@pikku/core 0.12.129 → 0.12.130

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 0.12.130
+
+### Patch Changes
+
+- dfcd351: The deploy planner now binds a unit to the units of the functions its functions call with `rpc.invoke('name')` / `rpc.remote('name')`. Before, a caller and callee split into different units (e.g. a no-service function in `svc-base` calling a DB function in `svc-kysely`) got no service binding and failed on the deployed stage with "No service binding for function". The inspector records literal RPC names per function as `invokes` (single, double or substitution-free template quotes; `rpc!`, `wire.rpc`) and warns on a computed name, which the planner cannot see (#1883).
+- cf40182: Deployed units that call `rpc.startWorkflow('x')` now get x's meta, so the call no longer fails with `WorkflowNotFoundError`. The inspector records `startsWorkflows` for literal `rpc.startWorkflow(...)` calls. It warns when a handler computes the workflow name or passes `rpc` to a helper, because the planner cannot see those calls.
+
+  With workflow queues, the deploy planner gives a starter unit the workflow meta and orchestrator queue meta only (new `--workflowMeta` filter), plus `workflow-state` and `queue` services. Without queues the start runs inline, so the whole workflow is bundled. Core's `startWorkflow` now requires the workflow registration only for inline runs; queued runs need only the meta.
+
+- 5bce779: `pikku dev` registers webhook sources with their providers when `PIKKU_DEV_WEBHOOK_URL` is set. What it registered, signing secrets included, is kept in a git-ignored `.webhook-registrations.gen.json` next to `pikku.config.json`, so a database reset or `.pikku` wipe does not register again, and nothing reaches a provider while the url and events are unchanged. Registrations no source declares any more are warned about on every run, with the endpoint and label to delete by hand. The prefix defaults to `dev-<username>`; override it with `PIKKU_DEV_WEBHOOK_LABEL_PREFIX`. New in core: `reconcileWebhookRegistrations`.
+- 5bce779: Webhook trigger sources are off until someone turns them on, and addons declare their own.
+
+  An addon calls `wireTriggerWebhookSource` in its own package, and an app that wires the addon gets the source (its route included) without declaring it: named and routed after the addon's namespace, so two instances get one each. A source the app declares under the same name wins.
+
+  Every source now has an `enabled` switch in the `triggerSourceStore`, off by default. `reconcileTriggerSources` registers only enabled sources and records each one's `baseUrl` and `labelPrefix`; a disabled source's route answers 404 without running `receive`. New in core: `enableTriggerSource` registers a source with its provider and `disableTriggerSource` stops it receiving, then tears it down, both at the recorded address unless one is given. The admin addon exposes them as `triggerSourceEnable` and `triggerSourceDisable`. The `pikkuTriggerSource` table gains `enabled`, `baseUrl` and `labelPrefix`: run `pikku db generate` for the migration.
+
 ## 0.12.129
 
 ### Patch Changes

package/dist/function/function-meta.types.d.ts

@@ -138,12 +138,26 @@ export type FunctionMeta = FunctionRuntimeMeta & Partial<{
     isDirectFunction: boolean;
     sourceFile: string;
     exportedName: string;
+    /**
+     * RPC names this function's own body calls by literal name through
+     * `rpc.invoke(...)` / `rpc.remote(...)`. The deploy planner binds the
+     * function's unit to each callee's unit from this; a call with a computed
+     * name is not listed, and is warned about instead.
+     */
+    invokes: string[];
     /** File containing the handler body when it differs from sourceFile (imported handlers) */
     bodySourceFile?: string;
     /** 1-indexed first line of the handler body (verbose meta; coverage mapping) */
     bodyStart: number;
     /** 1-indexed last line of the handler body (verbose meta; coverage mapping) */
     bodyEnd: number;
+    /**
+     * Workflow names this function's own body starts by literal name through
+     * `rpc.startWorkflow(...)`. The deploy planner bundles each one's meta
+     * into the function's unit, which is all a queued start needs. A call
+     * made from a helper the handler passes `rpc` to is not listed.
+     */
+    startsWorkflows: string[];
 } & CommonWireMeta>;
 export type FunctionsRuntimeMeta = Record<string, FunctionRuntimeMeta>;
 export type FunctionsMeta = Record<string, FunctionMeta>;

package/dist/services/trigger-source-store.d.ts

@@ -3,15 +3,22 @@ export type TriggerSourceKind = 'webhook';
 export type DeclaredTriggerSource = {
     name: string;
     kind: TriggerSourceKind;
+    /** Where the running app is served and how it labels provider endpoints: what enabling a source registers it with. */
+    baseUrl?: string;
+    labelPrefix?: string;
 };
 /**
  * What was registered with the provider for one declared trigger source.
  * `state` is what the last `setup` returned — provider identifiers only; any
  * secret it issued lives in the credential service.
  */
-export type TriggerSourceRow = DeclaredTriggerSource & {
+export type TriggerSourceRow = Required<Pick<DeclaredTriggerSource, 'name' | 'kind'>> & {
+    baseUrl: string | null;
+    labelPrefix: string | null;
     /** False once the declaration has gone from code without a teardown: an orphan. */
     declared: boolean;
+    /** Only an enabled source is registered with its provider or receives events. Off until someone turns it on. */
+    enabled: boolean;
     status: string | null;
     state: WebhookSourceState | null;
     /** The last step's instructions or error. */
@@ -25,11 +32,12 @@ export type TriggerSourceResult = {
 };
 /** What each declared trigger source registered with its provider. */
 export interface TriggerSourceStore {
-    /** Upserts the declared sources and marks the rest undeclared. */
+    /** Upserts the declared sources, keeping a known address when none is given, and marks the rest undeclared. */
     syncTriggerSources(sources: DeclaredTriggerSource[]): Promise<void>;
     listTriggerSources(): Promise<TriggerSourceRow[]>;
     getTriggerSource(name: string): Promise<TriggerSourceRow | null>;
     recordTriggerSource(name: string, result: TriggerSourceResult): Promise<void>;
+    setTriggerSourceEnabled(name: string, enabled: boolean): Promise<void>;
     deleteTriggerSource(name: string): Promise<void>;
 }
 export declare class InMemoryTriggerSourceStore implements TriggerSourceStore {
@@ -38,8 +46,12 @@ export declare class InMemoryTriggerSourceStore implements TriggerSourceStore {
     listTriggerSources(): Promise<{
         name: string;
         kind: TriggerSourceKind;
+        baseUrl: string | null;
+        labelPrefix: string | null;
         /** False once the declaration has gone from code without a teardown: an orphan. */
         declared: boolean;
+        /** Only an enabled source is registered with its provider or receives events. Off until someone turns it on. */
+        enabled: boolean;
         status: string | null;
         state: WebhookSourceState | null;
         /** The last step's instructions or error. */
@@ -49,8 +61,12 @@ export declare class InMemoryTriggerSourceStore implements TriggerSourceStore {
     getTriggerSource(name: string): Promise<{
         name: string;
         kind: TriggerSourceKind;
+        baseUrl: string | null;
+        labelPrefix: string | null;
         /** False once the declaration has gone from code without a teardown: an orphan. */
         declared: boolean;
+        /** Only an enabled source is registered with its provider or receives events. Off until someone turns it on. */
+        enabled: boolean;
         status: string | null;
         state: WebhookSourceState | null;
         /** The last step's instructions or error. */
@@ -58,5 +74,6 @@ export declare class InMemoryTriggerSourceStore implements TriggerSourceStore {
         updatedAt: string | null;
     } | null>;
     recordTriggerSource(name: string, result: TriggerSourceResult): Promise<void>;
+    setTriggerSourceEnabled(name: string, enabled: boolean): Promise<void>;
     deleteTriggerSource(name: string): Promise<void>;
 }

package/dist/services/trigger-source-store.js

@@ -5,16 +5,23 @@ export class InMemoryTriggerSourceStore {
         for (const row of this.rows.values()) {
             row.declared = names.has(row.name);
         }
-        for (const { name, kind } of sources) {
+        for (const { name, kind, baseUrl, labelPrefix } of sources) {
             const row = this.rows.get(name);
             if (row) {
                 row.kind = kind;
+                if (baseUrl !== undefined)
+                    row.baseUrl = baseUrl;
+                if (labelPrefix !== undefined)
+                    row.labelPrefix = labelPrefix;
                 continue;
             }
             this.rows.set(name, {
                 name,
                 kind,
+                baseUrl: baseUrl ?? null,
+                labelPrefix: labelPrefix ?? null,
                 declared: true,
+                enabled: false,
                 status: null,
                 state: null,
                 detail: null,
@@ -41,6 +48,12 @@ export class InMemoryTriggerSourceStore {
         row.detail = result.detail ?? null;
         row.updatedAt = new Date().toISOString();
     }
+    async setTriggerSourceEnabled(name, enabled) {
+        const row = this.rows.get(name);
+        if (!row)
+            throw new Error(`Unknown trigger source: ${name}`);
+        row.enabled = enabled;
+    }
     async deleteTriggerSource(name) {
         this.rows.delete(name);
     }

package/dist/wirings/trigger/index.d.ts

@@ -1,6 +1,6 @@
 export { wireTrigger, wireTriggerSource } from './trigger-runner.js';
-export { wireTriggerWebhookSource, receiveWebhookSourceRequest, dispatchWebhookSourceJob, runWebhookSourceLifecycle, declaredTriggerSources, reconcileTriggerSources, teardownTriggerSources, subscribedWebhookEvents, } from './webhook-source-runner.js';
-export type { WebhookSourceOutcome } from './webhook-source-runner.js';
+export { wireTriggerWebhookSource, receiveWebhookSourceRequest, dispatchWebhookSourceJob, runWebhookSourceLifecycle, declaredTriggerSources, reconcileTriggerSources, enableTriggerSource, disableTriggerSource, reconcileWebhookRegistrations, teardownTriggerSources, subscribedWebhookEvents, } from './webhook-source-runner.js';
+export type { OrphanedWebhookRegistration, WebhookRegistration, WebhookRegistrations, WebhookSourceOutcome, } from './webhook-source-runner.js';
 export { PIKKU_INCOMING_WEBHOOK_QUEUE_NAME } from './webhook-source.types.js';
 export type { CoreTriggerWebhookSource, TriggerEvent, WebhookCheckResult, WebhookLifecycleInput, WebhookReceiveResult, WebhookRequest, WebhookSetupResult, WebhookSourceJob, WebhookSourceMeta, WebhookSourceMethod, WebhookSourcesMeta, WebhookSourceState, WebhookTeardownInput, WebhookTeardownResult, } from './webhook-source.types.js';
 export { PikkuTriggerService } from './pikku-trigger-service.js';

package/dist/wirings/trigger/index.js

@@ -1,4 +1,4 @@
 export { wireTrigger, wireTriggerSource } from './trigger-runner.js';
-export { wireTriggerWebhookSource, receiveWebhookSourceRequest, dispatchWebhookSourceJob, runWebhookSourceLifecycle, declaredTriggerSources, reconcileTriggerSources, teardownTriggerSources, subscribedWebhookEvents, } from './webhook-source-runner.js';
+export { wireTriggerWebhookSource, receiveWebhookSourceRequest, dispatchWebhookSourceJob, runWebhookSourceLifecycle, declaredTriggerSources, reconcileTriggerSources, enableTriggerSource, disableTriggerSource, reconcileWebhookRegistrations, teardownTriggerSources, subscribedWebhookEvents, } from './webhook-source-runner.js';
 export { PIKKU_INCOMING_WEBHOOK_QUEUE_NAME } from './webhook-source.types.js';
 export { PikkuTriggerService } from './pikku-trigger-service.js';

package/dist/wirings/trigger/webhook-source-runner.d.ts

@@ -9,7 +9,8 @@ export declare const subscribedWebhookEvents: (source: string) => string[];
 /**
  * The body of a webhook source's route: `receive`, validate, and queue every
  * event some trigger listens for. Events nobody listens for are answered and
- * dropped, so the provider does not retry them forever.
+ * dropped, so the provider does not retry them forever. With a
+ * `triggerSourceStore`, a source nobody enabled answers 404.
  */
 export declare const receiveWebhookSourceRequest: (sourceName: string, wire: {
     http?: PikkuHTTP;
@@ -44,15 +45,61 @@ export declare const runWebhookSourceLifecycle: ({ action, previous, singletonSe
     singletonServices?: CoreSingletonServices;
 }) => Promise<WebhookSourceOutcome[]>;
 /** The trigger sources this app declares, as the store is synced to. */
-export declare const declaredTriggerSources: () => DeclaredTriggerSource[];
+export declare const declaredTriggerSources: (address?: LifecycleInput) => DeclaredTriggerSource[];
 /**
- * Registers every declared webhook source with its provider: `check`, then
+ * Registers every enabled webhook source with its provider: `check`, then
  * `setup` where it is missing or drifted, recording what was registered.
- * Run after a deployment goes live.
+ * A source nobody enabled is skipped. Run after a deployment goes live.
  */
 export declare const reconcileTriggerSources: ({ singletonServices, ...input }: LifecycleInput & {
     singletonServices?: CoreSingletonServices;
 }) => Promise<WebhookSourceOutcome[]>;
+type SwitchInput = Partial<LifecycleInput> & {
+    name: string;
+    singletonServices?: CoreSingletonServices;
+};
+/**
+ * Turns a declared webhook source on and registers it with its provider, at
+ * the address given or the one the last deployment recorded.
+ */
+export declare const enableTriggerSource: ({ singletonServices, ...input }: SwitchInput) => Promise<WebhookSourceOutcome>;
+/**
+ * Turns a webhook source off: it stops receiving at once, then is removed
+ * from its provider. A failed teardown leaves it off and records the error.
+ */
+export declare const disableTriggerSource: ({ singletonServices, ...input }: SwitchInput) => Promise<WebhookSourceOutcome>;
+/** What one source registered with its provider, as a caller keeps it between runs. */
+export type WebhookRegistration = {
+    url: string;
+    events: string[];
+    status: WebhookSourceOutcome['status'];
+    state?: WebhookSourceState;
+    /** The signing secrets `setup` stored, so a wiped credential store can be refilled without registering again. */
+    credentials?: Record<string, unknown>;
+};
+export type WebhookRegistrations = Record<string, WebhookRegistration>;
+export type OrphanedWebhookRegistration = {
+    source: string;
+    url: string;
+    label: string;
+};
+/**
+ * Registers every declared webhook source against registrations the caller
+ * keeps rather than a `triggerSourceStore`, as `pikku dev` does in a file that
+ * outlives its database. A source whose url and events match what was
+ * registered is left alone without calling the provider, and its signing
+ * secrets are put back if the credential store lost them. Registrations no
+ * source declares any more are returned as orphans and kept, since only the
+ * code that set one up could tear it down.
+ */
+export declare const reconcileWebhookRegistrations: ({ registrations, singletonServices, ...input }: LifecycleInput & {
+    registrations: WebhookRegistrations;
+    singletonServices?: CoreSingletonServices;
+}) => Promise<{
+    registrations: WebhookRegistrations;
+    outcomes: WebhookSourceOutcome[];
+    orphans: OrphanedWebhookRegistration[];
+}>;
 /**
  * Removes the named webhook sources from their providers and forgets them.
  * Run on the outgoing deployment for the sources the next release drops,

package/dist/wirings/trigger/webhook-source-runner.js

@@ -79,11 +79,16 @@ const validateEvents = async (source, events, logger) => {
 /**
  * The body of a webhook source's route: `receive`, validate, and queue every
  * event some trigger listens for. Events nobody listens for are answered and
- * dropped, so the provider does not retry them forever.
+ * dropped, so the provider does not retry them forever. With a
+ * `triggerSourceStore`, a source nobody enabled answers 404.
  */
 export const receiveWebhookSourceRequest = async (sourceName, wire) => {
     const singletonServices = getSingletonServices();
     const meta = getSourceMeta(sourceName);
+    const store = singletonServices.triggerSourceStore;
+    if (store && !(await store.getTriggerSource(sourceName))?.enabled) {
+        return new Response(null, { status: 404 });
+    }
     const source = pikkuState(null, 'trigger', 'webhookSources').get(sourceName);
     const request = await readRequest(wire.http);
     const result = meta.receive
@@ -152,9 +157,12 @@ export const dispatchWebhookSourceJob = async (job) => {
 const recordAttempt = (singletonServices, receiptId, trigger, error) => singletonServices.incomingWebhookService
     ?.recordAttempt(receiptId, { trigger, ...(error ? { error } : {}) })
     .catch((storeError) => singletonServices.logger.error(`Failed to record the attempt for webhook receipt ${receiptId}`, storeError));
-const runSourceLifecycleStep = async (meta, action, { baseUrl, labelPrefix }, previous, singletonServices) => {
-    const url = `${baseUrl.replace(/\/+$/, '')}${meta.route}`;
-    const label = `${labelPrefix}:${meta.name}`;
+const sourceAddress = (meta, { baseUrl, labelPrefix }) => ({
+    url: `${baseUrl.replace(/\/+$/, '')}${meta.route}`,
+    label: `${labelPrefix}:${meta.name}`,
+});
+const runSourceLifecycleStep = async (meta, action, lifecycleInput, previous, singletonServices) => {
+    const { url, label } = sourceAddress(meta, lifecycleInput);
     const input = {
         url,
         label,
@@ -217,31 +225,165 @@ const requireTriggerSourceStore = (singletonServices) => {
     return store;
 };
 /** The trigger sources this app declares, as the store is synced to. */
-export const declaredTriggerSources = () => Object.keys(pikkuState(null, 'trigger', 'webhookSourceMeta')).map((name) => ({
+export const declaredTriggerSources = (address) => Object.keys(pikkuState(null, 'trigger', 'webhookSourceMeta')).map((name) => ({
     name,
     kind: 'webhook',
+    ...address,
 }));
 const detailOf = (outcome) => outcome.instructions ?? outcome.error ?? outcome.reason ?? null;
+const registerTriggerSource = async (store, meta, input, previous, singletonServices) => {
+    const outcome = await runSourceLifecycleStep(meta, 'setup', input, previous, singletonServices);
+    await store.recordTriggerSource(meta.name, {
+        status: outcome.status,
+        ...(outcome.state ? { state: outcome.state } : {}),
+        detail: detailOf(outcome),
+    });
+    return outcome;
+};
 /**
- * Registers every declared webhook source with its provider: `check`, then
+ * Registers every enabled webhook source with its provider: `check`, then
  * `setup` where it is missing or drifted, recording what was registered.
- * Run after a deployment goes live.
+ * A source nobody enabled is skipped. Run after a deployment goes live.
  */
 export const reconcileTriggerSources = async ({ singletonServices = getSingletonServices(), ...input }) => {
     const store = requireTriggerSourceStore(singletonServices);
-    await store.syncTriggerSources(declaredTriggerSources());
+    await store.syncTriggerSources(declaredTriggerSources({
+        baseUrl: input.baseUrl,
+        labelPrefix: input.labelPrefix,
+    }));
     const outcomes = [];
     for (const meta of Object.values(pikkuState(null, 'trigger', 'webhookSourceMeta'))) {
         const row = await store.getTriggerSource(meta.name);
-        const outcome = await runSourceLifecycleStep(meta, 'setup', input, row?.state ?? undefined, singletonServices);
-        await store.recordTriggerSource(meta.name, {
+        if (!row?.enabled) {
+            outcomes.push({
+                source: meta.name,
+                url: sourceAddress(meta, input).url,
+                status: 'skipped',
+                reason: 'disabled',
+            });
+            continue;
+        }
+        outcomes.push(await registerTriggerSource(store, meta, input, row.state ?? undefined, singletonServices));
+    }
+    return outcomes;
+};
+/** The address given, or the one the last deployment synced onto the row. */
+const switchAddress = (row, { baseUrl, labelPrefix, name }) => {
+    const address = {
+        baseUrl: baseUrl ?? row?.baseUrl,
+        labelPrefix: labelPrefix ?? row?.labelPrefix,
+    };
+    if (!address.baseUrl || !address.labelPrefix) {
+        throw new Error(`Trigger source '${name}' has no address yet: pass baseUrl and labelPrefix, or deploy so reconcile records them.`);
+    }
+    return address;
+};
+/**
+ * Turns a declared webhook source on and registers it with its provider, at
+ * the address given or the one the last deployment recorded.
+ */
+export const enableTriggerSource = async ({ singletonServices = getSingletonServices(), ...input }) => {
+    const store = requireTriggerSourceStore(singletonServices);
+    const meta = getSourceMeta(input.name);
+    await store.syncTriggerSources(declaredTriggerSources());
+    const row = await store.getTriggerSource(input.name);
+    const address = switchAddress(row, input);
+    await store.setTriggerSourceEnabled(input.name, true);
+    return registerTriggerSource(store, meta, address, row?.state ?? undefined, singletonServices);
+};
+/**
+ * Turns a webhook source off: it stops receiving at once, then is removed
+ * from its provider. A failed teardown leaves it off and records the error.
+ */
+export const disableTriggerSource = async ({ singletonServices = getSingletonServices(), ...input }) => {
+    const store = requireTriggerSourceStore(singletonServices);
+    const meta = getSourceMeta(input.name);
+    const row = await store.getTriggerSource(input.name);
+    const address = switchAddress(row, input);
+    await store.setTriggerSourceEnabled(input.name, false);
+    const outcome = await runSourceLifecycleStep(meta, 'teardown', address, row?.state ?? undefined, singletonServices);
+    await store.recordTriggerSource(input.name, {
+        status: outcome.status,
+        ...(outcome.status === 'failed' ? {} : { state: null }),
+        detail: detailOf(outcome),
+    });
+    return outcome;
+};
+/** The singleton credentials the package owning a source's `setup` declares: where its signing secret goes. */
+const sourceCredentialNames = (meta) => {
+    if (!meta.setup)
+        return [];
+    const namespace = meta.setup.includes(':') ? meta.setup.split(':')[0] : '';
+    const packageName = pikkuState(null, 'addons', 'packages').get(namespace)?.package ?? null;
+    const declared = pikkuState(packageName, 'package', 'credentialsMeta') ?? {};
+    return Object.entries(declared)
+        .filter(([, credential]) => credential.type === 'singleton' && !credential.oauth2)
+        .map(([name]) => name);
+};
+const sameEvents = (a, b) => a.length === b.length && a.every((event) => b.includes(event));
+/**
+ * Registers every declared webhook source against registrations the caller
+ * keeps rather than a `triggerSourceStore`, as `pikku dev` does in a file that
+ * outlives its database. A source whose url and events match what was
+ * registered is left alone without calling the provider, and its signing
+ * secrets are put back if the credential store lost them. Registrations no
+ * source declares any more are returned as orphans and kept, since only the
+ * code that set one up could tear it down.
+ */
+export const reconcileWebhookRegistrations = async ({ registrations, singletonServices = getSingletonServices(), ...input }) => {
+    const credentialService = singletonServices.credentialService;
+    const sources = pikkuState(null, 'trigger', 'webhookSourceMeta');
+    const next = {};
+    const outcomes = [];
+    for (const meta of Object.values(sources)) {
+        const { url } = sourceAddress(meta, input);
+        const events = subscribedWebhookEvents(meta.name);
+        const previous = registrations[meta.name];
+        const names = sourceCredentialNames(meta);
+        if (credentialService) {
+            for (const [name, value] of Object.entries(previous?.credentials ?? {})) {
+                if (!(await credentialService.has(name))) {
+                    await credentialService.set(name, value);
+                }
+            }
+        }
+        if (previous &&
+            previous.status !== 'failed' &&
+            previous.url === url &&
+            sameEvents(previous.events, events)) {
+            next[meta.name] = previous;
+            outcomes.push({ source: meta.name, url, status: 'unchanged' });
+            continue;
+        }
+        const outcome = await runSourceLifecycleStep(meta, 'setup', input, previous?.state, singletonServices);
+        const credentials = {};
+        for (const name of names) {
+            const value = await credentialService?.get(name);
+            if (value != null)
+                credentials[name] = value;
+        }
+        const state = outcome.state ?? previous?.state;
+        next[meta.name] = {
+            url,
+            events,
             status: outcome.status,
-            ...(outcome.state ? { state: outcome.state } : {}),
-            detail: detailOf(outcome),
-        });
+            ...(state ? { state } : {}),
+            ...(Object.keys(credentials).length ? { credentials } : {}),
+        };
         outcomes.push(outcome);
     }
-    return outcomes;
+    const orphans = [];
+    for (const [source, registration] of Object.entries(registrations)) {
+        if (sources[source])
+            continue;
+        next[source] = registration;
+        orphans.push({
+            source,
+            url: registration.url,
+            label: `${input.labelPrefix}:${source}`,
+        });
+    }
+    return { registrations: next, outcomes, orphans };
 };
 /**
  * Removes the named webhook sources from their providers and forgets them.

package/dist/wirings/workflow/pikku-workflow-service.js

@@ -385,15 +385,15 @@ export class PikkuWorkflowService {
             const shouldInline = options?.inline || !getSingletonServices()?.queueService;
             return runWorkflowGraph(this, name, input, rpcService, shouldInline, options?.startNode, wire, workflowMeta);
         }
-        const registrations = pikkuState(packageName, 'workflows', 'registrations');
-        const workflow = registrations.get(resolved?.resolvedName ?? name);
-        if (!workflow) {
-            throw new WorkflowNotFoundError(name);
-        }
         if (!workflowMeta.graphHash) {
             throw new Error(`Missing workflow graphHash for '${name}'`);
         }
         const shouldInline = options?.inline || !getSingletonServices()?.queueService;
+        // A queued run needs only the meta; the orchestrator's unit runs it.
+        const registrations = pikkuState(packageName, 'workflows', 'registrations');
+        if (shouldInline && !registrations.get(resolved?.resolvedName ?? name)) {
+            throw new WorkflowNotFoundError(name);
+        }
         const runId = await this.createRun(name, input, shouldInline, workflowMeta.graphHash, wire, {
             deterministic: workflowMeta.deterministic,
             plannedSteps: workflowMeta.plannedSteps,

package/knowledge/decisions/security/an-actor-credential-is-derived-per-persona.md

@@ -26,9 +26,10 @@ rotating it invalidates every credential at once.
 
 This is what lets a holder be handed less than everything:
 
-- The browser switcher gets `VITE_DEV_ACTOR_SECRETS`, one credential per
-  declared persona. The root stays on the dev server, so a bundle can no longer
-  hold the thing that is entitled to every persona.
+- The browser switcher gets no credential at all. It used to be handed
+  `VITE_DEV_ACTOR_SECRETS`, one per persona; it now names a persona by id at
+  `/sign-in/persona`, which the server gates with the actor opt-in and the
+  `devSwitcher` flag, so a bundle holds nothing worth taking.
 - A run can be given `PIKKU_PERSONA_SECRETS` (`id=secret,…`, minted with
   `pikku persona secret`) instead of the root, and then it can sign in as those
   personas and no others. Asking for one outside the list throws naming the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.129",
+  "version": "0.12.130",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",

package/src/public-surface.json

@@ -183,9 +183,12 @@
     "PIKKU_INCOMING_WEBHOOK_QUEUE_NAME",
     "PikkuTriggerService",
     "declaredTriggerSources",
+    "disableTriggerSource",
     "dispatchWebhookSourceJob",
+    "enableTriggerSource",
     "receiveWebhookSourceRequest",
     "reconcileTriggerSources",
+    "reconcileWebhookRegistrations",
     "runWebhookSourceLifecycle",
     "subscribedWebhookEvents",
     "teardownTriggerSources",