Unified Platform

Architecture: What Talks to What

Browser Hub UI  ──► /hub/*      ──► Platform (RBAC + SQLite persistence)
curl /orders    ──► Workflows   ──► Platform Application (DAG Engine)
Prometheus      ──► GET /metrics──► Platform Metrics Collector

Running the Complete Platform

To run the platform server and visual Hub UI in local development:

# 1. Build workspace packages
pnpm --filter @vaakloom/engine build
pnpm --filter @vaakloom/platform build

# 2. Terminal 1: Start Platform with demo workflows & database
pnpm --filter @vaakloom/demo-ts start
# (Copy the generated Admin API key output in the console)

# 3. Terminal 2: Start Hub UI development server
VITE_API_KEY=<admin-key> pnpm --filter @vaakloom/hub dev

Platform API Authentication & RBAC

All administrative and control-plane endpoints under /hub/* require authentication via the x-api-key HTTP header:

curl -H "x-api-key: your-admin-key" http://localhost:8787/hub/apis

Platform Permissions Matrix

Endpoint	HTTP Method	Required Permission	Description
/hub/apis	GET	workflow:read	List all registered API endpoints & metadata
/hub/workflows	GET, POST, PUT, DELETE	workflow:create / edit / delete	Dynamic workflow CRUD operations
/hub/workflows/validate	POST	workflow:read	Statically validate a DAG workflow JSON specification
/hub/traces	GET	telemetry:read	Query execution trace logs and step latencies
/hub/tests/run	POST	workflow:test	Execute Snapline regression test runs
/hub/deploy/plan	POST	workflow:deploy	Generate zero-downtime deployment diff and bundle
/hub/rbac/users	GET, POST, PUT	rbac:manage	Manage users, roles, and API key tokens
/hub/metrics	GET	metrics:read	Retrieve Prometheus metrics summary

Securing Workflow Routes

By default, workflow routes (e.g. POST /orders) can be invoked publicly or behind your API gateway. To enforce authentication directly within VaakLoom Platform, pass protectInvoke: true:

const platform = new Platform({
  dbPath: "./data/vaakloom.db",
  protectInvoke: true, // Requires 'api:invoke' permission on API keys
});