Release v2.0.1

DECISION-LOGS.md

@@ -15,3 +15,4 @@
 - _05.05.2026_: [Extract AI Studio from `apps/demo` into its own `apps/ai-studio` app](./apps/ai-studio/ai-studio-extraction.decision-log.md)
 - _05.05.2026_: [Workspace layout — relocate libraries to `packages/`](./packages/sdk/workspace-layout.decision-log.md)
 - _06.05.2026_: [Make execution-core generic over the consumer's node union](./packages/execution-core/generic-execution-core.decision-log.md)
+- _15.05.2026_: [AuthPort seam for backend authn/authz](./apps/backend/auth-port.decision-log.md)

apps/ai-studio/package.json

@@ -16,7 +16,7 @@
     "@jsonforms/core": "^3.4.1",
     "@jsonforms/react": "^3.4.1",
     "@phosphor-icons/react": "^2.1.7",
-    "@synergycodes/overflow-ui": "1.0.0-beta.26",
+    "@synergycodes/overflow-ui": "1.0.0-beta.27",
     "@workflow-builder/types": "workspace:*",
     "@xyflow/react": "catalog:",
     "clsx": "^2.1.1",

apps/ai-studio/src/data/sales-inquiry-flow.ts

@@ -98,7 +98,7 @@ Be concise. Use the exact format above.`,
             decisionBranches: [
               {
                 id: 'branch-pricing',
-                sourceHandle: 'decision-1:source:inner:pricing',
+                sourceHandle: 'source:inner:pricing',
                 label: 'Pricing',
                 conditions: [
                   {
@@ -111,7 +111,7 @@ Be concise. Use the exact format above.`,
               },
               {
                 id: 'branch-technical',
-                sourceHandle: 'decision-1:source:inner:technical',
+                sourceHandle: 'source:inner:technical',
                 label: 'Technical',
                 conditions: [
                   {
@@ -124,7 +124,7 @@ Be concise. Use the exact format above.`,
               },
               {
                 id: 'branch-general',
-                sourceHandle: 'decision-1:source:inner:general',
+                sourceHandle: 'source:inner:general',
                 label: 'General',
                 conditions: [],
               },
@@ -252,72 +252,75 @@ If there are issues, output: "⚠️ NEEDS REVISION" followed by specific correc
     edges: [
       {
         source: 'trigger-1',
-        sourceHandle: 'trigger-1:source',
+        sourceHandle: 'source',
         target: 'classify-1',
-        targetHandle: 'classify-1:target',
+        targetHandle: 'target',
         type: 'labelEdge',
         id: 'edge-trigger-classify',
         data: {},
       },
       {
         source: 'classify-1',
-        sourceHandle: 'classify-1:source',
+        sourceHandle: 'source',
         target: 'decision-1',
-        targetHandle: 'decision-1:target',
+        targetHandle: 'target',
         type: 'labelEdge',
         id: 'edge-classify-decision',
         data: {},
       },
       {
         source: 'decision-1',
-        sourceHandle: 'decision-1:source:inner:pricing',
+        sourceHandle: 'source:inner:pricing',
+        zIndex: 1001,
         target: 'pricing-1',
-        targetHandle: 'pricing-1:target',
+        targetHandle: 'target',
         type: 'labelEdge',
         id: 'edge-decision-pricing',
         data: {},
       },
       {
         source: 'decision-1',
-        sourceHandle: 'decision-1:source:inner:technical',
+        sourceHandle: 'source:inner:technical',
+        zIndex: 1001,
         target: 'technical-1',
-        targetHandle: 'technical-1:target',
+        targetHandle: 'target',
         type: 'labelEdge',
         id: 'edge-decision-technical',
         data: {},
       },
       {
         source: 'decision-1',
-        sourceHandle: 'decision-1:source:inner:general',
+        sourceHandle: 'source:inner:general',
+        zIndex: 1001,
         target: 'general-1',
-        targetHandle: 'general-1:target',
+        targetHandle: 'target',
         type: 'labelEdge',
         id: 'edge-decision-general',
         data: {},
       },
       {
         source: 'pricing-1',
-        sourceHandle: 'pricing-1:source',
+        sourceHandle: 'source',
         target: 'review-1',
-        targetHandle: 'review-1:target',
+        targetHandle: 'target',
         type: 'labelEdge',
         id: 'edge-pricing-review',
         data: {},
       },
       {
         source: 'technical-1',
-        sourceHandle: 'technical-1:source',
+        sourceHandle: 'source',
         target: 'review-1',
-        targetHandle: 'review-1:target',
+        targetHandle: 'target',
         type: 'labelEdge',
         id: 'edge-technical-review',
         data: {},
       },
       {
         source: 'general-1',
-        sourceHandle: 'general-1:source',
+        sourceHandle: 'source',
         target: 'review-1',
-        targetHandle: 'review-1:target',
+        targetHandle: 'target',
         type: 'labelEdge',
         id: 'edge-general-review',
         data: {},

apps/backend/.env.example

@@ -1,7 +1,13 @@
 DATABASE_URL=postgresql://wb:wb@127.0.0.1:5432/workflow_builder
 TEMPORAL_ADDRESS=127.0.0.1:7233
 PORT=3001
-# Hostname to bind. Default 127.0.0.1 (loopback only — single-tenant local dev).
+# Hostname to bind. Default 127.0.0.1 (loopback only - single-tenant local dev).
 # Change ONLY if you understand: this server has no auth, anyone reachable on
 # the host:port can fully control workflows.
 HOST=127.0.0.1
+# AuthPort opt-in. The reference backend wires AllowAllAuthPort, which permits
+# every caller and every action. It refuses to start without this explicit
+# opt-in so a forgotten env var (CI, deploy template) fails loudly instead of
+# exposing the API. Remove this line when wiring a real AuthPort. See:
+# apps/backend/auth-port.decision-log.md
+WB_AUTH_PORT=allow-all

apps/backend/README.md

@@ -1,7 +1,7 @@
 # AI Studio — Execution Backend
 
-> ⚠️ **Reference implementation — local development only.**
-> No authentication, no authorization, no tenant isolation. The HTTP server and the docker-compose services bind to `127.0.0.1` by default. Do not expose to the internet or shared networks without first implementing real authn/authz.
+> ⚠️ **Reference implementation, local development only.**
+> No real authentication. The bundled `AllowAllAuthPort` permits every caller and every action (see `src/auth/`), and the constructor refuses to start without the explicit `WB_AUTH_PORT=allow-all` opt-in so a forgotten env var fails loudly. No tenant isolation. The HTTP server and the docker-compose services bind to `127.0.0.1` by default. Do not expose to the internet or shared networks without first plugging in a real `AuthPort`, see [`auth-port.decision-log.md`](./auth-port.decision-log.md) for the seam, default, and a JWT adapter sketch.
 
 > **Note:** setup is in [root README "Path B. Run the full stack demo"](../../README.md#path-b-run-the-full-stack-demo). This file documents the backend's internals, not how to start it.