
+            position=self.next_position(),
+        )
+        self.nodes.append(join_node)
+        self._register_node(join_id, "variable-aggregator", join_fields)
+        for tip_id, tip_type, tip_handle in branch_exits:
+            self.add_edge(
+                source=tip_id,
+                target=join_id,
+                source_type=tip_type,
+                target_type="variable-aggregator",
+                source_handle=tip_handle,
+            )
+        return [(join_id, "variable-aggregator", "source")]
+
+    def _compile_iterate(
+        self,
+        step: dict[str, Any],
+        *,
+        predecessors: list[tuple[str, str, str]],
+    ) -> list[tuple[str, str, str]]:
+        if self._iteration_stack:
+            raise _validation_error(["iterate 暂不支持嵌套"])
+        iterate = step["iterate"]
+        iter_id = step["id"]
+        over = iterate["over"]
+        if not isinstance(over, str):
+            raise _validation_error(["iterate.over 必须是字符串模板引用"])
+        over_ref = _REFERENCE.fullmatch(over)
+        if over_ref is None:
+            raise _validation_error(
+                ["iterate.over 必须是单个模板引用，例如 {{ prep.chunks }}"]
+            )
+        over_ns, over_field = over_ref.groups()
+        iterator_selector = _resolve_value_selector(
+            over_ns,
+            over_field,
+            self.context(),
+            error_prefix="iterate.over",
+        )
+
+        start_id = f"{iter_id}start"
+        if start_id in self._known_ids or start_id in {s["id"] for s in iterate["steps"]}:
+            raise _validation_error(
+                [f"iterate[{iter_id}] 生成的起点 ID 冲突：{start_id}"]
+            )
+
+        position = self.next_position()
+        iteration_node = {
+            "id": iter_id,
+            "type": "custom",
+            "position": {"x": position * _NODE_X_GAP, "y": 0},
+            "width": 400,
+            "height": 200,
+            "data": {
+                "title": iter_id,
+                "desc": "",
+                "type": "iteration",
+                "start_node_id": start_id,
+                "iterator_selector": iterator_selector,
+                "output_selector": [],
+                "output_type": "array[string]",
+                "is_parallel": False,
+                "parallel_nums": 10,
+                "error_handle_mode": "terminated",
+            },
+        }
+        self.nodes.append(iteration_node)
+        self._register_node(
+            iter_id,
+            "iteration",
+            frozenset({"item", "index", "output"}),
+        )
+
+        start_node = {
+            "id": start_id,
+            "type": "custom-iteration-start",
+            "position": {"x": 24, "y": 68},
+            "parentId": iter_id,
+            "extent": "parent",
+            "zIndex": 1002,
+            "data": {
+                "title": "",
+                "desc": "",
+                "type": "iteration-start",
+                "isInIteration": True,
+                "iteration_id": iter_id,
+            },
+            "selectable": False,
+            "draggable": False,
+        }
+        self.nodes.append(start_node)
+        self._known_ids.add(start_id)
+        self.node_types[start_id] = "iteration-start"
+
+        for source_id, source_type, source_handle in predecessors:
+            self.add_edge(
+                source=source_id,
+                target=iter_id,
+                source_type=source_type,
+                target_type="iteration",
+                source_handle=source_handle,
+            )
+
+        self._iteration_stack.append(iter_id)
+        try:
+            inner_exits = self.compile_steps(
+                iterate["steps"],
+                predecessors=[(start_id, "iteration-start", "source")],
+            )
+        finally:
+            self._iteration_stack.pop()
+
+        if len(inner_exits) != 1:
+            raise _validation_error(
+                [f"iterate[{iter_id}].steps 必须是线性链路（恰好一个出口）"]
+            )
+
+        output_expr = iterate["output"]
+        if not isinstance(output_expr, str):
+            raise _validation_error(["iterate.output 必须是字符串模板引用"])
+        output_ref = _REFERENCE.fullmatch(output_expr)
+        if output_ref is None:
+            raise _validation_error(
+                ["iterate.output 必须是单个模板引用，例如 {{ call.body }}"]
+            )
+        out_ns, out_field = output_ref.groups()
+        inner_ids = {node["id"] for node in iterate["steps"]}
+        if out_ns not in inner_ids:
+            raise _validation_error(
+                ["iterate.output 必须引用 iterate.steps 内的节点"]
+            )
+        allowed = self.node_output_fields.get(out_ns, frozenset())
+        if out_field not in allowed:
+            raise _validation_error(
+                [f"iterate.output 节点 {out_ns} 不支持输出字段：{out_field}"]
+            )
+        iteration_node["data"]["output_selector"] = [out_ns, out_field]
+        iteration_node["data"]["output_type"] = _iteration_output_type(out_field)
+        iteration_node["data"]["startNodeType"] = "iteration-start"
+
+        return [(iter_id, "iteration", "source")]
+
+    def _register_node(
+        self,
+        node_id: str,
+        dify_type: str,
+        output_fields: frozenset[str],
+    ) -> None:
+        if node_id in self._known_ids:
+            raise _validation_error([f"节点 ID 重复：{node_id}"])
+        self._known_ids.add(node_id)
+        self.node_types[node_id] = dify_type
+        self.node_output_fields[node_id] = output_fields
+        if dify_type not in {"if-else"}:
+            self.business_node_ids.add(node_id)
+
+
+def load_workflow_file(path: Path | str) -> dict[str, Any]:
+    """Safely load a regular Workflow YAML file without network access."""
+    dsl_path = Path(path)
+    try:
+        raw_content = read_regular_file(
+            dsl_path,
+            max_bytes=_MAX_DSL_FILE_SIZE,
+        )
+        content = raw_content.decode("utf-8")
+    except SecureFileReadError as error:
+        reasons = {
+            "symlink": "Workflow DSL 输入不能是符号链接",
+            "not_regular": "Workflow DSL 输入不是普通文件",
+            "too_large": "Workflow DSL 文件过大，最大允许 1 MiB",
+            "changed": "Workflow DSL 文件在安全打开期间发生变化",
+            "unreadable": "Workflow DSL 文件不存在或不可读",
+        }
+        raise _validation_error(
+            [reasons.get(error.reason, "无法安全读取 Workflow DSL 文件")]
+        ) from error
+    except TacoError:
+        raise
+    except (OSError, UnicodeError) as error:
+        raise _validation_error(["无法读取 Workflow DSL 文件"]) from error
+
+    try:
+        workflow = yaml.load(content, Loader=_WorkflowSafeLoader)
+    except (
+        yaml.YAMLError,
+        RecursionError,
+        ValueError,
+        OverflowError,
+    ) as error:
+        raise _validation_error(["Workflow DSL 不是合法 YAML"]) from error
+    if not isinstance(workflow, dict):
+        raise _validation_error(["Workflow DSL YAML 必须是对象"])
+    return workflow
+
+
+def compile_workflow_file(path: Path | str) -> dict[str, Any]:
+    """Safely load and compile a regular Workflow YAML file."""
+    try:
+        return compile_workflow(load_workflow_file(path))
+    except RecursionError as error:
+        raise _validation_error(["Workflow DSL 嵌套层级过深"]) from error
+
+
+def summarize_graph(graph: Mapping[str, Any]) -> dict[str, int]:
+    nodes = graph.get("nodes")
+    edges = graph.get("edges")
+    node_items = nodes if isinstance(nodes, list) else []
+    edge_items = edges if isinstance(edges, list) else []
+
+    def _type_of(node: object) -> str | None:
+        if not isinstance(node, dict):
+            return None
+        data = node.get("data")
+        if not isinstance(data, dict):
+            return None
+        raw = data.get("type")
+        return raw if isinstance(raw, str) else None
+
+    types = [_type_of(node) for node in node_items]
+    return {
+        "nodes": len(node_items),
+        "edges": len(edge_items),
+        "http_nodes": sum(1 for item in types if item == "http-request"),
+        "code_nodes": sum(1 for item in types if item == "code"),
+        "knowledge_nodes": sum(
+            1 for item in types if item == "knowledge-retrieval"
+        ),
+        "if_else_nodes": sum(1 for item in types if item == "if-else"),
+        "aggregator_nodes": sum(
+            1 for item in types if item == "variable-aggregator"
+        ),
+        "iteration_nodes": sum(1 for item in types if item == "iteration"),
+        "answer_nodes": sum(1 for item in types if item == "answer"),
+        "llm_nodes": sum(1 for item in types if item == "llm"),
+        "template_nodes": sum(
+            1 for item in types if item == "template-transform"
+        ),
+    }
+
+
+class _TemplateContext:
+    def __init__(
+        self,
+        *,
+        input_names: frozenset[str],
+        node_ids: frozenset[str],
+        node_output_fields: dict[str, frozenset[str]] | None = None,
+        aggregator_ids: frozenset[str] | None = None,
+    ) -> None:
+        self.input_names = input_names
+        self.node_ids = node_ids
+        self.node_output_fields = node_output_fields or {}
+        self.aggregator_ids = aggregator_ids or frozenset()
+
+
+def _normalize_workflow_steps(workflow: dict[str, Any]) -> dict[str, Any]:
+    """Accept `nodes` or `steps` as the linear step list (M1)."""
+    has_nodes = "nodes" in workflow
+    has_steps = "steps" in workflow
+    if has_nodes and has_steps:
+        raise _validation_error(["不能同时提供 nodes 与 steps，请只保留其一"])
+    if not has_nodes and not has_steps:
+        raise _validation_error(["必须提供 nodes 或 steps（至少一个业务节点）"])
+    if has_steps:
+        workflow = {**workflow, "nodes": workflow["steps"]}
+        workflow.pop("steps", None)
+    return workflow
+
+
+def _compile_step_node(
+    node: dict[str, Any],
+    *,
+    position: int,
+    context: _TemplateContext,
+) -> tuple[dict[str, Any], str, frozenset[str]]:
+    node_type = node.get("type")
+    if node_type == "http":
+        compiled = _compile_http_node(node, position=position, context=context)
+        return compiled, "http-request", _HTTP_OUTPUT_FIELDS
+    if node_type == "code":
+        compiled = _compile_code_node(node, position=position, context=context)
+        outputs = node.get("outputs")
+        fields = frozenset(outputs) if isinstance(outputs, dict) else frozenset()
+        return compiled, "code", fields
+    if node_type == "knowledge-retrieval":
+        compiled = _compile_knowledge_retrieval_node(
+            node,
+            position=position,
+            context=context,
+        )
+        return compiled, "knowledge-retrieval", _KNOWLEDGE_OUTPUT_FIELDS
+    if node_type == "llm":
+        compiled = _compile_llm_node(node, position=position, context=context)
+        return compiled, "llm", _LLM_OUTPUT_FIELDS
+    if node_type == "template-transform":
+        compiled = _compile_template_transform_node(
+            node,
+            position=position,
+            context=context,
+        )
+        return compiled, "template-transform", _TEMPLATE_TRANSFORM_OUTPUT_FIELDS
+    raise _validation_error([f"不支持的节点类型：{node_type}"])
+
+
+def _compile_llm_node(
+    node: dict[str, Any],
+    *,
+    position: int,
+    context: _TemplateContext,
+) -> dict[str, Any]:
+    has_prompt = "prompt" in node
+    has_template = "prompt_template" in node
+    if has_prompt == has_template:
+        raise _validation_error(
+            ["llm 必须且只能提供 prompt 或 prompt_template 之一"]
+        )
+
+    if has_prompt:
+        prompt = node["prompt"]
+        if not isinstance(prompt, str) or not prompt.strip():
+            raise _validation_error(["llm.prompt 必须是非空字符串"])
+        prompt_template = [
+            {
+                "role": "user",
+                "text": _compile_template(prompt, context),
+            }
+        ]
+    else:
+        raw_messages = node["prompt_template"]
+        if not isinstance(raw_messages, list) or not raw_messages:
+            raise _validation_error(["llm.prompt_template 必须是非空数组"])
+        prompt_template = []
+        for index, message in enumerate(raw_messages):
+            if not isinstance(message, dict):
+                raise _validation_error(
+                    [f"llm.prompt_template[{index}] 必须是对象"]
+                )
+            role = message.get("role")
+            text = message.get("text")
+            if role not in {"system", "user", "assistant"}:
+                raise _validation_error(
+                    [f"llm.prompt_template[{index}].role 不受支持"]
+                )
+            if not isinstance(text, str) or not text.strip():
+                raise _validation_error(
+                    [f"llm.prompt_template[{index}].text 必须是非空字符串"]
+                )
+            prompt_template.append(
+                {
+                    "role": role,
+                    "text": _compile_template(text, context),
+                }
+            )
+
+    mode = node.get("mode", "chat")
+    if mode not in {"chat", "completion"}:
+        raise _validation_error(["llm.mode 仅支持 chat 或 completion"])
+    completion_params = node.get("completion_params") or {}
+    if not isinstance(completion_params, dict):
+        raise _validation_error(["llm.completion_params 必须是对象"])
+
+    if mode == "completion":
+        # Dify completion mode expects a single prompt object.
+        joined = "\n".join(item["text"] for item in prompt_template)
+        compiled_prompt: Any = {"text": joined}
+    else:
+        compiled_prompt = prompt_template
+
+    return {
+        "id": node["id"],
+        "type": "custom",
+        "position": {"x": position * _NODE_X_GAP, "y": 0},
+        "data": {
+            "title": node["id"],
+            "desc": "",
+            "type": "llm",
+            "model": {
+                "provider": node["provider"],
+                "name": node["model"],
+                "mode": mode,
+                "completion_params": completion_params,
+            },
+            "prompt_template": compiled_prompt,
+            "context": {"enabled": False, "variable_selector": []},
+            "vision": {"enabled": False},
+        },
+    }
+
+
+def _compile_template_transform_node(
+    node: dict[str, Any],
+    *,
+    position: int,
+    context: _TemplateContext,
+) -> dict[str, Any]:
+    variables_raw = node.get("variables") or {}
+    if not isinstance(variables_raw, dict) or not variables_raw:
+        raise _validation_error(["template-transform.variables 必须是非空对象"])
+    variables = []
+    for name, expression in variables_raw.items():
+        if not isinstance(expression, str):
+            raise _validation_error(
+                [f"template-transform.variables.{name} 必须是字符串引用"]
+            )
+        reference = _REFERENCE.fullmatch(expression)
+        if reference is None:
+            raise _validation_error(
+                [f"template-transform.variables.{name} 必须是单个模板引用"]
+            )
+        namespace, field = reference.groups()
+        value_selector = _resolve_value_selector(
+            namespace,
+            field,
+            context,
+            error_prefix=f"template-transform.variables.{name}",
+        )
+        variables.append({"variable": name, "value_selector": value_selector})
+
+    template = node.get("template")
+    if not isinstance(template, str) or not template.strip():
+        raise _validation_error(["template-transform.template 必须是非空字符串"])
+    # Jinja template must not contain TACO {{ ns.field }} refs; use variables.
+    if _REFERENCE.search(template) is not None:
+        raise _validation_error(
+            [
+                "template-transform.template 不能直接使用 TACO 节点引用，"
+                "请通过 variables 绑定后在模板中使用 {{ var }} 写法"
+            ]
+        )
+
+    return {
+        "id": node["id"],
+        "type": "custom",
+        "position": {"x": position * _NODE_X_GAP, "y": 0},
+        "data": {
+            "title": node["id"],
+            "desc": "",
+            "type": "template-transform",
+            "variables": variables,
+            "template": template,
+        },
+    }
+
+def _compile_code_node(
+    node: dict[str, Any],
+    *,
+    position: int,
+    context: _TemplateContext,
+) -> dict[str, Any]:
+    variables_raw = node.get("variables") or {}
+    if not isinstance(variables_raw, dict):
+        raise _validation_error(["code.variables 必须是对象"])
+    variables = []
+    for name, expression in variables_raw.items():
+        if not isinstance(expression, str):
+            raise _validation_error([f"code.variables.{name} 必须是字符串引用"])
+        reference = _REFERENCE.fullmatch(expression)
+        if reference is None:
+            raise _validation_error(
+                [f"code.variables.{name} 必须是单个模板引用"]
+            )
+        namespace, field = reference.groups()
+        value_selector = _resolve_value_selector(
+            namespace,
+            field,
+            context,
+            error_prefix=f"code.variables.{name}",
+        )
+        variables.append({"variable": name, "value_selector": value_selector})
+
+    outputs_raw = node.get("outputs") or {}
+    outputs: dict[str, Any] = {}
+    for name, config in outputs_raw.items():
+        if not isinstance(config, dict) or "type" not in config:
+            raise _validation_error([f"code.outputs.{name} 必须包含 type"])
+        outputs[name] = {"type": config["type"], "children": None}
+
+    return {
+        "id": node["id"],
+        "type": "custom",
+        "position": {"x": position * _NODE_X_GAP, "y": 0},
+        "data": {
+            "title": node["id"],
+            "desc": "",
+            "type": "code",
+            "variables": variables,
+            "code_language": node["language"],
+            "code": node["code"],
+            "outputs": outputs,
+        },
+    }
+
+
+def _compile_knowledge_retrieval_node(
+    node: dict[str, Any],
+    *,
+    position: int,
+    context: _TemplateContext,
+) -> dict[str, Any]:
+    query = node["query"]
+    if not isinstance(query, str):
+        raise _validation_error(["knowledge-retrieval.query 必须是字符串"])
+    reference = _REFERENCE.fullmatch(query)
+    if reference is None:
+        raise _validation_error(
+            ["knowledge-retrieval.query 必须是单个模板引用"]
+        )
+    namespace, field = reference.groups()
+    query_selector = _resolve_value_selector(
+        namespace,
+        field,
+        context,
+        error_prefix="knowledge-retrieval.query",
+    )
+    retrieval_mode = node.get("retrieval_mode", "multiple")
+    if retrieval_mode != "multiple":
+        raise _validation_error(
+            ["知识检索节点首期仅支持 retrieval_mode=multiple"]
+        )
+    multiple_config: dict[str, Any] = {
+        "top_k": node.get("top_k", 3),
+        "score_threshold": node.get("score_threshold"),
+        "reranking_enable": node.get("reranking_enable", False),
+    }
+    return {
+        "id": node["id"],
+        "type": "custom",
+        "position": {"x": position * _NODE_X_GAP, "y": 0},
+        "data": {
+            "title": node["id"],
+            "desc": "",
+            "type": "knowledge-retrieval",
+            "query_variable_selector": query_selector,
+            "dataset_ids": list(node["dataset_ids"]),
+            "retrieval_mode": "multiple",
+            "multiple_retrieval_config": multiple_config,
+        },
+    }
+
+
+def _resolve_value_selector(
+    namespace: str,
+    field: str,
+    context: _TemplateContext,
+    *,
+    error_prefix: str,
+) -> list[str]:
+    if namespace == "inputs":
+        if field not in context.input_names:
+            raise _validation_error([f"{error_prefix} 未知输入：inputs.{field}"])
+        return ["start", field]
+    if namespace == "secrets":
+        raise _validation_error([f"{error_prefix} 不支持直接引用 secrets"])
+    if namespace not in context.node_ids:
+        raise _validation_error([f"{error_prefix} 未知节点：{namespace}"])
+    allowed = context.node_output_fields.get(namespace, frozenset())
+    if field not in allowed:
+        raise _validation_error(
+            [f"{error_prefix} 节点 {namespace} 不支持输出字段：{field}"]
+        )
+    if namespace in context.aggregator_ids:
+        return [namespace, field, "output"]
+    return [namespace, field]
+
+
+def _collect_step_ids(steps: list[dict[str, Any]]) -> list[str]:
+    """Collect all step / nested node / join IDs for uniqueness checks."""
+    collected: list[str] = []
+    for step in steps:
+        collected.append(step["id"])
+        if "branch" in step:
+            branch = step["branch"]
+            for nested in [*branch.get("then", []), *branch.get("else", [])]:
+                collected.append(nested["id"])
+        elif "parallel" in step:
+            parallel = step["parallel"]
+            for branch_steps in parallel.get("branches", []):
+                for nested in branch_steps:
+                    collected.append(nested["id"])
+            join_id = parallel.get("join")
+            if join_id:
+                collected.append(join_id)
+        elif "iterate" in step:
+            for nested in step["iterate"].get("steps", []):
+                collected.append(nested["id"])
+    return collected
+
+
+def _iteration_output_type(field: str) -> str:
+    if field in {"result"}:
+        return "array[object]"
+    if field in {"status_code"}:
+        return "array[number]"
+    return "array[string]"
+
+
+def _compile_answer_node(
+    answer: str,
+    *,
+    position: int,
+    context: _TemplateContext,
+) -> dict[str, Any]:
+    if not isinstance(answer, str) or not answer.strip():
+        raise _validation_error(["chatflow.answer 必须是非空字符串"])
+    compiled_answer = _compile_template(answer, context)
+    return {
+        "id": "answer",
+        "type": "custom",
+        "position": {"x": position * _NODE_X_GAP, "y": 0},
+        "data": {
+            "title": "Answer",
+            "desc": "",
+            "type": "answer",
+            "variables": [],
+            "answer": compiled_answer,
+        },
+    }
+
+
+def _validate_unique_ids(ids: list[str]) -> None:
+    if not ids:
+        raise _validation_error(["nodes/steps 至少需要一个业务节点"])
+    seen: set[str] = set()
+    for node_id in ids:
+        if node_id in _RESERVED_NODE_IDS:
+            raise _validation_error(["节点 ID 不能使用保留名"])
+        if node_id in seen:
+            raise _validation_error([f"节点 ID 重复：{node_id}"])
+        seen.add(node_id)
+
+
+_EMPTY_OPS = frozenset({"empty", "not empty"})
+_AGGREGATOR_FIELD_PRIORITY = (
+    "body",
+    "result",
+    "output",
+    "text",
+    "data",
+)
+
+
+def _compile_if_else_node(
+    *,
+    step_id: str,
+    when: dict[str, Any],
+    position: int,
+    context: _TemplateContext,
+) -> dict[str, Any]:
+    left = when.get("left")
+    if not isinstance(left, str):
+        raise _validation_error(["branch.when.left 必须是字符串模板引用"])
+    reference = _REFERENCE.fullmatch(left)
+    if reference is None:
+        raise _validation_error(
+            ["branch.when.left 必须是单个模板引用，例如 {{ inputs.x }}"]
+        )
+    namespace, field = reference.groups()
+    selector = _resolve_value_selector(
+        namespace,
+        field,
+        context,
+        error_prefix="branch.when.left",
+    )
+    op = when["op"]
+    condition: dict[str, Any] = {
+        "id": f"{step_id}-cond-0",
+        "varType": "string",
+        "variable_selector": selector,
+        "comparison_operator": op,
+        "value": "",
+    }
+    if op not in _EMPTY_OPS:
+        if "right" not in when:
+            raise _validation_error(
+                [f"branch.when.op={op} 时必须提供 right"]
+            )
+        right = when["right"]
+        if right is None:
+            condition["value"] = ""
+        elif isinstance(right, bool):
+            condition["value"] = "true" if right else "false"
+        else:
+            condition["value"] = right
+    return {
+        "id": step_id,
+        "type": "custom",
+        "position": {"x": position * _NODE_X_GAP, "y": 0},
+        "data": {
+            "title": step_id,
+            "desc": "",
+            "type": "if-else",
+            "cases": [
+                {
+                    "case_id": "true",
+                    "logical_operator": "and",
+                    "conditions": [condition],
+                }
+            ],
+        },
+    }
+
+
+def _primary_output_field(fields: frozenset[str], *, tip_id: str) -> str:
+    for name in _AGGREGATOR_FIELD_PRIORITY:
+        if name in fields:
+            return name
+    if not fields:
+        raise _validation_error(
+            [f"parallel join 无法聚合节点 {tip_id}：该节点没有可引用输出"]
+        )
+    return sorted(fields)[0]
+
+
+def _compile_variable_aggregator_node(
+    *,
+    join_id: str,
+    tip_fields: list[tuple[str, frozenset[str]]],
+    position: int,
+) -> tuple[dict[str, Any], frozenset[str]]:
+    groups = []
+    group_names: list[str] = []
+    for tip_id, fields in tip_fields:
+        field = _primary_output_field(fields, tip_id=tip_id)
+        group_names.append(tip_id)
+        groups.append(
+            {
+                "groupId": tip_id,
+                "group_name": tip_id,
+                "output_type": "string",
+                "variables": [[tip_id, field]],
+            }
+        )
+    node = {
+        "id": join_id,
+        "type": "custom",
+        "position": {"x": position * _NODE_X_GAP, "y": 0},
+        "data": {
+            "title": join_id,
+            "desc": "",
+            "type": "variable-aggregator",
+            "output_type": "string",
+            "variables": [],
+            "advanced_settings": {
+                "group_enabled": True,
+                "groups": groups,
+            },
+        },
+    }
+    return node, frozenset(group_names)
+
+def _validate_json_compatible(value: Any, *, depth: int = 0) -> None:
+    if depth > _MAX_STRUCTURE_DEPTH:
+        raise _validation_error(["Workflow DSL 嵌套层级过深"])
+    if value is None or isinstance(value, (str, bool, int)):
+        return
+    if isinstance(value, float):
+        if not math.isfinite(value):
+            raise _validation_error(["Workflow DSL 包含非 JSON 数值"])
+        return
+    if isinstance(value, list):
+        for item in value:
+            _validate_json_compatible(item, depth=depth + 1)
+        return
+    if isinstance(value, dict):
+        for key, item in value.items():
+            if not isinstance(key, str):
+                raise _validation_error(["Workflow DSL mapping key 必须是字符串"])
+            _validate_json_compatible(item, depth=depth + 1)
+        return
+    raise _validation_error(["Workflow DSL 包含非 JSON 兼容值"])
+
+
+def _validate_schema(workflow: dict[str, Any]) -> None:
+    kind = workflow.get("kind")
+    try:
+        if kind == "chatflow":
+            schema = load_json_asset("schemas", "chatflow")
+        else:
+            schema = load_json_asset("schemas", "workflow")
+    except TacoError:
+        schema = load_json_asset("schemas", "workflow.http")
+    validator = Draft202012Validator(schema)
+    details = [
+        _schema_error_message(error)
+        for error in sorted(
+            validator.iter_errors(workflow),
+            key=lambda item: (
+                tuple(str(part) for part in item.absolute_path),
+                str(item.validator),
+            ),
+        )
+    ]
+    if details:
+        raise _validation_error(details)
+
+
+def _schema_error_message(error: Any) -> str:
+    path = _json_path(list(error.absolute_path)) or "$"
+    if error.validator == "required" and isinstance(error.instance, dict):
+        missing = sorted(
+            field
+            for field in error.validator_value
+            if field not in error.instance
+        )
+        return f"{path} 缺少必填字段：{', '.join(missing)}"
+    if error.validator == "additionalProperties":
+        allowed = set(error.schema.get("properties", {}))
+        unknown = sorted(set(error.instance) - allowed)
+        suffix = f"：{', '.join(unknown)}" if unknown else ""
+        return f"{path} 包含不支持字段{suffix}"
+    if error.validator == "minItems":
+        if path in {"nodes", "steps"}:
+            return f"{path} 至少需要一个业务节点"
+        return f"{path} 至少需要一项"
+    if error.validator in {"enum", "const"}:
+        return f"{path} 的值不受支持"
+    if error.validator == "type":
+        return f"{path} 的类型不合法"
+    if error.validator == "pattern":
+        return f"{path} 的格式不合法"
+    return f"{path} 不符合 Workflow schema 约束"
+
+
+def _validate_node_ids(nodes: list[dict[str, Any]]) -> list[str]:
+    if not nodes:
+        raise _validation_error(["nodes/steps 至少需要一个业务节点"])
+    node_ids: list[str] = []
+    seen: set[str] = set()
+    for index, node in enumerate(nodes):
+        node_id = node["id"]
+        if node_id in _RESERVED_NODE_IDS:
+            raise _validation_error(
+                [f"nodes[{index}].id 不能使用保留 ID"]
+            )
+        if node_id in seen:
+            raise _validation_error([f"nodes[{index}].id 重复"])
+        seen.add(node_id)
+        node_ids.append(node_id)
+    return node_ids
+
+
+def _compile_start_node(inputs: dict[str, dict[str, Any]]) -> dict[str, Any]:
+    variables = []
+    for name, config in inputs.items():
+        variables.append(
+            {
+                "variable": name,
+                "label": config.get("description") or name,
+                "type": _INPUT_TYPES[config["type"]],
+                "required": config["required"],
+                "max_length": config.get("max_length", 48),
+                "options": list(config.get("options", [])),
+            }
+        )
+    return {
+        "id": "start",
+        "type": "custom",
+        "position": {"x": 0, "y": 0},
+        "data": {
+            "title": "Start",
+            "desc": "",
+            "type": "start",
+            "variables": variables,
+        },
+    }
+
+
+def _compile_http_node(
+    node: dict[str, Any],
+    *,
+    position: int,
+    context: _TemplateContext,
+) -> dict[str, Any]:
+    timeout = {
+        name: node.get("timeout", {}).get(name, default)
+        for name, default in _DEFAULT_TIMEOUT.items()
+    }
+    timeout.update(
+        {
+            f"max_{name}_timeout": 0
+            for name in timeout
+        }
+    )
+    retry = node.get("retry", {})
+    retry_config = {
+        "retry_enabled": retry.get(
+            "enabled",
+            retry.get("retry_enabled", _DEFAULT_RETRY["retry_enabled"]),
+        ),
+        "max_retries": retry.get(
+            "max_retries",
+            _DEFAULT_RETRY["max_retries"],
+        ),
+        "retry_interval": retry.get(
+            "interval",
+            retry.get("retry_interval", _DEFAULT_RETRY["retry_interval"]),
+        ),
+    }
+    return {
+        "id": node["id"],
+        "type": "custom",
+        "position": {"x": position * _NODE_X_GAP, "y": 0},
+        "data": {
+            "title": node["id"],
+            "desc": "",
+            "type": "http-request",
+            "variables": [],
+            "method": node["method"].lower(),
+            "url": _compile_url(node["url"], context),
+            "authorization": _compile_authorization(node.get("authorization")),
+            "headers": _compile_mapping(
+                node.get("headers", {}),
+                context,
+                key_type="header",
+            ),
+            "params": _compile_mapping(
+                node.get("query", {}),
+                context,
+                key_type="query",
+            ),
+            "body": _compile_body(node.get("body"), context),
+            "timeout": timeout,
+            "retry_config": retry_config,
+        },
+    }
+
+
+def _compile_url(value: str, context: _TemplateContext) -> str:
+    compiled = _compile_template(value, context)
+    template_free = _TEMPLATE.sub("template", value)
+    try:
+        parsed = urlsplit(template_free)
+        raw_parsed = urlsplit(value)
+        parsed.port
+    except ValueError as error:
+        raise _validation_error(["HTTP 节点 URL 不合法"]) from error
+
+    if (
+        not value
+        or value != value.strip()
+        or any(character.isspace() for character in template_free)
+        or parsed.scheme.lower() not in {"http", "https"}
+        or not parsed.netloc
+        or not parsed.hostname
+        or "{{" in raw_parsed.netloc
+        or "}}" in raw_parsed.netloc
+    ):
+        raise _validation_error(["HTTP 节点 URL 必须是包含 host 的 HTTP/HTTPS URL"])
+    _, separator, remainder = compiled.partition(":")
+    return f"{parsed.scheme.lower()}{separator}{remainder}"
+
+
+def _compile_authorization(
+    authorization: dict[str, Any] | None,
+) -> dict[str, Any]:
+    if authorization is None:
+        return {"type": "no-auth", "config": None}
+
+    auth_type = authorization["type"]
+    config = authorization.get("config")
+    if auth_type == "no-auth":
+        if config is not None:
+            raise _validation_error(
+                ["no-auth 鉴权不允许 authorization.config"]
+            )
+        return {"type": "no-auth", "config": None}
+
+    if auth_type != "api-key" or not isinstance(config, dict):
+        raise _validation_error(["authorization.config 是 api-key 鉴权的必填对象"])
+
+    api_key = config.get("api_key")
+    secret_reference = (
+        _SECRET_REFERENCE.fullmatch(api_key)
+        if isinstance(api_key, str)
+        else None
+    )
+    if secret_reference is None:
+        raise _validation_error(
+            ["authorization.config.api_key 必须是完整的 secrets 引用"]
+        )
+
+    config_type = config.get("type")
+    if config_type not in {"basic", "bearer", "custom"}:
+        raise _validation_error(
+            ["authorization.config.type 的值不受支持"]
+        )
+    header = config.get("header")
+    if config_type == "custom" and (
+        not isinstance(header, str) or not header
+    ):
+        raise _validation_error(
+            ["custom api-key 鉴权必须提供 header"]
+        )
+    if "header" in config:
+        _validate_header_name(header)
+
+    compiled_config = {
+        "type": config_type,
+        "api_key": f"{{{{#env.{secret_reference.group(1)}#}}}}",
+    }
+    if "header" in config:
+        compiled_config["header"] = header
+    return {
+        "type": auth_type,
+        "config": compiled_config,
+    }
+
+
+def _compile_body(
+    body: dict[str, Any] | None,
+    context: _TemplateContext,
+) -> dict[str, Any]:
+    if body is None or body["type"] == "none":
+        return {"type": "none", "data": []}
+
+    body_type = body["type"]
+    data = body["data"]
+    if body_type == "json":
+        if isinstance(data, str):
+            try:
+                parsed_data = json.loads(
+                    data,
+                    parse_constant=_reject_json_constant,
+                )
+                _validate_json_compatible(parsed_data)
+            except (ValueError, RecursionError) as error:
+                raise _validation_error(
+                    ["json body.data 必须是合法 JSON 字符串"]
+                ) from error
+            compiled_data = parsed_data
+        elif isinstance(data, dict):
+            compiled_data = data
+        else:
+            raise _validation_error(
+                ["json body.data 必须是对象或字符串"]
+            )
+        _validate_static_json(compiled_data)
+        try:
+            value = json.dumps(
+                compiled_data,
+                ensure_ascii=False,
+                sort_keys=True,
+                allow_nan=False,
+            )
+        except (TypeError, ValueError, RecursionError) as error:
+            raise _validation_error(
+                ["body.data 包含无法序列化的 JSON 值"]
+            ) from error
+        items = [
+            {
+                "key": "",
+                "type": "text",
+                "value": value,
+            }
+        ]
+    elif body_type == "raw-text":
+        if not isinstance(data, str):
+            raise _validation_error(
+                ["raw-text body.data 必须是字符串"]
+            )
+        items = [
+            {
+                "key": "",
+                "type": "text",
+                "value": _compile_template(data, context),
+            }
+        ]
+    elif body_type == "x-www-form-urlencoded":
+        if not isinstance(data, dict):
+            raise _validation_error(
+                ["x-www-form-urlencoded body.data 必须是对象"]
+            )
+        items = [
+            {
+                "key": key,
+                "type": "text",
+                "value": _compile_scalar(value, context),
+            }
+            for key, value in data.items()
+        ]
+    else:
+        raise _validation_error([f"不支持的 body.type：{body_type}"])
+    return {"type": body_type, "data": items}
+
+
+def _reject_json_constant(_: str) -> None:
+    raise ValueError("non-standard JSON constant")
+
+
+def _compile_mapping(
+    values: dict[str, Any],
+    context: _TemplateContext,
+    *,
+    key_type: str,
+) -> str:
+    compiled_items = []
+    for key, value in values.items():
+        _validate_mapping_key(key, key_type=key_type)
+        if isinstance(value, str):
+            _validate_single_line_value(value)
+            if key_type == "header" and _TEMPLATE.search(value):
+                raise _validation_error(
+                    ["HTTP header value 不允许使用模板"]
+                )
+        compiled_value = _compile_scalar(value, context)
+        _validate_single_line_value(compiled_value)
+        compiled_items.append(f"{key}: {compiled_value}")
+    return "\n".join(compiled_items)
+
+
+def _validate_mapping_key(key: Any, *, key_type: str) -> None:
+    if not isinstance(key, str):
+        raise _validation_error(["HTTP mapping key 必须是字符串"])
+    if _contains_line_separator(key):
+        raise _validation_error(["HTTP mapping key 不允许换行"])
+    if key_type == "header":
+        _validate_header_name(key)
+        return
+    if (
+        not key
+        or key != key.strip()
+        or ":" in key
+    ):
+        raise _validation_error(["HTTP query key 不合法"])
+
+
+def _validate_header_name(value: Any) -> None:
+    if not isinstance(value, str) or _HEADER_NAME.fullmatch(value) is None:
+        raise _validation_error(["HTTP header 名称不合法"])
+
+
+def _validate_single_line_value(value: str) -> None:
+    if _contains_line_separator(value):
+        raise _validation_error(["HTTP header/query value 不允许换行"])
+
+
+def _contains_line_separator(value: str) -> bool:
+    return bool(value) and value.splitlines() != [value]
+
+
+def _compile_scalar(value: Any, context: _TemplateContext) -> str:
+    if isinstance(value, bool):
+        text = "true" if value else "false"
+    else:
+        text = str(value)
+    return _compile_template(text, context)
+
+
+def _validate_static_json(value: Any) -> None:
+    if isinstance(value, str):
+        _validate_template_syntax(value)
+        for match in _TEMPLATE.finditer(value):
+            if _REFERENCE.fullmatch(match.group(0)) is not None:
+                raise _validation_error(
+                    [
+                        "当前 Dify 不支持安全动态 JSON body，"
+                        "请改用 query 或 x-www-form-urlencoded 传递动态值"
+                    ]
+                )
+            raise _validation_error(["存在不支持的模板引用"])
+    if isinstance(value, list):
+        for item in value:
+            _validate_static_json(item)
+    if isinstance(value, dict):
+        for key, item in value.items():
+            _validate_static_json(key)
+            _validate_static_json(item)
+
+
+def _compile_template(value: str, context: _TemplateContext) -> str:
+    _validate_template_syntax(value)
+
+    def replace(match: re.Match[str]) -> str:
+        reference = _REFERENCE.fullmatch(match.group(0))
+        if reference is None:
+            raise _validation_error(["存在不支持的模板引用"])
+        namespace, field = reference.groups()
+        if namespace == "inputs":
+            if field not in context.input_names:
+                raise _validation_error([f"未知输入引用：inputs.{field}"])
+            return f"{{{{#start.{field}#}}}}"
+        if namespace == "secrets":
+            return f"{{{{#env.{field}#}}}}"
+        if namespace not in context.node_ids:
+            raise _validation_error([f"未知节点引用：{namespace}"])
+        allowed = context.node_output_fields.get(namespace)
+        if allowed is None:
+            allowed = _HTTP_OUTPUT_FIELDS
+        if field not in allowed:
+            raise _validation_error([f"节点 {namespace} 不支持输出字段：{field}"])
+        if namespace in context.aggregator_ids:
+            return f"{{{{#{namespace}.{field}.output#}}}}"
+        return f"{{{{#{namespace}.{field}#}}}}"
+
+    return _TEMPLATE.sub(replace, value)
+
+
+def _validate_template_syntax(value: str) -> None:
+    cursor = 0
+    for match in _TEMPLATE.finditer(value):
+        unmatched = value[cursor : match.start()]
+        if (
+            "{{" in unmatched
+            or "}}" in unmatched
+            or (match.start() > 0 and value[match.start() - 1] == "{")
+            or (match.end() < len(value) and value[match.end()] == "}")
+        ):
+            raise _validation_error(["模板语法不合法"])
+        cursor = match.end()
+    remainder = value[cursor:]
+    if "{{" in remainder or "}}" in remainder:
+        raise _validation_error(["模板语法不合法"])
+
+
+def _compile_end_node(
+    outputs: dict[str, str],
+    *,
+    position: int,
+    node_ids: frozenset[str],
+    node_output_fields: dict[str, frozenset[str]] | None = None,
+    aggregator_ids: frozenset[str] | None = None,
+) -> dict[str, Any]:
+    output_fields = node_output_fields or {}
+    aggregators = aggregator_ids or frozenset()
+    compiled_outputs = []
+    for variable, expression in outputs.items():
+        reference = _REFERENCE.fullmatch(expression)
+        if reference is None:
+            raise _validation_error(
+                [f"outputs.{variable} 必须是单个节点输出引用"]
+            )
+        node_id, field = reference.groups()
+        if node_id not in node_ids:
+            raise _validation_error([f"outputs.{variable} 引用了未知节点：{node_id}"])
+        allowed = output_fields.get(node_id, _HTTP_OUTPUT_FIELDS)
+        if field not in allowed:
+            raise _validation_error(
+                [f"outputs.{variable} 使用了非法输出字段：{field}"]
+            )
+        if node_id in aggregators:
+            selector: list[str] = [node_id, field, "output"]
+        else:
+            selector = [node_id, field]
+        compiled_outputs.append(
+            {
+                "variable": variable,
+                "value_selector": selector,
+            }
+        )
+    return {
+        "id": "end",
+        "type": "custom",
+        "position": {"x": position * _NODE_X_GAP, "y": 0},
+        "data": {
+            "title": "End",
+            "desc": "",
+            "type": "end",
+            "outputs": compiled_outputs,
+        },
+    }
+
+
+def _compile_edge(
+    *,
+    source: str,
+    target: str,
+    source_type: str,
+    target_type: str,
+) -> dict[str, Any]:
+    return {
+        "id": f"{source}-{target}",
+        "type": "custom",
+        "source": source,
+        "sourceHandle": "source",
+        "target": target,
+        "targetHandle": "target",
+        "data": {
+            "sourceType": source_type,
+            "targetType": target_type,
+        },
+    }
+
+
+def _json_path(parts: list[Any]) -> str:
+    path = ""
+    for part in parts:
+        if isinstance(part, int):
+            path += f"[{part}]"
+        else:
+            path += f".{part}" if path else str(part)
+    return path
+
+
+def _validation_error(details: list[str]) -> TacoError:
+    return TacoError(
+        code="WORKFLOW_VALIDATION_FAILED",
+        message="Workflow DSL 校验失败：" + "；".join(details),
+        exit_code=6,
+        hint="请执行 taco schema workflow -o json（或 workflow.http）后修正 YAML DSL。",
+    )