@cynodia/axiom-server 0.14.0-alpha.4 → 0.14.0-alpha.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (39) hide show
  1. package/conformance/live/aggregate-reset.json +1 -1
  2. package/conformance/live/dependency-commit-no-change.json +1 -1
  3. package/conformance/live/f2-state-ref-refused.json +1 -1
  4. package/conformance/live/initial-result.json +1 -1
  5. package/conformance/live/insert-on-filter-entry.json +1 -1
  6. package/conformance/live/limit-boundary.json +1 -1
  7. package/conformance/live/manifest.json +1 -1
  8. package/conformance/live/not-live-capable.json +1 -1
  9. package/conformance/live/provider-only-sequence.json +1 -1
  10. package/conformance/live/provider-record-remove.json +1 -1
  11. package/conformance/live/remove-on-filter-exit.json +1 -1
  12. package/conformance/live/update-with-move.json +1 -1
  13. package/conformance/live/update-without-move.json +1 -1
  14. package/conformance/workflow/manifest.json +1 -1
  15. package/conformance/workflow/workflow-action-on-error.json +1 -1
  16. package/conformance/workflow/workflow-action-retry.json +1 -1
  17. package/conformance/workflow/workflow-action-success.json +1 -1
  18. package/conformance/workflow/workflow-action-terminal-failure.json +1 -1
  19. package/conformance/workflow/workflow-branch-false.json +1 -1
  20. package/conformance/workflow/workflow-branch-true.json +1 -1
  21. package/conformance/workflow/workflow-cancel-waiting.json +1 -1
  22. package/conformance/workflow/workflow-event-match.json +1 -1
  23. package/conformance/workflow/workflow-event-nonmatch.json +1 -1
  24. package/conformance/workflow/workflow-event-timeout.json +1 -1
  25. package/conformance/workflow/workflow-start-complete.json +1 -1
  26. package/conformance/workflow/workflow-start-idempotency.json +1 -1
  27. package/conformance/workflow/workflow-timer.json +1 -1
  28. package/dist/server.d.ts +6 -1
  29. package/dist/workflows.js +20 -1
  30. package/package.json +4 -4
  31. package/schema/protocol.v1.schema.json +1 -1
  32. package/schema/server-ir.v1.schema.json +1 -1
  33. package/schema/server-ir.v2.schema.json +1 -1
  34. package/schema/server-ir.v3.schema.json +1 -1
  35. package/schema/server-ir.v4.schema.json +1 -1
  36. package/schema/server-ir.v5.schema.json +1 -1
  37. package/schema/server-ir.v6.schema.json +1 -1
  38. package/schema/server-ir.v7.schema.json +1 -1
  39. package/schema/server-ir.v8.schema.json +1 -1
@@ -10,7 +10,7 @@
10
10
  "contract": "axiom.server.v6",
11
11
  "id": "live-query-conformance",
12
12
  "name": "Live Query Conformance",
13
- "version": "0.14.0-alpha.4",
13
+ "version": "0.14.0-alpha.5",
14
14
  "entities": [
15
15
  {
16
16
  "id": "entity_order",
@@ -10,7 +10,7 @@
10
10
  "contract": "axiom.server.v6",
11
11
  "id": "live-query-conformance",
12
12
  "name": "Live Query Conformance",
13
- "version": "0.14.0-alpha.4",
13
+ "version": "0.14.0-alpha.5",
14
14
  "entities": [
15
15
  {
16
16
  "id": "entity_order",
@@ -11,7 +11,7 @@
11
11
  "contract": "axiom.server.v6",
12
12
  "id": "live-query-conformance",
13
13
  "name": "Live Query Conformance",
14
- "version": "0.14.0-alpha.4",
14
+ "version": "0.14.0-alpha.5",
15
15
  "entities": [
16
16
  {
17
17
  "id": "entity_order",
@@ -9,7 +9,7 @@
9
9
  "contract": "axiom.server.v6",
10
10
  "id": "live-query-conformance",
11
11
  "name": "Live Query Conformance",
12
- "version": "0.14.0-alpha.4",
12
+ "version": "0.14.0-alpha.5",
13
13
  "entities": [
14
14
  {
15
15
  "id": "entity_order",
@@ -10,7 +10,7 @@
10
10
  "contract": "axiom.server.v6",
11
11
  "id": "live-query-conformance",
12
12
  "name": "Live Query Conformance",
13
- "version": "0.14.0-alpha.4",
13
+ "version": "0.14.0-alpha.5",
14
14
  "entities": [
15
15
  {
16
16
  "id": "entity_order",
@@ -9,7 +9,7 @@
9
9
  "contract": "axiom.server.v6",
10
10
  "id": "live-query-conformance",
11
11
  "name": "Live Query Conformance",
12
- "version": "0.14.0-alpha.4",
12
+ "version": "0.14.0-alpha.5",
13
13
  "entities": [
14
14
  {
15
15
  "id": "entity_order",
@@ -2,7 +2,7 @@
2
2
  "conformance": "axiom.conformance.v7",
3
3
  "baseContract": "axiom.server.v7",
4
4
  "protocol": "axiom.protocol.v1",
5
- "release": "0.14.0-alpha.4",
5
+ "release": "0.14.0-alpha.5",
6
6
  "description": "Portable live-query conformance fixtures (spec13 §152, §194). Each file carries a compiled axiom.server.v7 Server IR, a dataset of provider rows, the live query to open, its required initial result, and a script of committed mutations each paired with the live message that must follow (canonical update / whole reset / none). The runner also checks the primary invariant: folding the delivered stream must equal a fresh one-shot execution of the same QueryDef. Running one needs only a DataProvider and the semantics in docs/LIVE_QUERIES.md.",
7
7
  "fixtures": [
8
8
  {
@@ -10,7 +10,7 @@
10
10
  "contract": "axiom.server.v6",
11
11
  "id": "live-query-conformance",
12
12
  "name": "Live Query Conformance",
13
- "version": "0.14.0-alpha.4",
13
+ "version": "0.14.0-alpha.5",
14
14
  "entities": [
15
15
  {
16
16
  "id": "entity_order",
@@ -12,7 +12,7 @@
12
12
  "contract": "axiom.server.v6",
13
13
  "id": "live-query-conformance",
14
14
  "name": "Live Query Conformance",
15
- "version": "0.14.0-alpha.4",
15
+ "version": "0.14.0-alpha.5",
16
16
  "entities": [
17
17
  {
18
18
  "id": "entity_order",
@@ -9,7 +9,7 @@
9
9
  "contract": "axiom.server.v6",
10
10
  "id": "live-query-conformance",
11
11
  "name": "Live Query Conformance",
12
- "version": "0.14.0-alpha.4",
12
+ "version": "0.14.0-alpha.5",
13
13
  "entities": [
14
14
  {
15
15
  "id": "entity_order",
@@ -10,7 +10,7 @@
10
10
  "contract": "axiom.server.v6",
11
11
  "id": "live-query-conformance",
12
12
  "name": "Live Query Conformance",
13
- "version": "0.14.0-alpha.4",
13
+ "version": "0.14.0-alpha.5",
14
14
  "entities": [
15
15
  {
16
16
  "id": "entity_order",
@@ -10,7 +10,7 @@
10
10
  "contract": "axiom.server.v6",
11
11
  "id": "live-query-conformance",
12
12
  "name": "Live Query Conformance",
13
- "version": "0.14.0-alpha.4",
13
+ "version": "0.14.0-alpha.5",
14
14
  "entities": [
15
15
  {
16
16
  "id": "entity_order",
@@ -9,7 +9,7 @@
9
9
  "contract": "axiom.server.v6",
10
10
  "id": "live-query-conformance",
11
11
  "name": "Live Query Conformance",
12
- "version": "0.14.0-alpha.4",
12
+ "version": "0.14.0-alpha.5",
13
13
  "entities": [
14
14
  {
15
15
  "id": "entity_order",
@@ -2,7 +2,7 @@
2
2
  "conformance": "axiom.conformance.v8",
3
3
  "baseContract": "axiom.server.v8",
4
4
  "protocol": "axiom.protocol.v1",
5
- "release": "0.14.0-alpha.4",
5
+ "release": "0.14.0-alpha.5",
6
6
  "description": "Portable workflow conformance fixtures (spec14 §156-§159). Each file carries a compiled axiom.server.v8 Server IR, the start arguments, a deterministic driver script, and the required logical transition history + terminal state. Physical action attempts may be duplicated; the logical history must match exactly. Running one needs only the in-memory WorkflowStore and the semantics in docs/WORKFLOWS.md.",
7
7
  "fixtures": [
8
8
  {
@@ -31,7 +31,7 @@
31
31
  "contract": "axiom.server.v8",
32
32
  "id": "workflow-conformance",
33
33
  "name": "Workflow Conformance",
34
- "version": "0.14.0-alpha.4",
34
+ "version": "0.14.0-alpha.5",
35
35
  "entities": [
36
36
  {
37
37
  "id": "entity_pay",
@@ -49,7 +49,7 @@
49
49
  "contract": "axiom.server.v8",
50
50
  "id": "workflow-conformance",
51
51
  "name": "Workflow Conformance",
52
- "version": "0.14.0-alpha.4",
52
+ "version": "0.14.0-alpha.5",
53
53
  "entities": [
54
54
  {
55
55
  "id": "entity_pay",
@@ -21,7 +21,7 @@
21
21
  "contract": "axiom.server.v8",
22
22
  "id": "workflow-conformance",
23
23
  "name": "Workflow Conformance",
24
- "version": "0.14.0-alpha.4",
24
+ "version": "0.14.0-alpha.5",
25
25
  "entities": [
26
26
  {
27
27
  "id": "entity_pay",
@@ -27,7 +27,7 @@
27
27
  "contract": "axiom.server.v8",
28
28
  "id": "workflow-conformance",
29
29
  "name": "Workflow Conformance",
30
- "version": "0.14.0-alpha.4",
30
+ "version": "0.14.0-alpha.5",
31
31
  "entities": [
32
32
  {
33
33
  "id": "entity_pay",
@@ -20,7 +20,7 @@
20
20
  "contract": "axiom.server.v8",
21
21
  "id": "workflow-conformance",
22
22
  "name": "Workflow Conformance",
23
- "version": "0.14.0-alpha.4",
23
+ "version": "0.14.0-alpha.5",
24
24
  "entities": [
25
25
  {
26
26
  "id": "entity_pay",
@@ -20,7 +20,7 @@
20
20
  "contract": "axiom.server.v8",
21
21
  "id": "workflow-conformance",
22
22
  "name": "Workflow Conformance",
23
- "version": "0.14.0-alpha.4",
23
+ "version": "0.14.0-alpha.5",
24
24
  "entities": [
25
25
  {
26
26
  "id": "entity_pay",
@@ -31,7 +31,7 @@
31
31
  "contract": "axiom.server.v8",
32
32
  "id": "workflow-conformance",
33
33
  "name": "Workflow Conformance",
34
- "version": "0.14.0-alpha.4",
34
+ "version": "0.14.0-alpha.5",
35
35
  "entities": [
36
36
  {
37
37
  "id": "entity_pay",
@@ -30,7 +30,7 @@
30
30
  "contract": "axiom.server.v8",
31
31
  "id": "workflow-conformance",
32
32
  "name": "Workflow Conformance",
33
- "version": "0.14.0-alpha.4",
33
+ "version": "0.14.0-alpha.5",
34
34
  "entities": [
35
35
  {
36
36
  "id": "entity_pay",
@@ -28,7 +28,7 @@
28
28
  "contract": "axiom.server.v8",
29
29
  "id": "workflow-conformance",
30
30
  "name": "Workflow Conformance",
31
- "version": "0.14.0-alpha.4",
31
+ "version": "0.14.0-alpha.5",
32
32
  "entities": [
33
33
  {
34
34
  "id": "entity_pay",
@@ -27,7 +27,7 @@
27
27
  "contract": "axiom.server.v8",
28
28
  "id": "workflow-conformance",
29
29
  "name": "Workflow Conformance",
30
- "version": "0.14.0-alpha.4",
30
+ "version": "0.14.0-alpha.5",
31
31
  "entities": [
32
32
  {
33
33
  "id": "entity_pay",
@@ -17,7 +17,7 @@
17
17
  "contract": "axiom.server.v8",
18
18
  "id": "workflow-conformance",
19
19
  "name": "Workflow Conformance",
20
- "version": "0.14.0-alpha.4",
20
+ "version": "0.14.0-alpha.5",
21
21
  "entities": [
22
22
  {
23
23
  "id": "entity_pay",
@@ -17,7 +17,7 @@
17
17
  "contract": "axiom.server.v8",
18
18
  "id": "workflow-conformance",
19
19
  "name": "Workflow Conformance",
20
- "version": "0.14.0-alpha.4",
20
+ "version": "0.14.0-alpha.5",
21
21
  "entities": [
22
22
  {
23
23
  "id": "entity_pay",
@@ -23,7 +23,7 @@
23
23
  "contract": "axiom.server.v8",
24
24
  "id": "workflow-conformance",
25
25
  "name": "Workflow Conformance",
26
- "version": "0.14.0-alpha.4",
26
+ "version": "0.14.0-alpha.5",
27
27
  "entities": [
28
28
  {
29
29
  "id": "entity_pay",
package/dist/server.d.ts CHANGED
@@ -318,7 +318,12 @@ export interface AxiomServer {
318
318
  message: string;
319
319
  };
320
320
  }>;
321
- /** Cancel a workflow instance (spec14 §75). Idempotent; not a rollback. */
321
+ /**
322
+ * Cancel a workflow instance (spec14 §75). Idempotent; not a rollback. **Authorized**
323
+ * (spec14pt6): `credential` is resolved and its principal fingerprint must match the one
324
+ * the instance was started under, or the call is refused `AUTHORIZATION_DENIED` with no
325
+ * mutation. Cancellation of an already-terminal instance stays idempotent for any caller.
326
+ */
322
327
  cancelWorkflow(instanceId: string, credential?: unknown): Promise<{
323
328
  ok: true;
324
329
  status: string;
package/dist/workflows.js CHANGED
@@ -152,6 +152,8 @@ const WF_DIAGNOSTIC = {
152
152
  ARGUMENT_MISMATCH: 'WORKFLOW_ARGUMENT_MISMATCH',
153
153
  INCOMPATIBLE: 'INCOMPATIBLE_AUTHORITY',
154
154
  NOT_FOUND: 'WORKFLOW_INSTANCE_NOT_FOUND',
155
+ /** The canonical Axiom authorization refusal — same code `authorize()` uses (spec14pt6 F4). */
156
+ UNAUTHORIZED: 'AUTHORIZATION_DENIED',
155
157
  };
156
158
  export function createWorkflowEngine(options) {
157
159
  const now = options.now ?? (() => Date.now());
@@ -744,7 +746,7 @@ export function createWorkflowEngine(options) {
744
746
  const fresh = (await store.load(instance.instanceId)) ?? instance;
745
747
  return { instanceId: fresh.instanceId, status: fresh.status };
746
748
  }
747
- async function cancelWorkflow(instanceId) {
749
+ async function cancelWorkflow(instanceId, credential) {
748
750
  const record = await store.load(instanceId);
749
751
  if (!record)
750
752
  return { error: { code: WF_DIAGNOSTIC.NOT_FOUND, message: `No workflow instance ${instanceId}` } };
@@ -753,6 +755,23 @@ export function createWorkflowEngine(options) {
753
755
  if (record.status === 'completed' || record.status === 'failed') {
754
756
  return { ok: true, status: record.status }; // idempotent; a terminal workflow is not resurrected
755
757
  }
758
+ // spec14pt6 F4 — cancellation is an authorized durable mutation. The calling
759
+ // credential is resolved to a canonical principal and its fingerprint must match the
760
+ // one the instance was **started** under (spec14 §257 — instance access is keyed by
761
+ // `principalFingerprint`). A cross-principal caller is refused with the canonical
762
+ // `AUTHORIZATION_DENIED` **before** any lease claim or transition — no
763
+ // `instanceRevision` advance, no history, no wake. The check resolves identically on
764
+ // every authority (durable `principalFingerprint` + deterministic `resolvePrincipal`),
765
+ // so it is topology-independent.
766
+ const { fingerprint } = await options.resolvePrincipal(credential);
767
+ if (fingerprint !== record.principalFingerprint) {
768
+ return {
769
+ error: {
770
+ code: WF_DIAGNOSTIC.UNAUTHORIZED,
771
+ message: `Not authorized to cancel workflow instance ${instanceId}`,
772
+ },
773
+ };
774
+ }
756
775
  // spec14pt3 §163 — cancellation writes a durable `cancelled` transition on this
757
776
  // instance, so it is compatibility-gated like every other transition: an incompatible
758
777
  // build must not transition an instance whose workflow meaning it does not share. The
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cynodia/axiom-server",
3
- "version": "0.14.0-alpha.4",
3
+ "version": "0.14.0-alpha.5",
4
4
  "description": "Authoritative server runtime that executes an Axiom Server IR.",
5
5
  "license": "MIT",
6
6
  "author": "AskTech AS",
@@ -37,11 +37,11 @@
37
37
  "./schema/*": "./schema/*"
38
38
  },
39
39
  "dependencies": {
40
- "@cynodia/axiom-core": "0.14.0-alpha.4",
41
- "@cynodia/axiom-runtime": "0.14.0-alpha.4"
40
+ "@cynodia/axiom-core": "0.14.0-alpha.5",
41
+ "@cynodia/axiom-runtime": "0.14.0-alpha.5"
42
42
  },
43
43
  "scripts": {
44
44
  "build": "tsc -b tsconfig.json tsconfig.test.json",
45
- "test": "node --test --test-concurrency=1 dist-test/**/*.test.js"
45
+ "test": "AXIOM_WF_TRIALS=${AXIOM_WF_TRIALS:-3} AXIOM_WF_MIXED_TRIALS=${AXIOM_WF_MIXED_TRIALS:-2} node --test --test-concurrency=1 dist-test/**/*.test.js"
46
46
  }
47
47
  }
@@ -4,7 +4,7 @@
4
4
  "title": "Axiom semantic protocol v1",
5
5
  "description": "What a client may send an authority and what it may receive back. A client requests semantic operations — \"invoke action X with arguments Y\" — never a mutation program. Nothing here mentions a transport.",
6
6
  "contract": "axiom.protocol.v1",
7
- "release": "0.14.0-alpha.4",
7
+ "release": "0.14.0-alpha.5",
8
8
  "oneOf": [
9
9
  {
10
10
  "$ref": "#/$defs/ServerRequest"
@@ -4,7 +4,7 @@
4
4
  "title": "Axiom Server IR v1",
5
5
  "description": "The normative structure of an `axiom.server.v1` document. Structure only: what a conforming runtime must *do* with it is the semantic contract, and the conformance fixtures are the executable statement of that.",
6
6
  "contract": "axiom.server.v1",
7
- "release": "0.14.0-alpha.4",
7
+ "release": "0.14.0-alpha.5",
8
8
  "type": "object",
9
9
  "required": [
10
10
  "contract",
@@ -4,7 +4,7 @@
4
4
  "title": "Axiom Server IR v2",
5
5
  "description": "The normative structure of an `axiom.server.v2` document. Structure only: what a conforming runtime must *do* with it is the semantic contract, and the conformance fixtures are the executable statement of that.",
6
6
  "contract": "axiom.server.v2",
7
- "release": "0.14.0-alpha.4",
7
+ "release": "0.14.0-alpha.5",
8
8
  "type": "object",
9
9
  "required": [
10
10
  "contract",
@@ -4,7 +4,7 @@
4
4
  "title": "Axiom Server IR v3",
5
5
  "description": "The normative structure of an `axiom.server.v3` document. Structure only: what a conforming runtime must *do* with it is the semantic contract, and the conformance fixtures are the executable statement of that.",
6
6
  "contract": "axiom.server.v3",
7
- "release": "0.14.0-alpha.4",
7
+ "release": "0.14.0-alpha.5",
8
8
  "type": "object",
9
9
  "required": [
10
10
  "contract",
@@ -4,7 +4,7 @@
4
4
  "title": "Axiom Server IR v4",
5
5
  "description": "The normative structure of an `axiom.server.v4` document. Structure only: what a conforming runtime must *do* with it is the semantic contract, and the conformance fixtures are the executable statement of that.",
6
6
  "contract": "axiom.server.v4",
7
- "release": "0.14.0-alpha.4",
7
+ "release": "0.14.0-alpha.5",
8
8
  "type": "object",
9
9
  "required": [
10
10
  "contract",
@@ -4,7 +4,7 @@
4
4
  "title": "Axiom Server IR v5",
5
5
  "description": "The normative structure of an `axiom.server.v5` document. Structure only: what a conforming runtime must *do* with it is the semantic contract, and the conformance fixtures are the executable statement of that.",
6
6
  "contract": "axiom.server.v5",
7
- "release": "0.14.0-alpha.4",
7
+ "release": "0.14.0-alpha.5",
8
8
  "type": "object",
9
9
  "required": [
10
10
  "contract",
@@ -4,7 +4,7 @@
4
4
  "title": "Axiom Server IR v6",
5
5
  "description": "The normative structure of an `axiom.server.v6` document. Structure only: what a conforming runtime must *do* with it is the semantic contract, and the conformance fixtures are the executable statement of that.",
6
6
  "contract": "axiom.server.v6",
7
- "release": "0.14.0-alpha.4",
7
+ "release": "0.14.0-alpha.5",
8
8
  "type": "object",
9
9
  "required": [
10
10
  "contract",
@@ -4,7 +4,7 @@
4
4
  "title": "Axiom Server IR v7",
5
5
  "description": "The normative structure of an `axiom.server.v7` document. Structure only: what a conforming runtime must *do* with it is the semantic contract, and the conformance fixtures are the executable statement of that.",
6
6
  "contract": "axiom.server.v7",
7
- "release": "0.14.0-alpha.4",
7
+ "release": "0.14.0-alpha.5",
8
8
  "type": "object",
9
9
  "required": [
10
10
  "contract",
@@ -4,7 +4,7 @@
4
4
  "title": "Axiom Server IR v8",
5
5
  "description": "The normative structure of an `axiom.server.v8` document. Structure only: what a conforming runtime must *do* with it is the semantic contract, and the conformance fixtures are the executable statement of that.",
6
6
  "contract": "axiom.server.v8",
7
- "release": "0.14.0-alpha.4",
7
+ "release": "0.14.0-alpha.5",
8
8
  "type": "object",
9
9
  "required": [
10
10
  "contract",