chore(release): promote main to release for @workflowbuilder/temporal 0.1.0

.changeset/config.json

@@ -7,15 +7,8 @@
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
-  "ignore": [
-    "@workflow-builder/demo",
-    "@workflow-builder/ai-studio",
-    "@workflow-builder/backend",
-    "@workflow-builder/execution-worker",
-    "@workflow-builder/docs",
-    "@workflow-builder/execution-core",
-    "@workflow-builder/icons",
-    "@workflow-builder/types",
-    "@workflow-builder/tools"
-  ]
+  "privatePackages": {
+    "version": false,
+    "tag": false
+  }
 }

.changeset/move-ui-library-in-repo.md

@@ -0,0 +1,7 @@
+---
+'@workflowbuilder/sdk': minor
+---
+
+Consume the UI component library from the in-repo `@workflowbuilder/ui` (Base UI) instead of the published `@synergycodes/overflow-ui`.
+
+The SDK previously bundled `@synergycodes/overflow-ui@1.0.0-beta.27` (built on MUI / Mantine / Emotion / Floating UI). It now bundles the in-repo `@workflowbuilder/ui@2.0.0`, rebuilt on [Base UI](https://base-ui.com/). `@base-ui/react` is now a regular dependency of the SDK (installed automatically, not bundled) rather than an inlined implementation detail. Bundled component visuals and interaction details change accordingly; the SDK's exported symbols are unchanged, but public types deriving from the UI library (`InputControlProps`, `TextAreaControlProps`) now build on `@workflowbuilder/ui` type shapes (picked keys unchanged), and the internal DOM structure and class names of all bundled UI changed (MUI Base + Mantine → Base UI) — styles or tests written against those internal class names may need updating. Modal open/close now runs its enter and exit fade transitions (previously the dialog appeared and disappeared instantly).

.changeset/sdk-date-picker-trigger-height.md

@@ -0,0 +1,5 @@
+---
+'@workflowbuilder/sdk': patch
+---
+
+Date and datetime variable inputs regained their intended `2.5rem` trigger height and left-aligned text; the style override now matches the new DatePicker markup.

.changeset/sdk-is-start-node-flag.md

@@ -0,0 +1,5 @@
+---
+'@workflowbuilder/sdk': minor
+---
+
+Node data gains an `isStartNode?: boolean` flag marking the workflow's entry point. Declare it on the palette item (`NodeDefinition`) and the editor copies it into the node's `data` when the node is dropped, so execution integrations can read `data.isStartNode` instead of matching the node's xyflow `type` against `'start-node'`. `templateType` keeps selecting the visual template only.

.changeset/sdk-single-top-layer.md

@@ -0,0 +1,5 @@
+---
+'@workflowbuilder/sdk': minor
+---
+
+The SDK stylesheet now declares a single top-level cascade layer: XYFlow's stylesheet and the SDK resets moved from the `ext-lib` / `reset` layers into `ui.base`, and the file opens with the same `@layer ui.base, ui.component;` statement as every `@workflowbuilder/ui` stylesheet. Component styling no longer depends on stylesheet load order. If you targeted the removed `reset` / `ext-lib` layer names, plain unlayered CSS wins over all library layers.

.changeset/sdk-ssr-modal-portal.md

@@ -0,0 +1,5 @@
+---
+'@workflowbuilder/sdk': patch
+---
+
+`ModalProvider` no longer touches `document` during server-side rendering; the modal portal mounts after hydration. Fixes `ReferenceError: document is not defined` when the editor renders in SSR frameworks such as Next.js.

.changeset/ui-base-ui-1-7.md

@@ -0,0 +1,5 @@
+---
+'@workflowbuilder/ui': minor
+---
+
+`@base-ui/react` dependency moved from `1.4.1` to `1.7.0` (still exact-pinned). Overlay transitions (Modal, Menu, Select, Tooltip, DatePicker) were re-validated on the 1.7 line.

.changeset/ui-export-prop-types.md

@@ -0,0 +1,5 @@
+---
+'@workflowbuilder/ui': minor
+---
+
+Component prop types are now exported: `AvatarProps`, `CheckboxProps`, `RadioProps`, `StatusProps`, `TooltipProps`, `MenuProps`, `ModalProps`, `EdgeLabelProps`, `NodeIconProps`, `NodeDescriptionProps`, `NodeAsPortWrapperProps`, `SegmentPickerProps` (with its controlled/uncontrolled variants), the NavButton variant prop types, and `DatePickerProps` now covers the component's full runtime surface (`value`, `defaultValue`, `placeholder`, `valueFormat`, `type`, `error`). Supporting types used in those signatures (`Shape`, `IconNode`) are exported as well.

.changeset/ui-export-use-edge-style-params.md

@@ -0,0 +1,5 @@
+---
+'@workflowbuilder/ui': minor
+---
+
+`UseEdgeStyleParams`, the parameter type of the `useEdgeStyle` hook, is now exported.

.changeset/ui-layer-root-defaults.md

@@ -0,0 +1,5 @@
+---
+'@workflowbuilder/ui': minor
+---
+
+Variable defaults (`--ax-public-*` component defaults and the `--ax-*` design tokens in `tokens.css`) now ship inside the `ui.base` cascade layer. A plain `:root { --ax-…: … }` override in your app now wins regardless of stylesheet load order; previously a lazily loaded component stylesheet could silently restore the default.

.changeset/ui-react-18-peer.md

@@ -0,0 +1,5 @@
+---
+'@workflowbuilder/ui': minor
+---
+
+React 18 is accepted again: the `react` / `react-dom` peer ranges widened from `^19.0.0` to `^18.0.0 || ^19.0.0`, matching Base UI's own support range.

.dockerignore

@@ -24,7 +24,22 @@ tools/
 !tools/deployment/nginx
 .gitignore
 
+# examples
+examples/
+
 # env files hold secrets — never in a build context
 **/.env
 **/.env.*
 !**/.env.example
+
+# certificate material is mounted at runtime — never built into an image. The
+# Dockerfile needs one file from deploy/, so the rest stays out of the context:
+# a TEMPORAL_TLS_DIR under deploy/ cannot reach COPY . . whatever it is named.
+deploy/
+!deploy/ai-studio/nginx
+**/*.pem
+**/*.key
+**/*.crt
+**/*.cer
+**/*.p12
+**/*.pfx

.github/workflows/deploy-ai-studio.yml

@@ -77,25 +77,58 @@ jobs:
     needs: build-and-push
 
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Log in to Azure
         uses: azure/login@v2
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
 
+      # The VM runs the repo's compose files, shipped here on every deploy (base64,
+      # so the script stays free of quoting). Compose is run from the project
+      # directory, not with -f: that is what applies docker-compose.override.yml
+      # by default and honours COMPOSE_FILE from the VM's .env.
+      #
+      # The retired-key check runs before anything is written, so a refused deploy
+      # leaves the VM exactly as it was. It lives here rather than in the compose
+      # file because Compose 2.21 and older evaluate a nested `${A:+${B:?}}` guard
+      # eagerly and fail on every command, key set or not.
+      #
+      # The image tags are written into that .env rather than exported: an export
+      # dies with this shell, and the next `docker compose up -d worker` on the VM
+      # would fall back to the local ai-studio-* names. Only the two image lines
+      # are replaced; the rest of .env is the VM's own and stays untouched.
       - name: Refresh docker compose on Azure VM
+        env:
+          IMAGE: ${{ env.REGISTRY }}/${{ env.APP }}:${{ needs.build-and-push.outputs.image_tag }}
         run: |
+          COMPOSE_B64=$(base64 -w0 deploy/ai-studio/docker-compose.yml)
+          OVERRIDE_B64=$(base64 -w0 deploy/ai-studio/docker-compose.override.yml)
+          SCRIPT=$(cat <<EOF
+          set -e
+          cd /app/ai-studio
+          if [ -f .env ] && grep -Eq '^OPENROUTER_API_KEY=.+' .env; then
+            echo "OPENROUTER_API_KEY is still set in the VM's .env. It was renamed to AI_API_KEY and is no longer read; rename it and set AI_BASE_URL and AI_MODEL too (values in deploy/ai-studio/.env.example), then deploy again."
+            exit 1
+          fi
+          echo "$COMPOSE_B64" | base64 -d > docker-compose.yml
+          echo "$OVERRIDE_B64" | base64 -d > docker-compose.override.yml
+          touch .env
+          { grep -vE '^(RUNTIME_IMAGE|WEB_IMAGE)=' .env || true; printf 'RUNTIME_IMAGE=%s\nWEB_IMAGE=%s\n' "$IMAGE-runtime" "$IMAGE-web"; } > .env.tmp
+          chmod --reference=.env .env.tmp && chown --reference=.env .env.tmp && mv .env.tmp .env
+          az acr login --name synergycodes
+          docker compose pull
+          docker compose up -d --no-build --force-recreate --remove-orphans
+          echo DEPLOY_SCRIPT_SUCCEEDED
+          EOF
+          )
           OUTPUT=$(az vm run-command invoke \
             --name ${{ vars.AI_STUDIO_VM_NAME }} \
             --resource-group ${{ vars.AI_STUDIO_VM_RG }} \
             --command-id RunShellScript \
-            --scripts '
-              set -e
-              az acr login --name synergycodes
-              docker compose -f /app/ai-studio/docker-compose.yml pull
-              docker compose -f /app/ai-studio/docker-compose.yml up -d --no-build --force-recreate
-              echo DEPLOY_SCRIPT_SUCCEEDED
-            ')
+            --scripts "$SCRIPT")
           echo "$OUTPUT"
           echo "$OUTPUT" | grep -q DEPLOY_SCRIPT_SUCCEEDED

.github/workflows/deploy-docs.yml

@@ -1,7 +1,11 @@
 name: Deploy docs
 
-# Builds the docs site and deploys to Azure Static Web Apps on every push
-# to the `release` branch.
+# Builds the docs site and deploys it to Azure Static Web Apps. Runs only when a
+# maintainer starts it from the Actions tab (workflow_dispatch): pick the `release`
+# branch, then "Run workflow". Nothing deploys on push. The site documents what is
+# on npm, and `main` runs ahead of npm between releases (unreleased SDK API, packages
+# not published yet), so the production deploy refuses every branch but `release`.
+# A preview environment (SWA_ENV set) may deploy from any branch.
 #
 # Required repo secrets:
 #   SWA_TOKEN          Azure Static Web Apps deployment token
@@ -11,8 +15,6 @@ name: Deploy docs
 #   SWA_ENV            SWA environment name (leave unset for production)
 
 on:
-  push:
-    branches: ["release"]
   workflow_dispatch:
 
 permissions:
@@ -23,6 +25,13 @@ jobs:
     name: Build and deploy docs
     runs-on: ubuntu-latest
     steps:
+      - name: Refuse a production deploy from any branch but release
+        # An unset SWA_ENV means the production environment.
+        if: github.ref_name != 'release' && !vars.SWA_ENV
+        run: |
+          echo "::error::Production docs deploy requested from '${GITHUB_REF_NAME}'. The site has to match npm, so it is built from 'release' only. Select the release branch, or set the SWA_ENV variable to deploy a preview."
+          exit 1
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
@@ -42,6 +51,11 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # UI must build first: docs imports @workflowbuilder/ui/{styles,tokens}.css
+      # and its components, both resolved from packages/ui/dist.
+      - name: Build UI
+        run: pnpm build:ui
+
       # SDK must build first so TypeDoc can read its compiled types.
       - name: Build SDK
         run: pnpm --filter @workflowbuilder/sdk build:lib

.github/workflows/pr-check-docs.yml

@@ -0,0 +1,58 @@
+name: PR Check (docs)
+
+# The docs site is generated from packages/ui source (ui-api tables, live
+# examples) and consumes its built dist, so a PR touching either can break
+# the docs build - which otherwise first runs at release-time deploy.
+# Full `astro build` is the gate: it runs the ui-api generator, the
+# component-coverage guard, and page rendering (loud failures included).
+# Typecheck is deliberately absent: apps/docs tolerates known starlight
+# virtual-module type errors.
+
+on:
+  pull_request:
+    branches:
+      - main
+      - release # merging into release is what deploys the docs site
+    paths:
+      - 'apps/docs/**'
+      - 'packages/ui/**'
+      - 'packages/tokens/**'
+      # starlight-typedoc generates the /api reference from SDK sources.
+      - 'packages/sdk/**'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'package.json'
+      - '.github/workflows/pr-check-docs.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  docs:
+    name: Docs build (ui-api generator + coverage + astro)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Enable Corepack
+        run: npm i -g corepack@latest
+
+      - name: Install pnpm
+        run: corepack prepare
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build UI library
+        run: pnpm build:ui
+
+      - name: Build docs
+        run: pnpm build:docs