@cynodia/axiom-core 0.13.1-alpha.1 → 0.14.0-alpha.2

package/dist/diagnostics.d.ts

@@ -156,6 +156,36 @@ export declare const VALIDATION_CODES: {
     readonly invalidQueryOperation: "INVALID_QUERY_OPERATION";
     /** A `provider-record` location whose entity does not resolve, or whose identity field is not that entity's identity. */
     readonly invalidProviderRecordLocation: "INVALID_PROVIDER_RECORD_LOCATION";
+    /** `WorkflowDef.entry` does not name a step of that workflow. */
+    readonly workflowEntryNotFound: "WORKFLOW_ENTRY_NOT_FOUND";
+    /** A control-flow edge (`next`/`onError`/`then`/`else`/`onTimeout`) names a step that does not exist. */
+    readonly workflowStepNotFound: "WORKFLOW_STEP_NOT_FOUND";
+    /** Two steps in one workflow share an id, or a step id collides with a graph node id. */
+    readonly workflowDuplicateStepId: "WORKFLOW_DUPLICATE_STEP_ID";
+    /** A step whose `type` is outside `WORKFLOW_STEP_TYPES`, or whose shape is invalid for its type. */
+    readonly workflowInvalidStep: "WORKFLOW_INVALID_STEP";
+    /** The workflow control-flow graph contains a cycle (retries are runtime policy, not a cycle). */
+    readonly workflowCycleNotAllowed: "WORKFLOW_CYCLE_NOT_ALLOWED";
+    /** An `action` step references an `action` that does not exist. */
+    readonly workflowActionNotFound: "WORKFLOW_ACTION_NOT_FOUND";
+    /** A `wait-event` step references an `event` that does not exist. */
+    readonly workflowEventNotFound: "WORKFLOW_EVENT_NOT_FOUND";
+    /** A `bind` / expression names a `WorkflowBinding` the workflow does not declare, or reads one before its producer. */
+    readonly workflowBindingNotFound: "WORKFLOW_BINDING_NOT_FOUND";
+    /** Two steps declare themselves the producer of the same binding, or a `bind` assigns a binding twice. */
+    readonly workflowDuplicateBinding: "WORKFLOW_DUPLICATE_BINDING";
+    /** A `WorkflowRetryPolicy` with a non-positive `maxAttempts`/`initialDelaySeconds`, a `backoffMultiplier` < 1, or `maxDelaySeconds` < `initialDelaySeconds`. */
+    readonly workflowInvalidRetryPolicy: "WORKFLOW_INVALID_RETRY_POLICY";
+    /** A `timer` step with neither `after` nor `at`, both, or a non-positive `after.seconds`. */
+    readonly workflowInvalidTimer: "WORKFLOW_INVALID_TIMER";
+    /** A step unreachable from `entry` (spec14 §122 — an authoring mistake, not a warning). */
+    readonly workflowUnreachableStep: "WORKFLOW_UNREACHABLE_STEP";
+    /** A control-flow path that can neither reach `complete`/`fail` nor end in an intentional durable wait (spec14 §123). */
+    readonly workflowNoTerminal: "WORKFLOW_NO_TERMINAL";
+    /** A workflow expression references an id outside the workflow expression scope (inputs / bindings / EVENT / PRINCIPAL). */
+    readonly workflowExpressionScope: "WORKFLOW_EXPRESSION_SCOPE";
+    /** A workflow expression reads a nondeterministic builtin (`now`/`uuid`/`random`) outside captured-time semantics. */
+    readonly workflowNondeterministic: "WORKFLOW_NONDETERMINISTIC";
     /** A `MigrationDef` whose `fromSchema`/`toSchema` are not consecutive positive integers, or a migration whose `fromSchema` is at or beyond `graph.schemaVersion`. */
     readonly invalidMigrationVersion: "INVALID_MIGRATION_VERSION";
     /** No contiguous `MigrationDef` chain connects schema 1 to `graph.schemaVersion` — a step is missing (spec11 §13). */

package/dist/diagnostics.js

@@ -148,6 +148,38 @@ export const VALIDATION_CODES = {
     invalidQueryOperation: 'INVALID_QUERY_OPERATION',
     /** A `provider-record` location whose entity does not resolve, or whose identity field is not that entity's identity. */
     invalidProviderRecordLocation: 'INVALID_PROVIDER_RECORD_LOCATION',
+    // Durable workflows (0.14, spec14 §124). `validateGraph` rejects an internally
+    // inconsistent `WorkflowDef` before it can be compiled or executed.
+    /** `WorkflowDef.entry` does not name a step of that workflow. */
+    workflowEntryNotFound: 'WORKFLOW_ENTRY_NOT_FOUND',
+    /** A control-flow edge (`next`/`onError`/`then`/`else`/`onTimeout`) names a step that does not exist. */
+    workflowStepNotFound: 'WORKFLOW_STEP_NOT_FOUND',
+    /** Two steps in one workflow share an id, or a step id collides with a graph node id. */
+    workflowDuplicateStepId: 'WORKFLOW_DUPLICATE_STEP_ID',
+    /** A step whose `type` is outside `WORKFLOW_STEP_TYPES`, or whose shape is invalid for its type. */
+    workflowInvalidStep: 'WORKFLOW_INVALID_STEP',
+    /** The workflow control-flow graph contains a cycle (retries are runtime policy, not a cycle). */
+    workflowCycleNotAllowed: 'WORKFLOW_CYCLE_NOT_ALLOWED',
+    /** An `action` step references an `action` that does not exist. */
+    workflowActionNotFound: 'WORKFLOW_ACTION_NOT_FOUND',
+    /** A `wait-event` step references an `event` that does not exist. */
+    workflowEventNotFound: 'WORKFLOW_EVENT_NOT_FOUND',
+    /** A `bind` / expression names a `WorkflowBinding` the workflow does not declare, or reads one before its producer. */
+    workflowBindingNotFound: 'WORKFLOW_BINDING_NOT_FOUND',
+    /** Two steps declare themselves the producer of the same binding, or a `bind` assigns a binding twice. */
+    workflowDuplicateBinding: 'WORKFLOW_DUPLICATE_BINDING',
+    /** A `WorkflowRetryPolicy` with a non-positive `maxAttempts`/`initialDelaySeconds`, a `backoffMultiplier` < 1, or `maxDelaySeconds` < `initialDelaySeconds`. */
+    workflowInvalidRetryPolicy: 'WORKFLOW_INVALID_RETRY_POLICY',
+    /** A `timer` step with neither `after` nor `at`, both, or a non-positive `after.seconds`. */
+    workflowInvalidTimer: 'WORKFLOW_INVALID_TIMER',
+    /** A step unreachable from `entry` (spec14 §122 — an authoring mistake, not a warning). */
+    workflowUnreachableStep: 'WORKFLOW_UNREACHABLE_STEP',
+    /** A control-flow path that can neither reach `complete`/`fail` nor end in an intentional durable wait (spec14 §123). */
+    workflowNoTerminal: 'WORKFLOW_NO_TERMINAL',
+    /** A workflow expression references an id outside the workflow expression scope (inputs / bindings / EVENT / PRINCIPAL). */
+    workflowExpressionScope: 'WORKFLOW_EXPRESSION_SCOPE',
+    /** A workflow expression reads a nondeterministic builtin (`now`/`uuid`/`random`) outside captured-time semantics. */
+    workflowNondeterministic: 'WORKFLOW_NONDETERMINISTIC',
     // Schema evolution & semantic migrations (0.11). `validateGraph` rejects an internally
     // inconsistent migration declaration before any persisted data is touched (spec11 §77, §78).
     /** A `MigrationDef` whose `fromSchema`/`toSchema` are not consecutive positive integers, or a migration whose `fromSchema` is at or beyond `graph.schemaVersion`. */

package/dist/graph.js

@@ -23,7 +23,7 @@ export class ApplicationGraph {
     /** Bumped by every change, so the derived edge index can never serve stale data. */
     revision = 0;
     semanticIndex;
-    constructor(id, name, version = '0.13.1') {
+    constructor(id, name, version = '0.14.0') {
         this.data = { id, name, version, nodes: {}, edges: {} };
     }
     get id() {

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export * from './subscriptions.js';
 export * from './storage.js';
 export * from './query.js';
 export * from './live-query.js';
+export * from './workflows.js';
 export * from './relationships.js';
 export * from './read-policy.js';
 export * from './migration.js';

package/dist/index.js

@@ -15,6 +15,7 @@ export * from './subscriptions.js';
 export * from './storage.js';
 export * from './query.js';
 export * from './live-query.js';
+export * from './workflows.js';
 export * from './relationships.js';
 export * from './read-policy.js';
 export * from './migration.js';

package/dist/semantic-identity.d.ts

@@ -33,6 +33,14 @@ import type { ApplicationGraph } from './graph.js';
  * - `StorageDef` — `readAuthorization` / `uploadAuthorization` expressions, `retry`.
  * - `RelationshipDef` — endpoints and cardinality (also in the schema fingerprint; repeated
  *   here so a semantic-only comparison is self-contained).
+ * - `WorkflowDef` — `inputs`, `bindings`, `entry`, and every step's kind, control-flow edges
+ *   and step-specific executable semantics (the `ActionDef` / `EventDef` a step targets, an
+ *   `action` step's argument expressions / `retry` policy, a `wait-event` step's correlation
+ *   `where` / `bind` / `timeout`, a `timer` step's `after` / `at`, a `branch` step's `when`
+ *   and edges, `complete` / `fail` output/error expressions). A workflow's referenced
+ *   `ActionDef` / `EventDef` bodies are covered transitively — they are their own executable
+ *   nodes in this same projection (spec14pt3 §5, §7, §30-§33). Presentation-only fields
+ *   (`name` / `description` / `label`) are stripped exactly as elsewhere.
  * - `graph.schemaVersion`.
  *
  * ### Exclusions (what does NOT change it)
@@ -49,6 +57,16 @@ import type { ApplicationGraph } from './graph.js';
  */
 /** The projection algorithm's own version, mixed into the hash (spec12 §46). */
 export declare const SEMANTIC_FINGERPRINT_VERSION = 1;
+/**
+ * Every graph node kind that carries executable meaning — the single source of truth for
+ * "which graph changes alter executable semantic meaning" (spec14pt3 §5 G1). Both the
+ * graph-level {@link semanticFingerprint} and the ServerIR-side authority-compatibility
+ * fingerprint MUST derive from this same list; a `packages/server` test pins that they do,
+ * so a future primitive cannot be added to one and silently omitted from the other
+ * (spec14pt3 §189, §190 — the deeper architectural correction behind Phase 22 F3).
+ */
+export declare const EXECUTABLE_KINDS: readonly ["action", "integration", "integration-operation", "trigger", "event", "subscription", "read-policy", "query", "expression", "constraint", "transition-constraint", "storage", "relationship", "workflow"];
+export type ExecutableKind = (typeof EXECUTABLE_KINDS)[number];
 export interface SemanticProjection {
     fingerprintVersion: number;
     schemaVersion: number;

package/dist/semantic-identity.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { canonicalJSON } from './schema-identity.js';
 import { AUTHORING_METADATA_KEY } from './authoring-metadata.js';
+import { canonicalWorkflowForFingerprint } from './workflows.js';
 /**
  * Application **semantic** identity (spec12 §45, §46).
  *
@@ -35,6 +36,14 @@ import { AUTHORING_METADATA_KEY } from './authoring-metadata.js';
  * - `StorageDef` — `readAuthorization` / `uploadAuthorization` expressions, `retry`.
  * - `RelationshipDef` — endpoints and cardinality (also in the schema fingerprint; repeated
  *   here so a semantic-only comparison is self-contained).
+ * - `WorkflowDef` — `inputs`, `bindings`, `entry`, and every step's kind, control-flow edges
+ *   and step-specific executable semantics (the `ActionDef` / `EventDef` a step targets, an
+ *   `action` step's argument expressions / `retry` policy, a `wait-event` step's correlation
+ *   `where` / `bind` / `timeout`, a `timer` step's `after` / `at`, a `branch` step's `when`
+ *   and edges, `complete` / `fail` output/error expressions). A workflow's referenced
+ *   `ActionDef` / `EventDef` bodies are covered transitively — they are their own executable
+ *   nodes in this same projection (spec14pt3 §5, §7, §30-§33). Presentation-only fields
+ *   (`name` / `description` / `label`) are stripped exactly as elsewhere.
  * - `graph.schemaVersion`.
  *
  * ### Exclusions (what does NOT change it)
@@ -51,7 +60,15 @@ import { AUTHORING_METADATA_KEY } from './authoring-metadata.js';
  */
 /** The projection algorithm's own version, mixed into the hash (spec12 §46). */
 export const SEMANTIC_FINGERPRINT_VERSION = 1;
-const EXECUTABLE_KINDS = [
+/**
+ * Every graph node kind that carries executable meaning — the single source of truth for
+ * "which graph changes alter executable semantic meaning" (spec14pt3 §5 G1). Both the
+ * graph-level {@link semanticFingerprint} and the ServerIR-side authority-compatibility
+ * fingerprint MUST derive from this same list; a `packages/server` test pins that they do,
+ * so a future primitive cannot be added to one and silently omitted from the other
+ * (spec14pt3 §189, §190 — the deeper architectural correction behind Phase 22 F3).
+ */
+export const EXECUTABLE_KINDS = [
     'action',
     'integration',
     'integration-operation',
@@ -65,6 +82,7 @@ const EXECUTABLE_KINDS = [
     'transition-constraint',
     'storage',
     'relationship',
+    'workflow',
 ];
 /** Keys removed everywhere in the tree — human metadata, never executable meaning. */
 const NON_SEMANTIC_KEYS = new Set(['name', 'description', 'label', 'metadata', AUTHORING_METADATA_KEY]);
@@ -95,7 +113,7 @@ export function semanticProjection(graph) {
         if (group.length === 0) {
             continue;
         }
-        nodes[kind] = byId(group).map((node) => stripNonSemantic(node));
+        nodes[kind] = byId(group).map((node) => stripNonSemantic(kind === 'workflow' ? canonicalWorkflowForFingerprint(node) : node));
     }
     return {
         fingerprintVersion: SEMANTIC_FINGERPRINT_VERSION,

package/dist/server-ir.d.ts

@@ -11,6 +11,7 @@ import type { QueryDef } from './query.js';
 import type { RelationshipDef } from './relationships.js';
 import type { ReadPolicyDef } from './read-policy.js';
 import type { MigrationDef } from './migration.js';
+import type { WorkflowDef } from './workflows.js';
 /**
  * The contracts a Server IR may declare. A runtime that does not recognize the value MUST
  * refuse the IR rather than interpret it partially.
@@ -26,7 +27,7 @@ import type { MigrationDef } from './migration.js';
  * Every existing application therefore still compiles to a byte-identical
  * `axiom.server.v1` document, and the frozen conformance fixtures stay frozen.
  */
-export declare const SERVER_IR_CONTRACTS: readonly ["axiom.server.v1", "axiom.server.v2", "axiom.server.v3", "axiom.server.v4", "axiom.server.v5", "axiom.server.v6", "axiom.server.v7"];
+export declare const SERVER_IR_CONTRACTS: readonly ["axiom.server.v1", "axiom.server.v2", "axiom.server.v3", "axiom.server.v4", "axiom.server.v5", "axiom.server.v6", "axiom.server.v7", "axiom.server.v8"];
 export type ServerIRContract = (typeof SERVER_IR_CONTRACTS)[number];
 /** The oldest contract, and the one a document declares unless it needs more. */
 export declare const SERVER_IR_CONTRACT: ServerIRContract;
@@ -108,8 +109,18 @@ export declare function usesExternalIOVocabulary(ir: {
  */
 export declare function usesMigrationVocabulary(ir: {
     migrations?: readonly unknown[];
+    workflows?: readonly unknown[];
     schemaVersion?: number;
 }): boolean;
+/**
+ * Whether a document carries 0.14 durable-workflow vocabulary. A pre-v8 runtime has no
+ * `WorkflowDef` execution model at all, so any `WorkflowDef` present requires
+ * `axiom.server.v8` — computed from the document, never asserted by hand, so a graph that
+ * declares no workflow compiles to the byte-identical v1–v7 document it always did.
+ */
+export declare function usesWorkflowVocabulary(ir: {
+    workflows?: readonly unknown[];
+}): boolean;
 /**
  * Whether a document uses 0.10's semantic data-access vocabulary — a `QueryDef`, a
  * `RelationshipDef`, a `ReadPolicyDef`, or a `query` operation inside an action. A v5
@@ -139,6 +150,7 @@ export declare function serverIRExpressions(ir: {
     queries?: readonly QueryDef[];
     readPolicies?: readonly ReadPolicyDef[];
     migrations?: readonly MigrationDef[];
+    workflows?: readonly WorkflowDef[];
 }): Expression[];
 /**
  * The normalized form an authority executes: everything required to decide a mutation, and
@@ -237,5 +249,7 @@ export interface ServerIR {
      * `Expression` transform leaves, never SQL, a callback or a provider handle (spec11 §88).
      */
     migrations?: MigrationDef[];
+    /** Durable workflow definitions (spec14, `axiom.server.v8`). */
+    workflows?: WorkflowDef[];
 }
 //# sourceMappingURL=server-ir.d.ts.map

package/dist/server-ir.js

@@ -1,6 +1,7 @@
 import { walkExpression } from './expressions.js';
 import { queryExpressions } from './query.js';
 import { migrationExpressions } from './migration.js';
+import { workflowExpressions } from './workflows.js';
 /**
  * The contracts a Server IR may declare. A runtime that does not recognize the value MUST
  * refuse the IR rather than interpret it partially.
@@ -24,11 +25,12 @@ export const SERVER_IR_CONTRACTS = [
     'axiom.server.v5',
     'axiom.server.v6',
     'axiom.server.v7',
+    'axiom.server.v8',
 ];
 /** The oldest contract, and the one a document declares unless it needs more. */
 export const SERVER_IR_CONTRACT = 'axiom.server.v1';
 /** The newest contract this implementation produces and executes. */
-export const SERVER_IR_LATEST_CONTRACT = 'axiom.server.v7';
+export const SERVER_IR_LATEST_CONTRACT = 'axiom.server.v8';
 /** Operation kinds no contract before `axiom.server.v5` contains. */
 export const SERVER_IR_V5_OPERATION_KINDS = [
     'blob-metadata',
@@ -133,6 +135,15 @@ export function usesExternalIOVocabulary(ir) {
 export function usesMigrationVocabulary(ir) {
     return (ir.migrations?.length ?? 0) > 0 || (ir.schemaVersion ?? 1) > 1;
 }
+/**
+ * Whether a document carries 0.14 durable-workflow vocabulary. A pre-v8 runtime has no
+ * `WorkflowDef` execution model at all, so any `WorkflowDef` present requires
+ * `axiom.server.v8` — computed from the document, never asserted by hand, so a graph that
+ * declares no workflow compiles to the byte-identical v1–v7 document it always did.
+ */
+export function usesWorkflowVocabulary(ir) {
+    return (ir.workflows?.length ?? 0) > 0;
+}
 /**
  * Whether a document uses 0.10's semantic data-access vocabulary — a `QueryDef`, a
  * `RelationshipDef`, a `ReadPolicyDef`, or a `query` operation inside an action. A v5
@@ -200,6 +211,9 @@ export function serverIRExpressions(ir) {
     for (const migration of ir.migrations ?? []) {
         found.push(...migrationExpressions(migration));
     }
+    for (const workflow of ir.workflows ?? []) {
+        found.push(...workflowExpressions(workflow));
+    }
     return found;
 }
 function actionExpressions(action) {

package/dist/types.d.ts

@@ -11,11 +11,12 @@ import type { QueryDef } from './query.js';
 import type { RelationshipDef } from './relationships.js';
 import type { ReadPolicyDef } from './read-policy.js';
 import type { MigrationDef } from './migration.js';
-export type SemanticNodeKind = 'entity' | 'state' | 'action' | 'constraint' | 'transition-constraint' | 'route' | 'expression' | 'integration' | 'integration-operation' | 'event' | 'trigger' | 'subscription' | 'storage' | 'query' | 'relationship' | 'read-policy' | 'migration';
+import type { WorkflowDef } from './workflows.js';
+export type SemanticNodeKind = 'entity' | 'state' | 'action' | 'constraint' | 'transition-constraint' | 'route' | 'expression' | 'integration' | 'integration-operation' | 'event' | 'trigger' | 'subscription' | 'storage' | 'query' | 'relationship' | 'read-policy' | 'migration' | 'workflow';
 /** Every semantic node kind, enumerated so tests can walk them. */
 export declare const SEMANTIC_NODE_KINDS: readonly SemanticNodeKind[];
 export type NodeKind = SemanticNodeKind | UINodeKind;
-export type AnyNode = EntityDef | StateDef | ActionDef | ConstraintDef | TransitionConstraintDef | RouteDef | ExpressionDef | IntegrationDef | IntegrationOperationDef | EventDef | TriggerDef | SubscriptionDef | StorageDef | QueryDef | RelationshipDef | ReadPolicyDef | MigrationDef | UINode;
+export type AnyNode = EntityDef | StateDef | ActionDef | ConstraintDef | TransitionConstraintDef | RouteDef | ExpressionDef | IntegrationDef | IntegrationOperationDef | EventDef | TriggerDef | SubscriptionDef | StorageDef | QueryDef | RelationshipDef | ReadPolicyDef | MigrationDef | WorkflowDef | UINode;
 export type NodeOfKind<K extends NodeKind> = Extract<AnyNode, {
     kind: K;
 }>;

package/dist/types.js

@@ -17,4 +17,5 @@ export const SEMANTIC_NODE_KINDS = [
     'relationship',
     'read-policy',
     'migration',
+    'workflow',
 ];

package/dist/validate.js

@@ -5,6 +5,7 @@ import { SUBSCRIPTION_BACKPRESSURE_POLICIES, subscriptionBackpressure, subscript
 import { BLOB_REF_FIELDS } from './storage.js';
 import { queryPaginationStrategy, sortKeyDirection } from './query.js';
 import { queryStateReferences } from './live-query.js';
+import { WORKFLOW_EVENT_SCOPE, WORKFLOW_PRINCIPAL_SCOPE, WORKFLOW_STEP_TYPES, workflowHasCycle, workflowReachableSteps, workflowStepById, workflowStepExpressions, workflowStepSuccessors, } from './workflows.js';
 import { relationshipIsToOne } from './relationships.js';
 import { validateMigrations } from './validate-migration.js';
 import { collectionType, entityType } from './type-ref.js';
@@ -172,6 +173,9 @@ function validateNode(node, context) {
         case 'read-policy':
             validateReadPolicy(node, context);
             return;
+        case 'workflow':
+            validateWorkflow(node, context);
+            return;
         case 'migration':
             // A `MigrationDef` is validated by the graph-level `validateMigrations` pass, which
             // needs every migration and `graph.schemaVersion` at once — chain contiguity and
@@ -894,6 +898,253 @@ function policyRowScope(rowScopeId, entityId, ownerId, context, entity) {
  * endpoints consistent with the declared cardinality. Axiom never *infers* a link, so this
  * is where an inconsistent explicit one is caught.
  */
+/**
+ * A `WorkflowDef`'s structural soundness (spec14 §121-§125). Every failure is a structured
+ * diagnostic — never a thrown `TypeError` on a malformed step.
+ */
+function validateWorkflow(workflow, context) {
+    const steps = Array.isArray(workflow.steps) ? workflow.steps : [];
+    const stepIds = new Set();
+    for (const step of steps) {
+        if (!step || typeof step !== 'object' || typeof step.id !== 'string') {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowInvalidStep,
+                message: `Workflow ${workflow.id} has a step with no id`,
+                nodeId: workflow.id,
+            });
+            continue;
+        }
+        const id = String(step.id);
+        if (stepIds.has(id) || context.nodes.has(step.id)) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowDuplicateStepId,
+                message: `Workflow ${workflow.id} step id ${id} is declared twice, or collides with a graph node`,
+                nodeId: workflow.id,
+            });
+        }
+        stepIds.add(id);
+        if (!WORKFLOW_STEP_TYPES.includes(step.type)) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowInvalidStep,
+                message: `Workflow ${workflow.id} step ${id} has an unknown type ${String(step.type)}`,
+                nodeId: workflow.id,
+            });
+        }
+    }
+    if (!workflow.entry || !stepIds.has(String(workflow.entry))) {
+        context.errors.push({
+            code: VALIDATION_CODES.workflowEntryNotFound,
+            message: `Workflow ${workflow.id} entry ${String(workflow.entry)} is not one of its steps`,
+            nodeId: workflow.id,
+        });
+    }
+    const edge = (target, from) => {
+        if (target !== undefined && !stepIds.has(String(target))) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowStepNotFound,
+                message: `Workflow ${workflow.id} step ${from} points at ${String(target)}, which is not a step`,
+                nodeId: workflow.id,
+            });
+        }
+    };
+    // Bindings: declared once, produced by exactly one declared step.
+    const declaredBindings = new Map();
+    for (const binding of workflow.bindings ?? []) {
+        const bid = String(binding.id);
+        if (declaredBindings.has(bid)) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowDuplicateBinding,
+                message: `Workflow ${workflow.id} declares binding ${bid} twice`,
+                nodeId: workflow.id,
+            });
+        }
+        declaredBindings.set(bid, binding);
+        if (!stepIds.has(String(binding.producedBy))) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowStepNotFound,
+                message: `Workflow ${workflow.id} binding ${bid} is producedBy ${String(binding.producedBy)}, which is not a step`,
+                nodeId: workflow.id,
+            });
+        }
+        validateTypeRef(binding.valueType, workflow.id, context);
+    }
+    const inputIds = new Set((workflow.inputs ?? []).map((input) => String(input.id)));
+    for (const input of workflow.inputs ?? [])
+        validateTypeRef(input.valueType, workflow.id, context);
+    const boundBy = new Map(); // bindingId -> step id that binds it
+    for (const step of steps) {
+        if (!step || typeof step.id !== 'string')
+            continue;
+        const from = String(step.id);
+        const eventScopeOk = step.type === 'wait-event';
+        // Control-flow edges resolve.
+        if (step.type === 'action') {
+            edge(step.next, from);
+            edge(step.onError, from);
+            requireKind(step.action, 'action', workflow.id, context, VALIDATION_CODES.workflowActionNotFound);
+            if (step.retry)
+                validateWorkflowRetry(step.retry, workflow.id, from, context);
+        }
+        else if (step.type === 'wait-event') {
+            edge(step.next, from);
+            edge(step.onTimeout, from);
+            requireKind(step.event, 'event', workflow.id, context, VALIDATION_CODES.workflowEventNotFound);
+            if (step.timeout && !(step.timeout.seconds > 0)) {
+                context.errors.push({
+                    code: VALIDATION_CODES.workflowInvalidTimer,
+                    message: `Workflow ${workflow.id} step ${from} has a non-positive timeout`,
+                    nodeId: workflow.id,
+                });
+            }
+            for (const bindingId of Object.keys(step.bind ?? {})) {
+                if (!declaredBindings.has(bindingId)) {
+                    context.errors.push({
+                        code: VALIDATION_CODES.workflowBindingNotFound,
+                        message: `Workflow ${workflow.id} step ${from} binds ${bindingId}, which is not a declared WorkflowBinding`,
+                        nodeId: workflow.id,
+                    });
+                }
+                else if (String(declaredBindings.get(bindingId).producedBy) !== from) {
+                    context.errors.push({
+                        code: VALIDATION_CODES.workflowDuplicateBinding,
+                        message: `Workflow ${workflow.id} step ${from} binds ${bindingId}, but its declared producer is ${String(declaredBindings.get(bindingId).producedBy)}`,
+                        nodeId: workflow.id,
+                    });
+                }
+                if (boundBy.has(bindingId)) {
+                    context.errors.push({
+                        code: VALIDATION_CODES.workflowDuplicateBinding,
+                        message: `Workflow ${workflow.id} binding ${bindingId} is assigned by more than one step`,
+                        nodeId: workflow.id,
+                    });
+                }
+                boundBy.set(bindingId, from);
+            }
+        }
+        else if (step.type === 'timer') {
+            edge(step.next, from);
+            const hasAfter = step.after !== undefined;
+            const hasAt = step.at !== undefined;
+            if (hasAfter === hasAt) {
+                context.errors.push({
+                    code: VALIDATION_CODES.workflowInvalidTimer,
+                    message: `Workflow ${workflow.id} timer ${from} must declare exactly one of after / at`,
+                    nodeId: workflow.id,
+                });
+            }
+            else if (hasAfter && !(step.after.seconds > 0)) {
+                context.errors.push({
+                    code: VALIDATION_CODES.workflowInvalidTimer,
+                    message: `Workflow ${workflow.id} timer ${from} has a non-positive after.seconds`,
+                    nodeId: workflow.id,
+                });
+            }
+        }
+        else if (step.type === 'branch') {
+            edge(step.then, from);
+            edge(step.else, from);
+        }
+        // Expression scope — inputs / bindings / (EVENT inside wait-event) / PRINCIPAL only.
+        for (const expression of workflowStepExpressions(step)) {
+            validateWorkflowExpression(expression, workflow.id, from, inputIds, declaredBindings, eventScopeOk, context);
+        }
+    }
+    // Reachability + acyclicity + terminal reachability.
+    const reachable = workflowReachableSteps(workflow);
+    for (const step of steps) {
+        const sid = step && typeof step === 'object' ? step.id : undefined;
+        if (typeof sid === 'string' && !reachable.has(sid)) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowUnreachableStep,
+                message: `Workflow ${workflow.id} step ${sid} is unreachable from entry`,
+                nodeId: workflow.id,
+            });
+        }
+    }
+    if (stepIds.has(String(workflow.entry)) && workflowHasCycle(workflow)) {
+        context.errors.push({
+            code: VALIDATION_CODES.workflowCycleNotAllowed,
+            message: `Workflow ${workflow.id} has a control-flow cycle; retries are runtime policy, not graph edges`,
+            nodeId: workflow.id,
+        });
+    }
+    // Every reachable non-terminal step must be able to reach a terminal step (or an
+    // intentional wait-event with no timeout is an acceptable "may never resolve" leaf).
+    if (stepIds.has(String(workflow.entry)) && !workflowHasCycle(workflow)) {
+        const canTerminate = new Map();
+        const reaches = (id, seen) => {
+            if (canTerminate.has(id))
+                return canTerminate.get(id);
+            if (seen.has(id))
+                return false;
+            seen.add(id);
+            const step = workflowStepById(workflow, id);
+            if (!step)
+                return false;
+            if (step.type === 'complete' || step.type === 'fail') {
+                canTerminate.set(id, true);
+                return true;
+            }
+            if (step.type === 'wait-event' && !step.timeout) {
+                // An unbounded wait is an intentional durable leaf (spec14 §123).
+                const ok = workflowStepSuccessors(step).some((n) => reaches(String(n), new Set(seen)));
+                canTerminate.set(id, ok || true);
+                return true;
+            }
+            const ok = workflowStepSuccessors(step).some((n) => reaches(String(n), new Set(seen)));
+            canTerminate.set(id, ok);
+            return ok;
+        };
+        for (const id of reachable) {
+            if (!reaches(id, new Set())) {
+                context.errors.push({
+                    code: VALIDATION_CODES.workflowNoTerminal,
+                    message: `Workflow ${workflow.id} step ${id} cannot reach complete or fail`,
+                    nodeId: workflow.id,
+                });
+            }
+        }
+    }
+}
+function validateWorkflowRetry(retry, workflowId, stepId, context) {
+    const bad = !(retry.maxAttempts >= 1) ||
+        !(retry.initialDelaySeconds >= 0) ||
+        !(retry.backoffMultiplier >= 1) ||
+        !(retry.maxDelaySeconds >= retry.initialDelaySeconds);
+    if (bad) {
+        context.errors.push({
+            code: VALIDATION_CODES.workflowInvalidRetryPolicy,
+            message: `Workflow ${workflowId} step ${stepId} has an invalid retry policy`,
+            nodeId: workflowId,
+        });
+    }
+}
+const WORKFLOW_NONDETERMINISTIC_BUILTINS = new Set(['now', 'uuid', 'random']);
+function validateWorkflowExpression(expression, workflowId, stepId, inputIds, bindings, eventScopeOk, context) {
+    walkExpression(expression, (node) => {
+        if (node.kind === 'ref') {
+            const id = String(node.targetId);
+            const inScope = inputIds.has(id) ||
+                bindings.has(id) ||
+                id === WORKFLOW_PRINCIPAL_SCOPE ||
+                (eventScopeOk && id === WORKFLOW_EVENT_SCOPE);
+            if (!inScope) {
+                context.errors.push({
+                    code: VALIDATION_CODES.workflowExpressionScope,
+                    message: `Workflow ${workflowId} step ${stepId} references ${id}, which is outside workflow expression scope (inputs / bindings${eventScopeOk ? ' / EVENT' : ''} / PRINCIPAL)`,
+                    nodeId: workflowId,
+                });
+            }
+        }
+        if (node.kind === 'call' && WORKFLOW_NONDETERMINISTIC_BUILTINS.has(node.function)) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowNondeterministic,
+                message: `Workflow ${workflowId} step ${stepId} calls ${node.function}; workflow expressions must be deterministic`,
+                nodeId: workflowId,
+            });
+        }
+    });
+}
 function validateRelationship(relationship, context) {
     const fromEntity = requireRelationshipEndpoint(relationship.from, relationship.id, context);
     const toEntity = requireRelationshipEndpoint(relationship.to, relationship.id, context);

package/dist/workflows.d.ts

@@ -0,0 +1,164 @@
+/**
+ * Durable workflows (spec14).
+ *
+ * A `WorkflowDef` is a **long-running semantic computation with a durable control
+ * position** — not a background promise, a persisted callback, a job-queue entry, a cron
+ * task or a mutable JSON blob. The graph owns the orchestration meaning; the runtime owns
+ * scheduling, persistence, retries, leases, fencing, crash recovery and physical execution.
+ *
+ * The node is portable plain data: a closed step vocabulary, `Expression` trees for every
+ * leaf, and no JavaScript body of any kind (spec14 §7, §8). It compiles into
+ * `axiom.server.v8` and is inspectable through `AgentAPI.analyzeWorkflow`.
+ */
+import type { Expression } from './expressions.js';
+import type { NodeId } from './ids.js';
+import type { NodeBase } from './nodes.js';
+import type { TypeRef } from './type-ref.js';
+/** The matched event payload — resolvable only inside a `wait-event` step's `where` / `bind`. */
+export declare const WORKFLOW_EVENT_SCOPE: "EVENT";
+/** The workflow's bound principal. */
+export declare const WORKFLOW_PRINCIPAL_SCOPE: "PRINCIPAL";
+export interface WorkflowInput {
+    id: NodeId;
+    valueType: TypeRef;
+    required?: boolean;
+}
+/**
+ * A typed, durable, **single-assignment** value produced after start. Exactly one step
+ * (`producedBy`) assigns it; every other step may only read it. There is deliberately no
+ * mutable workflow blob (spec14 §26-§28).
+ */
+export interface WorkflowBinding {
+    id: NodeId;
+    valueType: TypeRef;
+    /** The step id whose activation assigns this binding (a `wait-event` step). */
+    producedBy: NodeId;
+}
+/** Portable relative time. No cron, no ISO-8601 parsing in the graph (spec14 §44, §84). */
+export interface WorkflowDuration {
+    seconds: number;
+}
+/** Portable retry policy for an `action` step (spec14 §38). */
+export interface WorkflowRetryPolicy {
+    maxAttempts: number;
+    initialDelaySeconds: number;
+    backoffMultiplier: number;
+    maxDelaySeconds: number;
+}
+export declare const WORKFLOW_STEP_TYPES: readonly ["action", "wait-event", "timer", "branch", "complete", "fail"];
+export type WorkflowStepType = (typeof WORKFLOW_STEP_TYPES)[number];
+/** Invoke a canonical `ActionDef` under the workflow principal (spec14 §29-§43). */
+export interface WorkflowActionStep {
+    type: 'action';
+    id: NodeId;
+    action: NodeId;
+    /** Argument expressions, in workflow expression scope (inputs / bindings / PRINCIPAL). */
+    arguments?: Record<string, Expression>;
+    next: NodeId;
+    /** Where a terminal action failure routes; absent ⇒ the workflow fails. */
+    onError?: NodeId;
+    retry?: WorkflowRetryPolicy;
+}
+/** Wait for a matching canonical `EventDef` occurrence (spec14 §50-§66). */
+export interface WorkflowWaitEventStep {
+    type: 'wait-event';
+    id: NodeId;
+    event: NodeId;
+    /** Deterministic boolean correlation over `ref(EVENT)` / inputs / bindings. */
+    where?: Expression;
+    /** Assigns declared `WorkflowBinding`s from the matched event (`bindingId -> Expression`). */
+    bind?: Record<string, Expression>;
+    next: NodeId;
+    timeout?: WorkflowDuration;
+    onTimeout?: NodeId;
+}
+/** Wait until a durable time (spec14 §44-§49). Exactly one of `after` / `at`. */
+export interface WorkflowTimerStep {
+    type: 'timer';
+    id: NodeId;
+    after?: WorkflowDuration;
+    /** An expression over inputs resolving to an epoch-ms number, captured once on activation. */
+    at?: Expression;
+    next: NodeId;
+}
+/** Deterministic edge choice over durable workflow context (spec14 §67-§70). */
+export interface WorkflowBranchStep {
+    type: 'branch';
+    id: NodeId;
+    when: Expression;
+    then: NodeId;
+    else: NodeId;
+}
+/** Terminal → `completed` (spec14 §71, §72). */
+export interface WorkflowCompleteStep {
+    type: 'complete';
+    id: NodeId;
+    output?: Record<string, Expression>;
+}
+/** Terminal → `failed` (spec14 §73). */
+export interface WorkflowFailStep {
+    type: 'fail';
+    id: NodeId;
+    error?: Record<string, Expression>;
+}
+export type WorkflowStep = WorkflowActionStep | WorkflowWaitEventStep | WorkflowTimerStep | WorkflowBranchStep | WorkflowCompleteStep | WorkflowFailStep;
+export interface WorkflowDef extends NodeBase {
+    kind: 'workflow';
+    inputs?: WorkflowInput[];
+    bindings?: WorkflowBinding[];
+    entry: NodeId;
+    steps: WorkflowStep[];
+}
+/**
+ * Whether a value is a structurally recognizable workflow step — an object with an `id` and
+ * one of the six {@link WORKFLOW_STEP_TYPES}. The accessors below are total over *any* input
+ * (a malformed graph, a hand-tampered Server IR) precisely so a bad step produces a
+ * structured diagnostic rather than a native `TypeError` (spec14pt3 F1 / F2 §39-§48).
+ */
+export declare function isWorkflowStep(step: unknown): step is WorkflowStep;
+export declare function workflowStepById(workflow: WorkflowDef, stepId: NodeId | string): WorkflowStep | undefined;
+/** Every step id a step can hand control to (control-flow successors). Total over bad input. */
+export declare function workflowStepSuccessors(step: WorkflowStep): NodeId[];
+export declare function workflowIsTerminalStep(step: WorkflowStep): boolean;
+/** Every `Expression` embedded in a step — the leaves dependency / scope analysis walks. Total over bad input. */
+export declare function workflowStepExpressions(step: WorkflowStep): Expression[];
+/** Every `Expression` in a workflow — inputs carry none, so this is the step leaves. */
+export declare function workflowExpressions(workflow: WorkflowDef): Expression[];
+/** The `ActionDef` ids a workflow invokes. */
+export declare function workflowActionIds(workflow: WorkflowDef): NodeId[];
+/** The `EventDef` ids a workflow waits on. */
+export declare function workflowEventIds(workflow: WorkflowDef): NodeId[];
+/**
+ * A `WorkflowDef` reduced to a form where **authoring order is not semantic** (spec14pt3
+ * §19, §64): `steps`, `inputs` and `bindings` are ordered by id. Control flow is by explicit
+ * `entry` / `next` / `then` / `else` / `onError` / `onTimeout` edges, never by array
+ * position, so two workflows that differ only in the order their steps were declared are the
+ * same executable meaning. Both the graph-level `semanticFingerprint` and the ServerIR-side
+ * authority-compatibility fingerprint pass workflows through this before hashing, so they
+ * agree (spec14pt3 §5 G1). Non-`id` fields are untouched; human metadata is stripped by the
+ * caller's projection exactly as elsewhere.
+ */
+export declare function canonicalWorkflowForFingerprint<T extends Partial<WorkflowDef>>(workflow: T): T;
+export interface WorkflowStructuralProblem {
+    code: 'WORKFLOW_INVALID_STEP' | 'WORKFLOW_ENTRY_NOT_FOUND' | 'WORKFLOW_STEP_NOT_FOUND' | 'WORKFLOW_INVALID_TIMER';
+    message: string;
+}
+/**
+ * A **runtime-boundary** structural check on a `WorkflowDef`, independent of an
+ * `ApplicationGraph` (spec14pt3 §44-§49). `validateGraph` remains the authoring-time
+ * authority; this is what the authoritative runtime runs on a `ServerIR` it did not compile
+ * itself — stored, transported or hand-tampered — so structurally invalid workflow IR fails
+ * closed with a structured result instead of reaching a native `TypeError`, a silently
+ * skipped step or a permanently wedged instance. It checks only what the engine dereferences
+ * to execute; cross-node references (`ActionDef` / `EventDef` ids) are a compile-time
+ * concern and are not re-checked here.
+ */
+export declare function workflowStructuralProblems(workflow: WorkflowDef): WorkflowStructuralProblem[];
+/**
+ * Step ids reachable from `entry` by control flow (spec14 §122). A step not in this set is
+ * unreachable and an authoring mistake.
+ */
+export declare function workflowReachableSteps(workflow: WorkflowDef): Set<string>;
+/** Whether the control-flow graph has a cycle (retries are runtime policy, not a cycle — §11). */
+export declare function workflowHasCycle(workflow: WorkflowDef): boolean;
+//# sourceMappingURL=workflows.d.ts.map

package/dist/workflows.js

@@ -0,0 +1,258 @@
+/**
+ * Durable workflows (spec14).
+ *
+ * A `WorkflowDef` is a **long-running semantic computation with a durable control
+ * position** — not a background promise, a persisted callback, a job-queue entry, a cron
+ * task or a mutable JSON blob. The graph owns the orchestration meaning; the runtime owns
+ * scheduling, persistence, retries, leases, fencing, crash recovery and physical execution.
+ *
+ * The node is portable plain data: a closed step vocabulary, `Expression` trees for every
+ * leaf, and no JavaScript body of any kind (spec14 §7, §8). It compiles into
+ * `axiom.server.v8` and is inspectable through `AgentAPI.analyzeWorkflow`.
+ */
+// ------------------------------------------------------------------- reserved scope ids
+/** The matched event payload — resolvable only inside a `wait-event` step's `where` / `bind`. */
+export const WORKFLOW_EVENT_SCOPE = 'EVENT';
+/** The workflow's bound principal. */
+export const WORKFLOW_PRINCIPAL_SCOPE = 'PRINCIPAL';
+// -------------------------------------------------------------------------------- steps
+export const WORKFLOW_STEP_TYPES = [
+    'action',
+    'wait-event',
+    'timer',
+    'branch',
+    'complete',
+    'fail',
+];
+// ---------------------------------------------------------------------------- accessors
+/**
+ * Whether a value is a structurally recognizable workflow step — an object with an `id` and
+ * one of the six {@link WORKFLOW_STEP_TYPES}. The accessors below are total over *any* input
+ * (a malformed graph, a hand-tampered Server IR) precisely so a bad step produces a
+ * structured diagnostic rather than a native `TypeError` (spec14pt3 F1 / F2 §39-§48).
+ */
+export function isWorkflowStep(step) {
+    return (!!step &&
+        typeof step === 'object' &&
+        !Array.isArray(step) &&
+        typeof step.id === 'string' &&
+        WORKFLOW_STEP_TYPES.includes(step.type));
+}
+export function workflowStepById(workflow, stepId) {
+    const steps = Array.isArray(workflow?.steps) ? workflow.steps : [];
+    return steps.find((step) => !!step && typeof step === 'object' && String(step.id) === String(stepId));
+}
+/** Every step id a step can hand control to (control-flow successors). Total over bad input. */
+export function workflowStepSuccessors(step) {
+    if (!isWorkflowStep(step))
+        return [];
+    switch (step.type) {
+        case 'action':
+            return step.onError ? [step.next, step.onError] : [step.next];
+        case 'wait-event':
+            return step.onTimeout ? [step.next, step.onTimeout] : [step.next];
+        case 'timer':
+            return [step.next];
+        case 'branch':
+            return [step.then, step.else];
+        case 'complete':
+        case 'fail':
+            return [];
+        default:
+            return [];
+    }
+}
+export function workflowIsTerminalStep(step) {
+    return isWorkflowStep(step) && (step.type === 'complete' || step.type === 'fail');
+}
+/** Every `Expression` embedded in a step — the leaves dependency / scope analysis walks. Total over bad input. */
+export function workflowStepExpressions(step) {
+    if (!isWorkflowStep(step))
+        return [];
+    switch (step.type) {
+        case 'action':
+            return Object.values(step.arguments ?? {});
+        case 'wait-event':
+            return [...(step.where ? [step.where] : []), ...Object.values(step.bind ?? {})];
+        case 'timer':
+            return step.at ? [step.at] : [];
+        case 'branch':
+            return [step.when];
+        case 'complete':
+            return Object.values(step.output ?? {});
+        case 'fail':
+            return Object.values(step.error ?? {});
+        default:
+            return [];
+    }
+}
+/** Every `Expression` in a workflow — inputs carry none, so this is the step leaves. */
+export function workflowExpressions(workflow) {
+    return workflow.steps.flatMap(workflowStepExpressions);
+}
+/** The `ActionDef` ids a workflow invokes. */
+export function workflowActionIds(workflow) {
+    return (Array.isArray(workflow?.steps) ? workflow.steps : [])
+        .filter((s) => isWorkflowStep(s) && s.type === 'action')
+        .map((s) => s.action);
+}
+/** The `EventDef` ids a workflow waits on. */
+export function workflowEventIds(workflow) {
+    return (Array.isArray(workflow?.steps) ? workflow.steps : [])
+        .filter((s) => isWorkflowStep(s) && s.type === 'wait-event')
+        .map((s) => s.event);
+}
+// ----------------------------------------------------- canonical form for fingerprinting
+/**
+ * A `WorkflowDef` reduced to a form where **authoring order is not semantic** (spec14pt3
+ * §19, §64): `steps`, `inputs` and `bindings` are ordered by id. Control flow is by explicit
+ * `entry` / `next` / `then` / `else` / `onError` / `onTimeout` edges, never by array
+ * position, so two workflows that differ only in the order their steps were declared are the
+ * same executable meaning. Both the graph-level `semanticFingerprint` and the ServerIR-side
+ * authority-compatibility fingerprint pass workflows through this before hashing, so they
+ * agree (spec14pt3 §5 G1). Non-`id` fields are untouched; human metadata is stripped by the
+ * caller's projection exactly as elsewhere.
+ */
+export function canonicalWorkflowForFingerprint(workflow) {
+    const byId = (list) => [...(list ?? [])].sort((a, b) => {
+        const ai = String(a?.id ?? '');
+        const bi = String(b?.id ?? '');
+        return ai < bi ? -1 : ai > bi ? 1 : 0;
+    });
+    return {
+        ...workflow,
+        ...(Array.isArray(workflow.steps) ? { steps: byId(workflow.steps) } : {}),
+        ...(Array.isArray(workflow.inputs) ? { inputs: byId(workflow.inputs) } : {}),
+        ...(Array.isArray(workflow.bindings) ? { bindings: byId(workflow.bindings) } : {}),
+    };
+}
+/**
+ * A **runtime-boundary** structural check on a `WorkflowDef`, independent of an
+ * `ApplicationGraph` (spec14pt3 §44-§49). `validateGraph` remains the authoring-time
+ * authority; this is what the authoritative runtime runs on a `ServerIR` it did not compile
+ * itself — stored, transported or hand-tampered — so structurally invalid workflow IR fails
+ * closed with a structured result instead of reaching a native `TypeError`, a silently
+ * skipped step or a permanently wedged instance. It checks only what the engine dereferences
+ * to execute; cross-node references (`ActionDef` / `EventDef` ids) are a compile-time
+ * concern and are not re-checked here.
+ */
+export function workflowStructuralProblems(workflow) {
+    const problems = [];
+    const wid = String(workflow?.id ?? '<unknown>');
+    const steps = Array.isArray(workflow?.steps) ? workflow.steps : [];
+    const ids = new Set();
+    for (const step of steps) {
+        if (!isWorkflowStep(step)) {
+            problems.push({
+                code: 'WORKFLOW_INVALID_STEP',
+                message: `Workflow ${wid} has a step that is not an object with an id and a known kind`,
+            });
+            continue;
+        }
+        ids.add(String(step.id));
+    }
+    if (workflow?.entry === undefined || !ids.has(String(workflow.entry))) {
+        problems.push({
+            code: 'WORKFLOW_ENTRY_NOT_FOUND',
+            message: `Workflow ${wid} entry ${String(workflow?.entry)} is not one of its steps`,
+        });
+    }
+    const edge = (target, from) => {
+        if (target !== undefined && !ids.has(String(target))) {
+            problems.push({
+                code: 'WORKFLOW_STEP_NOT_FOUND',
+                message: `Workflow ${wid} step ${from} points at ${String(target)}, which is not a step`,
+            });
+        }
+    };
+    for (const step of steps) {
+        if (!isWorkflowStep(step))
+            continue;
+        const from = String(step.id);
+        switch (step.type) {
+            case 'action':
+                if (typeof step.action !== 'string') {
+                    problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} action step ${from} has no action target` });
+                }
+                edge(step.next, from);
+                edge(step.onError, from);
+                break;
+            case 'wait-event':
+                if (typeof step.event !== 'string') {
+                    problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} wait-event step ${from} has no event target` });
+                }
+                edge(step.next, from);
+                edge(step.onTimeout, from);
+                if (step.timeout !== undefined && !(Number(step.timeout?.seconds) > 0)) {
+                    problems.push({ code: 'WORKFLOW_INVALID_TIMER', message: `Workflow ${wid} wait-event step ${from} has a non-positive timeout` });
+                }
+                break;
+            case 'timer': {
+                const hasAfter = step.after !== undefined;
+                const hasAt = step.at !== undefined;
+                if (hasAfter === hasAt) {
+                    problems.push({ code: 'WORKFLOW_INVALID_TIMER', message: `Workflow ${wid} timer step ${from} must declare exactly one of after / at` });
+                }
+                else if (hasAfter && !(Number(step.after?.seconds) > 0)) {
+                    problems.push({ code: 'WORKFLOW_INVALID_TIMER', message: `Workflow ${wid} timer step ${from} has a non-positive after.seconds` });
+                }
+                edge(step.next, from);
+                break;
+            }
+            case 'branch':
+                if (step.when === undefined) {
+                    problems.push({ code: 'WORKFLOW_INVALID_STEP', message: `Workflow ${wid} branch step ${from} has no when expression` });
+                }
+                edge(step.then, from);
+                edge(step.else, from);
+                break;
+            case 'complete':
+            case 'fail':
+                break;
+        }
+    }
+    return problems;
+}
+/**
+ * Step ids reachable from `entry` by control flow (spec14 §122). A step not in this set is
+ * unreachable and an authoring mistake.
+ */
+export function workflowReachableSteps(workflow) {
+    const seen = new Set();
+    const stack = [String(workflow.entry)];
+    while (stack.length > 0) {
+        const id = stack.pop();
+        if (seen.has(id))
+            continue;
+        const step = workflowStepById(workflow, id);
+        if (!step)
+            continue;
+        seen.add(id);
+        for (const next of workflowStepSuccessors(step))
+            stack.push(String(next));
+    }
+    return seen;
+}
+/** Whether the control-flow graph has a cycle (retries are runtime policy, not a cycle — §11). */
+export function workflowHasCycle(workflow) {
+    const WHITE = 0;
+    const GREY = 1;
+    const BLACK = 2;
+    const colour = new Map();
+    const visit = (id) => {
+        const step = workflowStepById(workflow, id);
+        if (!step)
+            return false;
+        colour.set(id, GREY);
+        for (const next of workflowStepSuccessors(step)) {
+            const c = colour.get(String(next)) ?? WHITE;
+            if (c === GREY)
+                return true;
+            if (c === WHITE && visit(String(next)))
+                return true;
+        }
+        colour.set(id, BLACK);
+        return false;
+    };
+    return visit(String(workflow.entry));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cynodia/axiom-core",
-  "version": "0.13.1-alpha.1",
+  "version": "0.14.0-alpha.2",
   "description": "Application Graph, semantic types, locations and validation for Axiom.",
   "license": "MIT",
   "author": "AskTech AS",