@pikku/core 0.12.134 → 0.12.135

package/knowledge/decisions/internals/workflow-step-compensation-runs-as-its-own-durable-step.md

@@ -1,26 +1,29 @@
 ---
 type: decision
-title: A step's compensation handler runs as a durable step of its own, and never compensates itself
-description: A refund or rollback must not fire twice on replay, so `onError` is recorded as `<step>:onError` with retries disabled
+title: A step's compensation runs as a durable step of its own, declared on the function
+description: A refund or rollback must not fire twice on replay, so it is recorded as `<step>:compensate`; `onError` is gone
 tags: workflow
 ---
 
-# A step's compensation handler runs as a durable step of its own, and never compensates itself
+# A step's compensation runs as a durable step of its own, declared on the function
 
-`runStepCompensation` in `pikku-workflow-service.ts` invokes a failed step's
-`onError` RPC through `rpcStep` under the name `<stepName>:onError` rather than
-calling it directly. Durability is the point: a compensation handler is
-typically a refund or a rollback, and a bare invoke would fire again on every
-replay that walks past the failed step. Recorded as a step, the second replay
-finds it `succeeded` and returns the cached result.
+A function declares `compensate` inline on `pikkuFunc`. When a workflow unwinds,
+`driveUnwind` (`workflow-compensation.ts`) runs it as the step
+`<step>:compensate` through the same RPC path as a forward step. Durability is
+the point: a compensation is typically a refund or a rollback, and a bare invoke
+would fire again on every replay. Recorded as a step, a second pass finds it
+`succeeded` and returns the cached result. It uses the forward step's retry
+defaults, and a compensation cannot itself be compensated.
 
-It runs with `{ retries: 0 }` and its own `onError` is deliberately not
-forwarded — a compensation handler cannot itself compensate. `onError` mirrors a
-graph node's: the handler receives `{ error: { message } }`, and the original
-error is still thrown afterwards, so the workflow fails either way. This is
-compensation, not recovery.
+`runPikkuFunc` and the RPC resolver derive the `<id>:compensate` function from
+the forward config lazily, so nothing extra is registered, and it is never
+exposed. What to undo, and in what order, is decided by the pure `planUnwind`
+from the recorded step rows — never from in-memory state, so a crash mid-unwind
+resumes at the next compensation.
 
-**What this rules out:** invoking the `onError` RPC inline "since it's just
-cleanup", giving it the workflow's default retry count, chaining a second
-`onError` onto it, or swallowing the original error because the handler
-succeeded.
+`onError` (DSL option and graph node field) was removed. Graph nodes recover
+with `recover`, which takes precedence over compensation.
+
+**What this rules out:** invoking the compensation inline "since it's just
+cleanup", compensating a compensation, a second unwind of a settled run, and
+swallowing the original failure because a handler succeeded.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.134",
+  "version": "0.12.135",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",

package/src/public-surface.json

@@ -532,7 +532,6 @@
     "wrapDEK"
   ],
   "./hmac": [
-    "WebhookSigningSecret",
     "hmacDigest",
     "hmacSha256Hex",
     "timingSafeStringEqual",