feat: implement save workflow to file

Signed-off-by: Simon Emms <simon@simonemms.com>

Author: mrsimonemms

src/lib/server/workflows-dir.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright 2025 - 2026 Zigflow authors <https://github.com/zigflow/studio/graphs/contributors>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { env } from '$env/dynamic/public';
+import { resolve } from 'node:path';
+
+/**
+ * Absolute path to the workflows directory.
+ *
+ * Configured via PUBLIC_WORKFLOWS_DIR env var; defaults to ./workflows
+ * relative to the process working directory.
+ */
+export const WORKFLOWS_DIR: string =
+  env.PUBLIC_WORKFLOWS_DIR ?? resolve(process.cwd(), 'workflows');

src/lib/tasks/registry.ts

@@ -56,12 +56,13 @@ function emptyGraph(): FlowGraph {
 }
 
 function taskNode(name: string, type: NodeType): TaskNode {
+  const nid = id();
   return {
-    id: id(),
+    id: nid,
     type: 'task',
     name,
     config: defaultConfig(type),
-    metadata: { __zigflow_id: id() },
+    metadata: { __zigflow_id: nid },
   } as TaskNode;
 }
 
@@ -197,53 +198,65 @@ export const TASK_REGISTRY: readonly TaskDefinition[] = [
     label: 'Switch',
     category: 'control',
     description: 'Branch on a condition',
-    create: (): SwitchNode => ({
-      id: id(),
-      type: 'switch',
-      name: 'switch',
-      branches: [],
-      metadata: { __zigflow_id: id() },
-    }),
+    create: (): SwitchNode => {
+      const nid = id();
+      return {
+        id: nid,
+        type: 'switch',
+        name: 'switch',
+        branches: [],
+        metadata: { __zigflow_id: nid },
+      };
+    },
   },
   {
     type: 'fork',
     label: 'Fork',
     category: 'control',
     description: 'Run branches in parallel',
-    create: (): ForkNode => ({
-      id: id(),
-      type: 'fork',
-      name: 'fork',
-      compete: false,
-      branches: [],
-      metadata: { __zigflow_id: id() },
-    }),
+    create: (): ForkNode => {
+      const nid = id();
+      return {
+        id: nid,
+        type: 'fork',
+        name: 'fork',
+        compete: false,
+        branches: [],
+        metadata: { __zigflow_id: nid },
+      };
+    },
   },
   {
     type: 'try',
     label: 'Try / Catch',
     category: 'control',
     description: 'Execute with error handling',
-    create: (): TryNode => ({
-      id: id(),
-      type: 'try',
-      name: 'try-catch',
-      tryGraph: emptyGraph(),
-      metadata: { __zigflow_id: id() },
-    }),
+    create: (): TryNode => {
+      const nid = id();
+      return {
+        id: nid,
+        type: 'try',
+        name: 'try-catch',
+        tryGraph: emptyGraph(),
+        metadata: { __zigflow_id: nid },
+      };
+    },
   },
   {
     type: 'loop',
     label: 'Loop',
     category: 'control',
     description: 'Iterate over a collection',
-    create: (): LoopNode => ({
-      id: id(),
-      type: 'loop',
-      name: 'loop',
-      in: '$.',
-      bodyGraph: emptyGraph(),
-      metadata: { __zigflow_id: id() },
-    }),
+    create: (): LoopNode => {
+      const nid = id();
+      return {
+        id: nid,
+        type: 'loop',
+        name: 'loop',
+        in: '$.',
+        bodyGraph: emptyGraph(),
+        metadata: { __zigflow_id: nid },
+      };
+    },
   },
 ];

src/routes/api/workflows/[...workflowId]/+server.ts

@@ -0,0 +1,88 @@
+/*
+ * Copyright 2025 - 2026 Zigflow authors <https://github.com/zigflow/studio/graphs/contributors>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { exportToYaml } from '$lib/export/yaml';
+import { WORKFLOWS_DIR } from '$lib/server/workflows-dir';
+import type { WorkflowFile } from '$lib/tasks/model';
+import { json } from '@sveltejs/kit';
+import { randomUUID } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
+
+import type { RequestHandler } from './$types';
+
+export const PUT: RequestHandler = async ({ params, request }) => {
+  const fileName = params.workflowId;
+
+  // Enforce .yaml / .yml extension.
+  if (!fileName.endsWith('.yaml') && !fileName.endsWith('.yml')) {
+    return json(
+      { ok: false, error: 'File must have a .yaml or .yml extension' },
+      { status: 400 },
+    );
+  }
+
+  // Validate path is inside WORKFLOWS_DIR — prevent path traversal.
+  const filePath = resolve(WORKFLOWS_DIR, fileName);
+  if (!filePath.startsWith(WORKFLOWS_DIR + '/') && filePath !== WORKFLOWS_DIR) {
+    return json({ ok: false, error: 'Invalid workflow path' }, { status: 400 });
+  }
+
+  // Parse JSON body.
+  let workflowFile: WorkflowFile;
+  try {
+    const body: unknown = await request.json();
+    if (
+      typeof body !== 'object' ||
+      body === null ||
+      !('workflowFile' in body)
+    ) {
+      return json(
+        { ok: false, error: 'Missing workflowFile in request body' },
+        { status: 400 },
+      );
+    }
+    workflowFile = (body as { workflowFile: WorkflowFile }).workflowFile;
+  } catch {
+    return json({ ok: false, error: 'Invalid JSON body' }, { status: 400 });
+  }
+
+  // Export WorkflowFile → YAML (also validates the graph).
+  const exportResult = exportToYaml(workflowFile);
+  if (!exportResult.ok) {
+    return json(
+      { ok: false, error: `Export failed: ${exportResult.errors.join('; ')}` },
+      { status: 400 },
+    );
+  }
+
+  // Atomic write: write to a temp file then rename so readers never see a
+  // partial file.
+  const dir = dirname(filePath);
+  const tempPath = resolve(dir, `.${basename(filePath)}.tmp.${randomUUID()}`);
+  try {
+    await fs.writeFile(tempPath, exportResult.yaml, 'utf-8');
+    await fs.rename(tempPath, filePath);
+  } catch (err) {
+    // Best-effort cleanup of the temp file.
+    await fs.unlink(tempPath).catch(() => undefined);
+    return json(
+      { ok: false, error: `Write failed: ${String(err)}` },
+      { status: 500 },
+    );
+  }
+
+  return json({ ok: true });
+};

src/routes/workflows/[...workflowId]/+page.server.ts

@@ -13,18 +13,15 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { env } from '$env/dynamic/public';
 import { exportToYaml } from '$lib/export/yaml';
+import { WORKFLOWS_DIR } from '$lib/server/workflows-dir';
 import { parseWorkflowFile } from '$lib/tasks/parse';
 import { error } from '@sveltejs/kit';
-import { promises as fs } from 'fs';
-import { resolve } from 'path';
+import { promises as fs } from 'node:fs';
+import { resolve } from 'node:path';
 
 import type { PageServerLoad } from './$types';
 
-const WORKFLOWS_DIR =
-  env.PUBLIC_WORKFLOWS_DIR ?? resolve(process.cwd(), 'workflows');
-
 export const load: PageServerLoad = async ({ params }) => {
   const fileName = params.workflowId;
   const filePath = resolve(WORKFLOWS_DIR, fileName);