@agimon-ai/po-workflow 0.0.0-alpha.119 → 0.0.0-alpha.120

package/dist/{RecoverWorkflowService-2WMhxaZd.cjs → RecoverWorkflowService-DP1ICYxa.cjs}

@@ -57,7 +57,11 @@ const StepArtifactsSchema = zod.z.array(WorkflowRelativePathSchema).min(1).refin
 * them (`${{ runConfig.<key> }}`, lists joined with commas) and hands the map to
 * a host executor, which owns and validates the keys it understands.
 */
-const RunConfigSchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.string(), zod.z.array(zod.z.string())])).describe("Host execution settings shared by customRun and command runners.");
+const RunConfigSchema = zod.z.record(zod.z.string(), zod.z.union([
+	zod.z.string(),
+	zod.z.array(zod.z.string()),
+	zod.z.null()
+])).describe("Host execution settings shared by customRun and command runners.");
 /** What only an in-process host executor needs, beside the shared `runConfig`. */
 const CustomRunEntrySchema = zod.z.object({
 	prompt: zod.z.string().min(1).describe("Prompt the host executor runs. Interpolated like a command."),
@@ -260,7 +264,9 @@ const AcceptanceCriterionSchema = zod.z.object({
 	artifacts: StepArtifactsSchema.optional()
 }).strict();
 const JobCompletionSchema = zod.z.object({ "max-continuations": zod.z.number().int().nonnegative().default(3) }).strict();
+const JobIdentitySchema = zod.z.object({ roles: zod.z.array(zod.z.string().trim().min(1)).min(1).refine((roles) => new Set(roles).size === roles.length, "Identity roles must be unique.").describe("Roles one member of the run team must hold; every step of the job runs as that member.") }).strict();
 const JobSchema = zod.z.object({
+	identity: JobIdentitySchema.optional(),
 	tools: WorkflowToolsPathSchema.optional(),
 	instructions: WorkflowInstructionsPathSchema.optional(),
 	runConfig: RunConfigSchema.optional(),
@@ -344,6 +350,7 @@ const WorkflowDefinitionSchema = zod.z.object({
 	instructions: WorkflowInstructionsPathSchema.optional(),
 	tags: zod.z.array(zod.z.string().trim().min(1)).optional().describe("Tags used to categorize and filter workflow definitions."),
 	workspace: zod.z.string().optional(),
+	team: zod.z.string().trim().min(1).optional().describe("Default team role-bound jobs resolve within; a launch may select another."),
 	runner: zod.z.string().optional().describe("Default runner key for step command maps when no CLI runner is provided."),
 	"default-runner": zod.z.string().optional().describe("Deprecated alias for runner."),
 	runners: zod.z.record(zod.z.string(), RunnerSchema).optional().describe("Named custom runners; selecting one lays its runConfig over every customRun step."),
@@ -370,8 +377,50 @@ const WorkflowDefinitionSchema = zod.z.object({
 	jobs: zod.z.record(zod.z.string(), JobSchema),
 	"child-jobs": zod.z.record(zod.z.string().min(1), JobSchema).optional()
 });
+/** Where a `runConfig` under this value sets a profile, as schema issue paths. */
+function profilePaths(value, path) {
+	if (Array.isArray(value)) return value.flatMap((item, index) => profilePaths(item, [...path, index]));
+	if (typeof value !== "object" || value === null) return [];
+	return Object.entries(value).flatMap(([key, child]) => key === "runConfig" && typeof child === "object" && child !== null && "profile" in child ? [[
+		...path,
+		key,
+		"profile"
+	]] : profilePaths(child, [...path, key]));
+}
 const WorkflowSchema = WorkflowDefinitionSchema.superRefine((workflow, context) => {
 	const declaredFiles = new Set((workflow["run-directory"]?.entries ?? []).filter((entry) => entry.kind === "file").map((entry) => entry.path));
+	const roleJobs = [...["jobs", "child-jobs"].flatMap((catalog) => Object.entries(workflow[catalog] ?? {}).map(([name, job]) => ({
+		job,
+		path: [catalog, name]
+	}))), ...workflow.repair ? [{
+		job: workflow.repair,
+		path: ["repair"]
+	}] : []].filter(({ job }) => job.identity !== void 0);
+	for (const { job, path } of roleJobs) {
+		const scope = {
+			runConfig: job.runConfig,
+			preJob: job.preJob,
+			steps: job.steps,
+			postJob: job.postJob
+		};
+		for (const issuePath of profilePaths(scope, path)) context.addIssue({
+			code: "custom",
+			message: "A job that declares identity.roles runs as its resolved member; remove this profile.",
+			path: issuePath
+		});
+	}
+	if (roleJobs.length > 0) {
+		const shared = {
+			runConfig: workflow.runConfig,
+			runners: workflow.runners,
+			commands: workflow.commands
+		};
+		for (const issuePath of profilePaths(shared, [])) context.addIssue({
+			code: "custom",
+			message: "A profile cannot apply across a workflow whose jobs declare identity.roles.",
+			path: issuePath
+		});
+	}
 	for (const catalog of ["jobs", "child-jobs"]) for (const [jobName, job] of Object.entries(workflow[catalog] ?? {})) for (const [stepIndex, step] of job.steps.entries()) {
 		const members = step.parallel ? step.parallel.map((child, childIndex) => ({
 			step: child,
@@ -622,6 +671,17 @@ const WorkflowAdmissionIntentSchema = zod.z.object({
 	requestHash: zod.z.string(),
 	rejected: zod.z.array(zod.z.string()).optional()
 });
+/** The member one role-bound job execution was admitted as; names and digests only, never secrets. */
+const JobIdentityBindingSchema = zod.z.object({
+	team: zod.z.string().min(1),
+	teamRevision: zod.z.string().min(1),
+	product: zod.z.string().min(1).optional(),
+	roles: zod.z.array(zod.z.string().min(1)).min(1),
+	ref: zod.z.string().min(1),
+	profile: zod.z.string().min(1),
+	contentDigest: zod.z.string().min(1),
+	policyDigest: zod.z.string().min(1)
+});
 const WorkflowRunRecordSchema = zod.z.object({
 	activeRepairId: zod.z.string().regex(/^\d+$/).optional(),
 	admission: WorkflowAdmissionMetadataSchema.optional(),
@@ -653,6 +713,8 @@ const WorkflowRunRecordSchema = zod.z.object({
 	command: zod.z.string().optional().describe("Command the launch selected for templated interactiveRun steps."),
 	choice: zod.z.string().optional().describe("Choice the launch selected for steps that do not pin one."),
 	profile: zod.z.string().optional().describe("Po profile name the launch selected as the default runConfig.profile; never its secrets."),
+	team: zod.z.string().min(1).optional().describe("Team pinned at launch; role-bound jobs resolve only within it."),
+	identities: zod.z.record(zod.z.string(), JobIdentityBindingSchema).optional().describe("Admitted member of each role-bound job execution, keyed job#matrixIndex."),
 	runId: zod.z.string().uuid().optional(),
 	resume: zod.z.object({
 		reason: zod.z.enum(["released", "host_shutdown"]),
@@ -1424,6 +1486,8 @@ var WorkflowRegistryService = class {
 				...input.command === void 0 ? {} : { command: input.command },
 				...input.choice === void 0 ? {} : { choice: input.choice },
 				...input.profile === void 0 ? {} : { profile: input.profile },
+				...input.team === void 0 ? {} : { team: input.team },
+				...input.identities === void 0 ? {} : { identities: input.identities },
 				runDirectory: input.runDirectory,
 				runId,
 				secretFile: input.secretFile,
@@ -1996,6 +2060,23 @@ var WorkflowRegistryService = class {
 		});
 	}
 	/**
+	* Keep the member a role-bound job execution was admitted as, before any of
+	* its steps runs. Fenced to this generation, so a stale process cannot write.
+	*/
+	async recordIdentity(handle, key, binding) {
+		await this.withRunLock(handle.recordPath, async () => {
+			const current = await this.readRunRecord(handle.recordPath);
+			if (current.stage !== RUNNING_STAGE || current.runId !== handle.runId) throw new Error(`Workflow run is no longer admitting jobs: ${handle.workspace}/${handle.runKey}`);
+			await this.writeRunRecord(handle.recordPath, {
+				...current,
+				identities: {
+					...current.identities,
+					[key]: binding
+				}
+			});
+		});
+	}
+	/**
 	* Read every stage directory a run key occupies, without validating run.json,
 	* so a run that listing skips as invalid can still be seen and repaired.
 	*/
@@ -2460,7 +2541,7 @@ const singleName = zod.z.string().trim().min(1);
 const poRunConfigSchema = zod.z.object({
 	majorMode: singleName.optional().describe("Major mode the step session runs in."),
 	minorModes: nameList.optional().describe("Minor modes activated in the step session."),
-	profile: singleName.optional().describe("Profile the step session runs as."),
+	profile: singleName.nullable().optional().describe("Profile the step session runs as; null runs it with no profile, never the workspace default."),
 	domains: nameList.optional().describe("Domains selected for the step session. An empty list selects none."),
 	model: singleName.optional().describe("Model selector, provider/id."),
 	thinking: singleName.optional().describe("Thinking level for the model."),
@@ -3310,7 +3391,7 @@ var WorkflowParserService = class {
 			if (parts[0] === "env" && parts[1]) return observed(context.env[parts[1]] || this.runtime.baseEnvironment[parts[1]] || (Object.hasOwn(context.env, parts[1]) ? "" : void 0));
 			if (parts[0] === "runConfig" && parts[1]) {
 				const value = context.runConfig?.[parts[1]];
-				return observed(Array.isArray(value) ? value.join(",") : value);
+				return observed(Array.isArray(value) ? value.join(",") : value ?? void 0);
 			}
 			if (parts[0] === "runner" && parts[1] === "os") return observed("macOS");
 			if (parts[0] === "github" && parts[1] === "sha") return observed(this.githubSha);
@@ -3366,6 +3447,43 @@ const STEP_PANE_REF_KIND = "pane";
 const WORKFLOW_RUNS_TYPE = "workflow_runs";
 const WORKFLOW_CATALOG_TYPE = "workflow_catalog";
 //#endregion
+//#region src/services/jobIdentity/index.ts
+/** Whether any job, child job or repair triage declares roles, which binds the workflow to a team. */
+function declaresRoles(workflow) {
+	return [
+		...Object.values(workflow.jobs),
+		...Object.values(workflow["child-jobs"] ?? {}),
+		workflow.repair
+	].some((job) => job?.identity !== void 0);
+}
+/**
+* Admits each job execution before its first step. The binding is kept in run
+* state under `job#matrixIndex`; a retry, resume or recovery that finds it
+* revalidates it and blocks when the team no longer assigns it the same member.
+*/
+function createJobIdentityAdmission(options) {
+	const { registry, run, team, teamBound, resolver, dryRun } = options;
+	return async ({ job, matrixIndex, roles }) => {
+		if (roles === void 0) return teamBound ? null : void 0;
+		if (resolver === void 0) throw new Error(`this host binds no identity provider for roles ${roles.join(", ")}.`);
+		if (team === void 0) throw new Error(`no team is selected for roles ${roles.join(", ")}; name one in the workflow or at launch.`);
+		if (dryRun) return void 0;
+		const key = `${job}#${matrixIndex}`;
+		const saved = (await registry.readRunRecord(run.recordPath)).identities?.[key];
+		const admitted = saved ? await resolver.revalidate(saved) : await resolver.resolve({
+			team,
+			roles
+		});
+		if (saved && admitted.ref !== saved.ref) throw new Error(`the member job "${job}" was admitted as no longer holds its roles in team "${team}".`);
+		if (admitted.team !== team || roles.some((role) => !admitted.roles.includes(role))) throw new Error(`the identity provider did not admit roles ${roles.join(", ")} within team "${team}".`);
+		await registry.recordIdentity(run, key, {
+			...admitted,
+			roles: [...admitted.roles]
+		});
+		return admitted.profile;
+	};
+}
+//#endregion
 //#region src/services/RunDirectoryService/index.ts
 /** Which job and step last wrote each declared entry, one change per line. */
 const RUN_DIRECTORY_WRITES_FILENAME = "writes.ndjson";
@@ -4154,15 +4272,26 @@ var JobRunnerService = class {
 					}
 					const baseline = writesRunDir ? await this.runDirectoryService.recordWrites(writesRunDir, declaredEntries) : void 0;
 					const writes = writesRunDir && baseline ? this.attemptWrites(writesRunDir, jobName, jobEnv, baseline, declaredEntries) : void 0;
+					let attemptOptions = options;
+					try {
+						const profile = await this.admitIdentity(jobName, job, matrixIndex, context.admitIdentity);
+						if (profile !== void 0) attemptOptions = {
+							...options,
+							profile
+						};
+					} catch (error) {
+						decidedFailure = `Job "${jobName}" was not admitted: ${error instanceof Error ? error.message : String(error)}`;
+						break;
+					}
 					const decisions = [];
 					let allStepsPassed = true;
-					if (preJobSteps.length > 0) allStepsPassed = await this.runStepSequence(preJobSteps, stepContext, options, matrixIndex, attempt, decisions, writes && {
+					if (preJobSteps.length > 0) allStepsPassed = await this.runStepSequence(preJobSteps, stepContext, attemptOptions, matrixIndex, attempt, decisions, writes && {
 						...writes,
 						outputs: []
 					});
-					if (allStepsPassed && decisions.length === 0) allStepsPassed = await this.runStepSequence(mainSteps, stepContext, options, matrixIndex, attempt, decisions, writes);
+					if (allStepsPassed && decisions.length === 0) allStepsPassed = await this.runStepSequence(mainSteps, stepContext, attemptOptions, matrixIndex, attempt, decisions, writes);
 					if (postJobSteps.length > 0) {
-						const postJobPassed = await this.runStepSequence(postJobSteps, stepContext, options, matrixIndex, attempt, decisions, writes && {
+						const postJobPassed = await this.runStepSequence(postJobSteps, stepContext, attemptOptions, matrixIndex, attempt, decisions, writes && {
 							...writes,
 							outputs: []
 						});
@@ -4232,6 +4361,19 @@ var JobRunnerService = class {
 			return true;
 		});
 	}
+	/** The profile this execution runs as, or undefined where no admission applies. */
+	async admitIdentity(jobName, job, matrixIndex, admit) {
+		const roles = job.identity?.roles;
+		if (admit === void 0) {
+			if (roles) throw new Error(`this host binds no identity provider for roles ${roles.join(", ")}.`);
+			return;
+		}
+		return await admit({
+			job: jobName,
+			matrixIndex,
+			roles
+		});
+	}
 	/**
 	* An attempt's outputs, taken from the records at its start, and the record
 	* each finished step adds. The step that ends the job is reminded only of
@@ -4916,7 +5058,10 @@ var StepRunnerService = class StepRunnerService {
 		stepEnv[WORKFLOW_STEP_DISPLAY_ENV_KEY] = this.formatStepDisplay(stepEnv[WORKFLOW_JOB_NAME_ENV_KEY], stepName);
 		const stepRunConfig = resolvedStepCommand?.runConfig ?? step.runConfig;
 		const launchProfile = this.commandSelection.profile;
-		const runConfig = launchProfile === void 0 || stepRunConfig?.[RUN_CONFIG_PROFILE_KEY] !== void 0 ? stepRunConfig : {
+		const runConfig = options.profile !== void 0 ? {
+			...stepRunConfig,
+			[RUN_CONFIG_PROFILE_KEY]: options.profile
+		} : launchProfile === void 0 || stepRunConfig?.[RUN_CONFIG_PROFILE_KEY] !== void 0 ? stepRunConfig : {
 			...stepRunConfig,
 			[RUN_CONFIG_PROFILE_KEY]: launchProfile
 		};
@@ -7553,6 +7698,22 @@ function createStepExecutor(dependencies) {
 				"WORKFLOW_NAME"
 			].flatMap((key) => child.context.jobEnvironment[key] === void 0 ? [] : [[key, child.context.jobEnvironment[key]]]));
 			env.WORKFLOW_PHASE = "job";
+			const registry = new WorkflowRegistryService(runtime);
+			const recordPath = env.WORKFLOW_RUN_DIR === void 0 ? void 0 : (0, node_path.join)(env.WORKFLOW_RUN_DIR, "run.json");
+			const record = recordPath !== void 0 && await (0, _agimon_ai_po_core_platform.pathExists)(runtime.fs, recordPath, runtime.ioContext) ? await registry.readRunRecord(recordPath) : void 0;
+			const admitIdentity = recordPath !== void 0 && record !== void 0 && record.runId === env.WORKFLOW_RUN_ID ? createJobIdentityAdmission({
+				registry,
+				run: {
+					recordPath,
+					runId: env.WORKFLOW_RUN_ID,
+					workspace: record.workspace,
+					runKey: record.runKey
+				},
+				team: record.team,
+				teamBound: record.team !== void 0 || declaresRoles(workflow),
+				resolver: dependencies.resolveIdentity,
+				dryRun: false
+			}) : void 0;
 			const success = await jobs.runJob(`${child.job}:${child.invocationId}`, child.definition, {
 				inputs: new Map(Object.entries(child.inputs).map(([key, value]) => [key, String(value)])),
 				secrets: /* @__PURE__ */ new Map(),
@@ -7561,6 +7722,7 @@ function createStepExecutor(dependencies) {
 				jobOrder: [child.job],
 				allJobs: { [child.job]: child.definition },
 				managedChild: true,
+				admitIdentity,
 				onFailed: (reason) => {
 					failure = reason;
 				}
@@ -11632,6 +11794,7 @@ var RunWorkflowService = class {
 	registry;
 	repairService;
 	runDirectoryService;
+	resolveIdentity;
 	outputLines = [];
 	interruptedSignal = null;
 	launchStdio;
@@ -11679,6 +11842,7 @@ var RunWorkflowService = class {
 		this.jobRunner = dependencies.jobRunner ?? new JobRunnerService(this.runtime, this.parser, this.stepRunner, this.logger, this.runDirectoryService);
 		this.triggerService = dependencies.triggerService ?? new TriggerService(this.runtime, this.stepRunner, this.logger);
 		this.repairService = dependencies.repairService ?? new WorkflowRepairService(this.runtime);
+		this.resolveIdentity = dependencies.resolveIdentity;
 	}
 	/**
 	* Run the workflow from trigger preparation through cleanup.
@@ -11887,6 +12051,10 @@ var RunWorkflowService = class {
 		const runner = this.resolveRunner(input, parsedWorkflow);
 		let workflow = this.parser.selectRunner(parsedWorkflow, runner);
 		this.useCommandSelection(workflow, input);
+		const team = input.team ?? workflow.team;
+		const teamBound = team !== void 0 || declaresRoles(workflow);
+		if (teamBound && input.profile !== void 0) throw new Error("A launch profile cannot apply to a team-bound workflow: role jobs run as their resolved members, others with no profile.");
+		const noProfile = teamBound ? { profile: null } : {};
 		let registryRun = null;
 		const configuration = () => ({
 			workflow: structuredClone(workflow),
@@ -12015,6 +12183,8 @@ var RunWorkflowService = class {
 				command: input.command,
 				choice: input.choice,
 				profile: input.profile,
+				team,
+				identities: input.recovery?.identities,
 				runDirectory: workflow["run-directory"],
 				secretFile: input.secretFile,
 				skipLaunch: input.skipLaunch,
@@ -12102,7 +12272,8 @@ var RunWorkflowService = class {
 				stopRequestPath: registryRun.stopRequestPath,
 				workflowDir,
 				onStepStarted,
-				onExecutionStateChange
+				onExecutionStateChange,
+				...noProfile
 			}, input.prompt || null)) {
 				if (this.isInterrupted()) {
 					result = this.createInterruptedResult();
@@ -12128,7 +12299,8 @@ var RunWorkflowService = class {
 					stopRequestPath: preStopRequestPath,
 					workflowDir,
 					onStepStarted,
-					onExecutionStateChange
+					onExecutionStateChange,
+					...noProfile
 				}))) {
 					if (this.isInterrupted()) result = this.createInterruptedResult();
 					else {
@@ -12140,6 +12312,14 @@ var RunWorkflowService = class {
 					}
 				}
 			}
+			const admitIdentity = createJobIdentityAdmission({
+				registry: this.registry,
+				run: registryRun,
+				team,
+				teamBound,
+				resolver: this.resolveIdentity,
+				dryRun
+			});
 			const maxRetries = parsePositiveIntegerEnv(workflowEnv.MAX_RETRIES, DEFAULT_MAX_RETRIES);
 			const maxFixCycles = parsePositiveIntegerEnv(workflowEnv.FIX_LOOP_MAX_CYCLES, DEFAULT_MAX_FIX_CYCLES);
 			const fixLoopDisabled = envFlagEnabled(workflowEnv[WORKFLOW_FIX_LOOP_DISABLED_ENV]);
@@ -12195,6 +12375,7 @@ var RunWorkflowService = class {
 							[REPAIR_TRIAGE_JOB_NAME$1]: repair
 						},
 						repairTriage: true,
+						admitIdentity,
 						activeRepairIssue: repairIssueContent,
 						runDirectory: workflow["run-directory"]
 					}, {
@@ -12300,6 +12481,7 @@ var RunWorkflowService = class {
 						maxCycles: maxFixCycles
 					},
 					runDirectory: workflow["run-directory"],
+					admitIdentity,
 					onPromptAssembled: dryRun ? (assembly) => {
 						dryRunPromptAssemblies.push(assembly);
 					} : void 0
@@ -12521,7 +12703,8 @@ var RunWorkflowService = class {
 						dryRun,
 						continueOnError,
 						progress,
-						workflowDir
+						workflowDir,
+						...noProfile
 					}))) {
 						this.logger.error(`\n${RED}${BOLD}${WORKFLOW_POST_FAILED_TEXT}${RESET}`);
 						if (!result || result.exitCode === 0 || result.exitCode === WORKFLOW_SKIPPED_EXIT_CODE) result = {
@@ -13255,6 +13438,7 @@ var RecoverWorkflowService = class {
 			command: record.command,
 			choice: record.choice,
 			profile: record.profile,
+			team: record.team,
 			workflowPath: record.workflowPath,
 			job: recoveredJob,
 			inputs: record.inputs,
@@ -13274,7 +13458,8 @@ var RecoverWorkflowService = class {
 				claimId: recoveryClaimId,
 				originalJob,
 				runKey: record.runKey,
-				startJob: recoveredJob
+				startJob: recoveredJob,
+				identities: record.identities
 			}
 		};
 	}
@@ -13592,4 +13777,4 @@ Object.defineProperty(exports, "workflowShellOutput", {
 	}
 });
 
-//# sourceMappingURL=RecoverWorkflowService-2WMhxaZd.cjs.map
+//# sourceMappingURL=RecoverWorkflowService-DP1ICYxa.cjs.map