Merge branch 'staging' into feat/wf-log-block

Resolve conflicts in /api/logs and /api/logs/[id] by adopting staging's
new contract pattern (parseRequest, fetchLogDetail, cursor pagination)
and re-applying checkSessionOrInternalAuth on top so the Logs block
tools can call these routes from the executor.

Update tools/logs and the Logs block to match the new API:
- /api/logs returns { data, nextCursor }; drop offset/page/total
- /api/logs/[id] now requires ?workspaceId=... query
- Drop the details='basic'|'full' knob (gone from staging)
- Add cursor, sortBy, sortOrder subblocks
- Use WorkflowLogSummary / WorkflowLogDetail types from contract

Author: TheodoreSpeaks

.github/workflows/test-build.yml

@@ -90,15 +90,15 @@ jobs:
 
           echo "✅ All feature flags are properly configured"
 
-      - name: Check subblock ID stability
+      - name: Check block registry invariants
         run: |
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             BASE_REF="origin/${{ github.base_ref }}"
             git fetch --depth=1 origin "${{ github.base_ref }}" 2>/dev/null || true
           else
             BASE_REF="HEAD~1"
           fi
-          bun run apps/sim/scripts/check-subblock-id-stability.ts "$BASE_REF"
+          bun run apps/sim/scripts/check-block-registry.ts "$BASE_REF"
 
       - name: Lint code
         run: bun run lint:check

apps/docs/content/docs/en/tools/image_generator.mdx

@@ -29,7 +29,7 @@ In Sim, the DALL-E integration enables your agents to generate images programmat
 
 ## Usage Instructions
 
-Integrate Image Generator into the workflow. Can generate images using DALL-E 3 or GPT Image.
+Integrate Image Generator into the workflow. Can generate images using DALL-E 3, GPT Image 1, or GPT Image 2.
 
 
 
@@ -43,12 +43,14 @@ Generate images using OpenAI
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `model` | string | Yes | The model to use \(gpt-image-1 or dall-e-3\) |
+| `model` | string | Yes | The model to use \(dall-e-3, gpt-image-1, or gpt-image-2\) |
 | `prompt` | string | Yes | A text description of the desired image |
-| `size` | string | Yes | The size of the generated images \(1024x1024, 1024x1792, or 1792x1024\) |
-| `quality` | string | No | The quality of the image \(standard or hd\) |
-| `style` | string | No | The style of the image \(vivid or natural\) |
-| `background` | string | No | The background color, only for gpt-image-1 |
+| `size` | string | Yes | Image size. dall-e-3: 1024x1024, 1024x1792, or 1792x1024. gpt-image-1: auto, 1024x1024, 1536x1024, or 1024x1536. gpt-image-2: auto or any size with edges ≤3840px and multiples of 16 \(e.g. 1024x1024, 1536x1024, 1024x1536, 2560x1440, 3840x2160\). |
+| `quality` | string | No | Quality. dall-e-3: standard\|hd. gpt-image-1/gpt-image-2: auto\|low\|medium\|high |
+| `style` | string | No | The style of the image \(vivid or natural\), only for dall-e-3 |
+| `background` | string | No | Background. gpt-image-1: auto\|transparent\|opaque. gpt-image-2: auto\|opaque \(transparent not supported\) |
+| `outputFormat` | string | No | Output image format \(png, jpeg, webp\), only for gpt-image-1 and gpt-image-2 |
+| `moderation` | string | No | Moderation level \(auto or low\), only for gpt-image-1 and gpt-image-2 |
 | `n` | number | No | The number of images to generate \(1-10\) |
 | `apiKey` | string | Yes | Your OpenAI API key |
 

apps/docs/content/docs/en/tools/knowledge.mdx

@@ -49,6 +49,8 @@ Search for similar content in a knowledge base using vector similarity
 | `tagValue` | string | No | No description |
 | `rerankerEnabled` | boolean | No | Whether to apply Cohere reranking to vector search results |
 | `rerankerModel` | string | No | Cohere rerank model to use \(one of: rerank-v4.0-pro, rerank-v4.0-fast, rerank-v3.5\) |
+| `rerankerInputCount` | number | No | Number of vector results sent to the Cohere reranker \(1–100\). Defaults to topK × 4 capped at 100. |
+| `apiKey` | string | No | Cohere API key for reranker \(self-hosted deployments only\) |
 | `tagFilters` | string | No | No description |
 
 #### Output

apps/docs/content/docs/en/tools/mem0.mdx

@@ -50,12 +50,9 @@ Add memories to Mem0 for persistent storage and retrieval
 
 | Parameter | Type | Description |
 | --------- | ---- | ----------- |
-| `ids` | array | Array of memory IDs that were created |
-| `memories` | array | Array of memory objects that were created |
-|   ↳ `id` | string | Unique identifier for the memory |
-|   ↳ `memory` | string | The content of the memory |
-|   ↳ `event` | string | Event type indicating operation performed \(ADD, UPDATE, DELETE, NOOP\) |
-|   ↳ `metadata` | json | Custom metadata associated with the memory |
+| `message` | string | Status message for the queued memory processing job |
+| `status` | string | Processing status returned by Mem0 |
+| `event_id` | string | Event ID for polling memory processing status |
 
 ### `mem0_search_memories`
 
@@ -102,6 +99,7 @@ Retrieve memories from Mem0 by ID or filter criteria
 | `startDate` | string | No | Start date for filtering by created_at \(e.g., "2024-01-15"\) |
 | `endDate` | string | No | End date for filtering by created_at \(e.g., "2024-12-31"\) |
 | `limit` | number | No | Maximum number of results to return \(e.g., 10, 50, 100\) |
+| `page` | number | No | Page number to retrieve for paginated list results |
 | `apiKey` | string | Yes | Your Mem0 API key |
 
 #### Output
@@ -120,10 +118,9 @@ Retrieve memories from Mem0 by ID or filter criteria
 |   ↳ `categories` | json | Auto-assigned categories for the memory |
 |   ↳ `created_at` | string | ISO 8601 timestamp when the memory was created |
 |   ↳ `updated_at` | string | ISO 8601 timestamp when the memory was last updated |
-|   ↳ `owner` | string | Owner of the memory |
-|   ↳ `organization` | string | Organization associated with the memory |
-|   ↳ `immutable` | boolean | Whether the memory can be modified |
-|   ↳ `expiration_date` | string | Expiration date after which memory is not retrieved |
 | `ids` | array | Array of memory IDs that were retrieved |
+| `count` | number | Total number of memories matching the filters |
+| `next` | string | URL for the next page of results |
+| `previous` | string | URL for the previous page of results |
 
 

apps/docs/content/docs/en/tools/stt.mdx

@@ -120,7 +120,7 @@ Transcribe audio and video files to text using leading AI providers. Supports mu
 | --------- | ---- | -------- | ----------- |
 | `provider` | string | Yes | STT provider \(elevenlabs\) |
 | `apiKey` | string | Yes | ElevenLabs API key |
-| `model` | string | No | ElevenLabs model to use \(scribe_v1, scribe_v1_experimental\) |
+| `model` | string | No | ElevenLabs model to use \(scribe_v2\) |
 | `audioFile` | file | No | Audio or video file to transcribe \(e.g., MP3, WAV, M4A, WEBM\) |
 | `audioFileReference` | file | No | Reference to audio/video file from previous blocks |
 | `audioUrl` | string | No | URL to audio or video file |

apps/docs/content/docs/en/triggers/meta.json

@@ -39,6 +39,7 @@
     "servicenow",
     "slack",
     "stripe",
+    "table",
     "telegram",
     "twilio_voice",
     "typeform",

apps/docs/content/docs/en/triggers/table.mdx

@@ -0,0 +1,45 @@
+---
+title: Table
+description: Available Table triggers for automating workflows
+---
+
+import { BlockInfoCard } from "@/components/ui/block-info-card"
+
+<BlockInfoCard
+  type="table"
+  color="#10B981"
+/>
+
+Table provides 1 trigger for automating workflows based on events.
+
+## Triggers
+
+### Table Trigger
+
+Triggers when rows are inserted or updated in a table
+
+#### Configuration
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `tableSelector` | table-selector | Yes | The table to monitor. |
+| `manualTableId` | string | Yes | The table to monitor. |
+| `eventType` | string | Yes | The type of event to trigger on. |
+| `watchColumns` | string | No | Only fire when these columns change. Leave empty to fire on any update. |
+| `includeHeaders` | boolean | No | When enabled, each row is returned as a key-value object mapped to column names. |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `row` | json | Row data mapped to column names \(when header mapping is enabled\) |
+| `rawRow` | json | Raw row data object |
+| `previousRow` | json | Previous row data before the update \(null for inserts\) |
+| `changedColumns` | json | List of column names that changed \(empty for inserts\) |
+| `rowId` | string | The unique row ID |
+| `headers` | json | Column names from the table schema |
+| `rowNumber` | number | The position of the row in the table |
+| `tableId` | string | The table ID |
+| `tableName` | string | The table name |
+| `timestamp` | string | Event timestamp in ISO format |
+

apps/realtime/src/handlers/index.ts

@@ -2,6 +2,7 @@ import { setupConnectionHandlers } from '@/handlers/connection'
 import { setupOperationsHandlers } from '@/handlers/operations'
 import { setupPresenceHandlers } from '@/handlers/presence'
 import { setupSubblocksHandlers } from '@/handlers/subblocks'
+import { setupTableHandlers } from '@/handlers/tables'
 import { setupVariablesHandlers } from '@/handlers/variables'
 import { setupWorkflowHandlers } from '@/handlers/workflow'
 import type { AuthenticatedSocket } from '@/middleware/auth'
@@ -13,5 +14,6 @@ export function setupAllHandlers(socket: AuthenticatedSocket, roomManager: IRoom
   setupSubblocksHandlers(socket, roomManager)
   setupVariablesHandlers(socket, roomManager)
   setupPresenceHandlers(socket, roomManager)
+  setupTableHandlers(socket, roomManager)
   setupConnectionHandlers(socket, roomManager)
 }

apps/realtime/src/handlers/operations.ts

@@ -10,6 +10,7 @@ import {
 } from '@sim/realtime-protocol/constants'
 import { WorkflowOperationSchema } from '@sim/realtime-protocol/schemas'
 import { generateId } from '@sim/utils/id'
+import { assertWorkflowMutable, WorkflowLockedError } from '@sim/workflow-authz'
 import { ZodError } from 'zod'
 import { persistWorkflowOperation } from '@/database/operations'
 import type { AuthenticatedSocket } from '@/middleware/auth'
@@ -139,6 +140,24 @@ export function setupOperationsHandlers(socket: AuthenticatedSocket, roomManager
         }
       }
 
+      try {
+        await assertWorkflowMutable(workflowId)
+      } catch (error) {
+        if (error instanceof WorkflowLockedError) {
+          emitOperationError(
+            {
+              type: 'WORKFLOW_LOCKED',
+              message: error.message,
+              operation,
+              target,
+            },
+            { error: error.message, retryable: false }
+          )
+          return
+        }
+        throw error
+      }
+
       // Broadcast first for position updates to minimize latency, then persist
       // For other operations, persist first for consistency
       if (isPositionUpdate) {

apps/realtime/src/handlers/subblocks.ts

@@ -2,6 +2,7 @@ import { db } from '@sim/db'
 import { workflow, workflowBlocks } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { SUBBLOCK_OPERATIONS } from '@sim/realtime-protocol/constants'
+import { assertWorkflowMutable, WorkflowLockedError } from '@sim/workflow-authz'
 import { and, eq } from 'drizzle-orm'
 import type { AuthenticatedSocket } from '@/middleware/auth'
 import { checkRolePermission } from '@/middleware/permissions'
@@ -151,6 +152,28 @@ export function setupSubblocksHandlers(socket: AuthenticatedSocket, roomManager:
         return
       }
 
+      try {
+        await assertWorkflowMutable(workflowId)
+      } catch (error) {
+        if (error instanceof WorkflowLockedError) {
+          socket.emit('operation-forbidden', {
+            type: 'WORKFLOW_LOCKED',
+            message: error.message,
+            operation: SUBBLOCK_OPERATIONS.UPDATE,
+            target: 'subblock',
+          })
+          if (operationId) {
+            socket.emit('operation-failed', {
+              operationId,
+              error: error.message,
+              retryable: false,
+            })
+          }
+          return
+        }
+        throw error
+      }
+
       // Update user activity
       await roomManager.updateUserActivity(workflowId, socket.id, { lastActivity: Date.now() })
 
@@ -231,6 +254,22 @@ async function flushSubblockUpdate(
       return
     }
 
+    try {
+      await assertWorkflowMutable(workflowId)
+    } catch (error) {
+      if (error instanceof WorkflowLockedError) {
+        pending.opToSocket.forEach((socketId, opId) => {
+          io.to(socketId).emit('operation-failed', {
+            operationId: opId,
+            error: error.message,
+            retryable: false,
+          })
+        })
+        return
+      }
+      throw error
+    }
+
     let updateSuccessful = false
     let blockLocked = false
     await db.transaction(async (tx) => {