@pikku/core 0.12.143 → 0.12.145

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (701) hide show
  1. package/dist/analytics/analytics.d.ts +14 -0
  2. package/dist/analytics/analytics.js +14 -0
  3. package/dist/analytics/analytics.types.d.ts +1 -0
  4. package/dist/analytics/anonymous-analytics-identity.d.ts +1 -0
  5. package/dist/analytics/cookie-analytics-identity.d.ts +1 -0
  6. package/dist/analytics/mint-cookie.d.ts +1 -0
  7. package/dist/{wirings/channel/channel-middleware-runner.d.ts → channel-middleware-runner.d.ts} +17 -3
  8. package/dist/{wirings/channel/channel-middleware-runner.js → channel-middleware-runner.js} +24 -8
  9. package/dist/classification/data-classification.d.ts +13 -0
  10. package/dist/classification/secret-value.d.ts +7 -0
  11. package/dist/classification/secret-value.js +7 -0
  12. package/dist/crypto-utils.d.ts +93 -0
  13. package/dist/crypto-utils.js +92 -0
  14. package/dist/dev/hot-reload.d.ts +16 -0
  15. package/dist/dev/hot-reload.js +16 -1
  16. package/dist/dev/module-runner.js +7 -3
  17. package/dist/dev/reload-meta.js +1 -1
  18. package/dist/errors/error-handler.d.ts +9 -0
  19. package/dist/errors/error-handler.js +8 -0
  20. package/dist/errors/errors.d.ts +219 -0
  21. package/dist/errors/errors.js +227 -0
  22. package/dist/errors/serialized-error.d.ts +4 -0
  23. package/dist/function/abort-scope.d.ts +5 -0
  24. package/dist/function/function-meta.types.d.ts +20 -0
  25. package/dist/function/function-runner.d.ts +41 -0
  26. package/dist/function/function-runner.js +57 -11
  27. package/dist/function/functions.types.d.ts +59 -0
  28. package/dist/function/functions.types.js +23 -0
  29. package/dist/function/list.types.d.ts +4 -0
  30. package/dist/lifecycle.d.ts +12 -1
  31. package/dist/lifecycle.js +12 -1
  32. package/dist/middleware/addon-scope-cap.d.ts +4 -0
  33. package/dist/middleware/addon-scope-cap.js +7 -3
  34. package/dist/middleware/auth-apikey.js +3 -3
  35. package/dist/middleware/auth-bearer.js +5 -13
  36. package/dist/middleware/auth-cookie.js +3 -3
  37. package/dist/middleware/middleware-factories.d.ts +17 -0
  38. package/dist/middleware/middleware-factories.js +17 -0
  39. package/dist/middleware/middleware.types.d.ts +23 -0
  40. package/dist/middleware/remote-auth.d.ts +15 -0
  41. package/dist/middleware/remote-auth.js +18 -3
  42. package/dist/middleware/remote-jobs-secret.js +2 -10
  43. package/dist/middleware-runner.d.ts +7 -0
  44. package/dist/middleware-runner.js +23 -7
  45. package/dist/permissions.d.ts +13 -0
  46. package/dist/permissions.js +13 -0
  47. package/dist/pikku-state.d.ts +49 -0
  48. package/dist/pikku-state.js +49 -0
  49. package/dist/remote.js +20 -5
  50. package/dist/schema.d.ts +36 -0
  51. package/dist/schema.js +36 -0
  52. package/dist/services/agent-run-state-service.d.ts +8 -0
  53. package/dist/services/agent-runner-service.d.ts +24 -0
  54. package/dist/services/agent-storage-service.d.ts +8 -0
  55. package/dist/services/ai-embedding-service.d.ts +4 -0
  56. package/dist/services/audit-service.d.ts +48 -0
  57. package/dist/services/audit-service.js +22 -0
  58. package/dist/services/content-service.d.ts +34 -0
  59. package/dist/services/credential-wire-service.d.ts +9 -0
  60. package/dist/services/credential-wire-service.js +9 -0
  61. package/dist/services/deployment-service.d.ts +14 -0
  62. package/dist/services/email-service.d.ts +20 -0
  63. package/dist/services/email-template.d.ts +24 -0
  64. package/dist/services/email-template.js +12 -0
  65. package/dist/services/file-scenario-run-store.d.ts +5 -0
  66. package/dist/services/file-scenario-run-store.js +4 -0
  67. package/dist/services/gateway-service.d.ts +5 -0
  68. package/dist/services/in-memory-agent-run-state-service.d.ts +5 -0
  69. package/dist/services/in-memory-agent-run-state-service.js +5 -0
  70. package/dist/services/in-memory-lease-service.d.ts +5 -0
  71. package/dist/services/in-memory-lease-service.js +5 -0
  72. package/dist/services/in-memory-session-store.d.ts +4 -0
  73. package/dist/services/in-memory-session-store.js +4 -0
  74. package/dist/services/incoming-webhook-queue.d.ts +2 -0
  75. package/dist/services/incoming-webhook-queue.js +2 -0
  76. package/dist/services/incoming-webhook-service.d.ts +9 -1
  77. package/dist/services/incoming-webhook-service.js +1 -1
  78. package/dist/services/index.d.ts +1 -5
  79. package/dist/services/index.js +1 -5
  80. package/dist/services/jwt-service.d.ts +8 -0
  81. package/dist/services/lease-service.d.ts +5 -0
  82. package/dist/services/lease-service.js +1 -0
  83. package/dist/services/local-content-request-handler.d.ts +20 -0
  84. package/dist/services/local-content-request-handler.js +11 -0
  85. package/dist/services/local-content.d.ts +45 -0
  86. package/dist/services/local-content.js +35 -0
  87. package/dist/services/local-credential-service.d.ts +5 -0
  88. package/dist/services/local-credential-service.js +5 -0
  89. package/dist/services/local-email-service.d.ts +7 -0
  90. package/dist/services/local-email-service.js +7 -0
  91. package/dist/services/local-secrets.d.ts +8 -0
  92. package/dist/services/local-secrets.js +8 -0
  93. package/dist/services/local-variables.d.ts +6 -0
  94. package/dist/services/local-variables.js +6 -0
  95. package/dist/services/logger.d.ts +4 -0
  96. package/dist/services/logger.js +4 -0
  97. package/dist/services/meta-service.d.ts +38 -0
  98. package/dist/services/meta-service.js +6 -0
  99. package/dist/services/queue-webhook-service.d.ts +19 -0
  100. package/dist/services/queue-webhook-service.js +19 -0
  101. package/dist/services/remote-jobs.d.ts +8 -13
  102. package/dist/services/remote-jobs.js +3 -54
  103. package/dist/services/scenario-cookie-jar.d.ts +4 -0
  104. package/dist/services/scheduler-service.d.ts +13 -0
  105. package/dist/services/scheduler-service.js +8 -0
  106. package/dist/services/schema-service.d.ts +9 -0
  107. package/dist/services/scope-service.d.ts +10 -0
  108. package/dist/services/scoped-secret-service.d.ts +5 -0
  109. package/dist/services/scoped-secret-service.js +5 -0
  110. package/dist/services/secret-host-binding.d.ts +5 -0
  111. package/dist/services/secret-host-binding.js +5 -0
  112. package/dist/services/secret-service.d.ts +19 -1
  113. package/dist/services/secretless.d.ts +6 -0
  114. package/dist/services/secretless.js +6 -0
  115. package/dist/services/session-store.d.ts +5 -0
  116. package/dist/services/stub-tracker.d.ts +1 -0
  117. package/dist/services/temporary-file-service.d.ts +9 -0
  118. package/dist/services/temporary-file-service.js +9 -0
  119. package/dist/services/trigger-service.d.ts +4 -0
  120. package/dist/services/trigger-source-store.d.ts +13 -0
  121. package/dist/services/trigger-source-store.js +7 -0
  122. package/dist/services/typed-credential-service.d.ts +6 -0
  123. package/dist/services/typed-credential-service.js +5 -0
  124. package/dist/services/typed-secret-service.d.ts +12 -0
  125. package/dist/services/typed-secret-service.js +11 -0
  126. package/dist/services/typed-variables-service.d.ts +1 -0
  127. package/dist/services/user-session-service.d.ts +31 -1
  128. package/dist/services/user-session-service.js +29 -3
  129. package/dist/services/v8-coverage-service.d.ts +27 -0
  130. package/dist/services/v8-coverage-service.js +5 -0
  131. package/dist/services/variables-service.d.ts +8 -0
  132. package/dist/services/virtual-user-sign-in.d.ts +1 -0
  133. package/dist/services/virtual-user-statement.d.ts +8 -0
  134. package/dist/services/virtual-user-statement.js +4 -0
  135. package/dist/services/webhook-service.d.ts +25 -0
  136. package/dist/services/webhook-service.js +15 -0
  137. package/dist/services/workflow-service.d.ts +6 -0
  138. package/dist/test-utils.js +1 -1
  139. package/dist/testing/service-tests.d.ts +4 -0
  140. package/dist/time-utils.d.ts +15 -0
  141. package/dist/time-utils.js +14 -0
  142. package/dist/types/core.types.d.ts +80 -0
  143. package/dist/types/state.types.d.ts +4 -0
  144. package/dist/utils/hmac.d.ts +3 -0
  145. package/dist/utils/safe-fetch.d.ts +14 -0
  146. package/dist/utils/safe-fetch.js +13 -0
  147. package/dist/utils/stable-stringify.d.ts +11 -0
  148. package/dist/utils/stable-stringify.js +33 -0
  149. package/dist/utils.d.ts +28 -0
  150. package/dist/utils.js +22 -0
  151. package/dist/version.d.ts +7 -0
  152. package/dist/version.js +7 -0
  153. package/dist/wirings/addon/define-screens.d.ts +2 -0
  154. package/dist/wirings/addon/remote-addon-auth.d.ts +9 -0
  155. package/dist/wirings/addon/remote-addon-auth.js +5 -0
  156. package/dist/wirings/addon/wire-addon.d.ts +4 -0
  157. package/dist/wirings/addon/wire-remote-addon.d.ts +1 -0
  158. package/dist/wirings/agent/agent-agui.d.ts +14 -5
  159. package/dist/wirings/agent/agent-agui.js +17 -6
  160. package/dist/wirings/agent/agent-helpers.d.ts +61 -1
  161. package/dist/wirings/agent/agent-helpers.js +62 -2
  162. package/dist/wirings/agent/agent-interrupt.d.ts +5 -0
  163. package/dist/wirings/agent/agent-output.d.ts +20 -0
  164. package/dist/wirings/agent/agent-output.js +69 -0
  165. package/dist/wirings/agent/agent-prepare.d.ts +41 -0
  166. package/dist/wirings/agent/agent-prepare.js +38 -2
  167. package/dist/wirings/agent/agent-registry.d.ts +8 -0
  168. package/dist/wirings/agent/agent-registry.js +10 -4
  169. package/dist/wirings/agent/agent-runner.d.ts +33 -0
  170. package/dist/wirings/agent/agent-runner.js +40 -7
  171. package/dist/wirings/agent/agent-stream.d.ts +30 -0
  172. package/dist/wirings/agent/agent-stream.js +33 -11
  173. package/dist/wirings/agent/agent.types.d.ts +43 -0
  174. package/dist/wirings/agent/voice-input.d.ts +12 -0
  175. package/dist/wirings/agent/voice-input.js +12 -0
  176. package/dist/wirings/agent/voice-output.d.ts +14 -0
  177. package/dist/wirings/agent/voice-output.js +10 -0
  178. package/dist/wirings/agent-scorer/agent-scorer-judge.js +1 -2
  179. package/dist/wirings/agent-scorer/agent-scorer-registry.d.ts +10 -0
  180. package/dist/wirings/agent-scorer/agent-scorer-registry.js +10 -0
  181. package/dist/wirings/agent-scorer/agent-scorer-snapshots.d.ts +1 -0
  182. package/dist/wirings/agent-scorer/agent-scorer-snapshots.js +1 -0
  183. package/dist/wirings/agent-scorer/agent-scorer.types.d.ts +7 -0
  184. package/dist/wirings/channel/channel-common.js +1 -1
  185. package/dist/wirings/channel/channel-rpc.types.d.ts +5 -0
  186. package/dist/wirings/channel/channel-runner.d.ts +22 -0
  187. package/dist/wirings/channel/channel-runner.js +22 -0
  188. package/dist/wirings/channel/channel-store.d.ts +8 -0
  189. package/dist/wirings/channel/channel-store.js +7 -0
  190. package/dist/wirings/channel/channel.types.d.ts +18 -0
  191. package/dist/wirings/channel/define-channel-routes.d.ts +5 -0
  192. package/dist/wirings/channel/define-channel-routes.js +5 -0
  193. package/dist/wirings/channel/eventhub-service.d.ts +9 -0
  194. package/dist/wirings/channel/eventhub-store.d.ts +1 -0
  195. package/dist/wirings/channel/eventhub-store.js +1 -0
  196. package/dist/wirings/channel/index.d.ts +1 -1
  197. package/dist/wirings/channel/index.js +1 -1
  198. package/dist/wirings/channel/local/local-channel-handler.d.ts +1 -0
  199. package/dist/wirings/channel/local/local-channel-handler.js +1 -0
  200. package/dist/wirings/channel/local/local-channel-runner.d.ts +13 -0
  201. package/dist/wirings/channel/local/local-channel-runner.js +13 -0
  202. package/dist/wirings/channel/local/local-eventhub-service.d.ts +1 -0
  203. package/dist/wirings/channel/local/local-eventhub-service.js +1 -0
  204. package/dist/wirings/channel/log-channels.d.ts +1 -0
  205. package/dist/wirings/channel/log-channels.js +1 -0
  206. package/dist/wirings/channel/pikku-abstract-channel-handler.d.ts +5 -0
  207. package/dist/wirings/channel/pikku-abstract-channel-handler.js +5 -0
  208. package/dist/wirings/channel/serverless/serverless-channel-runner.d.ts +32 -0
  209. package/dist/wirings/channel/serverless/serverless-channel-runner.js +31 -0
  210. package/dist/wirings/cli/channel/cli-channel-runner.d.ts +8 -0
  211. package/dist/wirings/cli/channel/cli-channel-runner.js +8 -0
  212. package/dist/wirings/cli/channel/cli-raw-channel-runner.d.ts +1 -0
  213. package/dist/wirings/cli/cli-runner.d.ts +43 -0
  214. package/dist/wirings/cli/cli-runner.js +43 -0
  215. package/dist/wirings/cli/cli.types.d.ts +4 -0
  216. package/dist/wirings/cli/command-parser.d.ts +13 -0
  217. package/dist/wirings/cli/command-parser.js +16 -0
  218. package/dist/wirings/credential/credential-overrides.d.ts +1 -0
  219. package/dist/wirings/credential/credential.types.d.ts +7 -0
  220. package/dist/wirings/credential/validate-credential-definitions.d.ts +7 -0
  221. package/dist/wirings/credential/validate-credential-definitions.js +7 -0
  222. package/dist/wirings/flag/cached-flag-source.d.ts +1 -0
  223. package/dist/wirings/flag/flag.types.d.ts +3 -0
  224. package/dist/wirings/gateway/gateway-runner.d.ts +23 -0
  225. package/dist/wirings/gateway/gateway-runner.js +23 -0
  226. package/dist/wirings/gateway/gateway.types.d.ts +3 -0
  227. package/dist/wirings/gateway/local-gateway-service.d.ts +10 -0
  228. package/dist/{services → wirings/gateway}/local-gateway-service.js +6 -2
  229. package/dist/wirings/http/http-routes.d.ts +21 -0
  230. package/dist/wirings/http/http-routes.js +11 -0
  231. package/dist/wirings/http/http-runner.d.ts +71 -0
  232. package/dist/wirings/http/http-runner.js +73 -5
  233. package/dist/wirings/http/http.types.d.ts +27 -0
  234. package/dist/wirings/http/index.d.ts +1 -0
  235. package/dist/wirings/http/index.js +1 -0
  236. package/dist/wirings/http/log-http-routes.d.ts +1 -0
  237. package/dist/wirings/http/log-http-routes.js +1 -0
  238. package/dist/wirings/http/merge-request-data.d.ts +12 -0
  239. package/dist/wirings/http/merge-request-data.js +42 -0
  240. package/dist/wirings/http/pikku-fetch-http-request.d.ts +1 -0
  241. package/dist/wirings/http/pikku-fetch-http-request.js +3 -32
  242. package/dist/wirings/http/pikku-fetch-http-response.d.ts +1 -0
  243. package/dist/wirings/http/pikku-fetch-http-response.js +1 -0
  244. package/dist/wirings/http/routers/http-router.d.ts +6 -0
  245. package/dist/wirings/http/routers/http-router.js +6 -0
  246. package/dist/wirings/http/web-request.d.ts +17 -0
  247. package/dist/wirings/http/web-request.js +17 -0
  248. package/dist/wirings/mcp/mcp-endpoint-registry.d.ts +7 -0
  249. package/dist/wirings/mcp/mcp-endpoint-registry.js +7 -0
  250. package/dist/wirings/mcp/mcp-runner.d.ts +63 -0
  251. package/dist/wirings/mcp/mcp-runner.js +62 -0
  252. package/dist/wirings/mcp/mcp.types.d.ts +12 -0
  253. package/dist/wirings/node/node.types.d.ts +4 -0
  254. package/dist/wirings/oauth2/oauth2.types.d.ts +2 -0
  255. package/dist/{services → wirings/queue}/in-memory-queue-service.d.ts +9 -1
  256. package/dist/{services → wirings/queue}/in-memory-queue-service.js +9 -1
  257. package/dist/wirings/queue/index.d.ts +1 -0
  258. package/dist/wirings/queue/index.js +1 -0
  259. package/dist/wirings/queue/queue-identity.js +2 -14
  260. package/dist/wirings/queue/queue-runner.d.ts +37 -0
  261. package/dist/wirings/queue/queue-runner.js +37 -0
  262. package/dist/wirings/queue/queue.types.d.ts +35 -0
  263. package/dist/wirings/queue/register-queue-helper.d.ts +12 -0
  264. package/dist/wirings/queue/register-queue-helper.js +11 -0
  265. package/dist/wirings/queue/remote-queue-job.d.ts +11 -0
  266. package/dist/wirings/queue/remote-queue-job.js +41 -0
  267. package/dist/wirings/queue/validate-worker-config.d.ts +1 -0
  268. package/dist/wirings/role/role.types.d.ts +3 -0
  269. package/dist/wirings/rpc/rpc-runner.d.ts +24 -0
  270. package/dist/wirings/rpc/rpc-runner.js +37 -2
  271. package/dist/wirings/rpc/rpc-types.d.ts +2 -0
  272. package/dist/wirings/scheduler/index.d.ts +1 -0
  273. package/dist/wirings/scheduler/index.js +1 -0
  274. package/dist/wirings/scheduler/log-schedulers.d.ts +1 -0
  275. package/dist/wirings/scheduler/log-schedulers.js +1 -0
  276. package/dist/wirings/scheduler/remote-scheduled-job.d.ts +11 -0
  277. package/dist/wirings/scheduler/remote-scheduled-job.js +20 -0
  278. package/dist/wirings/scheduler/scheduler-runner.d.ts +29 -0
  279. package/dist/wirings/scheduler/scheduler-runner.js +28 -0
  280. package/dist/wirings/scheduler/scheduler.types.d.ts +3 -0
  281. package/dist/wirings/scope/scope.types.d.ts +5 -0
  282. package/dist/wirings/secret/index.d.ts +2 -2
  283. package/dist/wirings/secret/index.js +1 -1
  284. package/dist/wirings/secret/secret.types.d.ts +26 -1
  285. package/dist/wirings/secret/secret.types.js +1 -0
  286. package/dist/wirings/secret/validate-secret-definitions.d.ts +8 -0
  287. package/dist/wirings/secret/validate-secret-definitions.js +15 -0
  288. package/dist/wirings/trigger/in-memory-trigger-service.d.ts +11 -0
  289. package/dist/{services → wirings/trigger}/in-memory-trigger-service.js +10 -3
  290. package/dist/wirings/trigger/index.d.ts +1 -1
  291. package/dist/wirings/trigger/pikku-trigger-service.d.ts +8 -3
  292. package/dist/wirings/trigger/pikku-trigger-service.js +14 -3
  293. package/dist/wirings/trigger/trigger-runner.d.ts +27 -2
  294. package/dist/wirings/trigger/trigger-runner.js +35 -2
  295. package/dist/wirings/trigger/trigger.types.d.ts +26 -4
  296. package/dist/wirings/trigger/webhook-source-runner.d.ts +24 -0
  297. package/dist/wirings/trigger/webhook-source-runner.js +19 -0
  298. package/dist/wirings/trigger/webhook-source.types.d.ts +12 -2
  299. package/dist/wirings/trigger/webhook-source.types.js +1 -1
  300. package/dist/wirings/variable/validate-variable-definitions.d.ts +7 -0
  301. package/dist/wirings/variable/validate-variable-definitions.js +7 -0
  302. package/dist/wirings/variable/variable.types.d.ts +7 -0
  303. package/dist/wirings/virtual-user/conversation/conversation.types.d.ts +5 -0
  304. package/dist/wirings/virtual-user/conversation/run-conversation.d.ts +6 -0
  305. package/dist/wirings/virtual-user/conversation/run-conversation.js +1 -1
  306. package/dist/{services → wirings/virtual-user}/http-virtual-users.d.ts +4 -3
  307. package/dist/{services → wirings/virtual-user}/http-virtual-users.js +6 -6
  308. package/dist/wirings/virtual-user/index.d.ts +1 -1
  309. package/dist/wirings/virtual-user/index.js +1 -1
  310. package/dist/wirings/virtual-user/run-virtual-user.d.ts +2 -1
  311. package/dist/wirings/virtual-user/run-virtual-user.js +1 -14
  312. package/dist/wirings/virtual-user/virtual-user-declaration.types.d.ts +4 -0
  313. package/dist/wirings/virtual-user/virtual-user-scaffold.d.ts +10 -1
  314. package/dist/wirings/virtual-user/virtual-user-scaffold.js +5 -0
  315. package/dist/wirings/virtual-user/virtual-user-schedule.d.ts +5 -0
  316. package/dist/wirings/virtual-user/virtual-user-schedule.js +1 -0
  317. package/dist/wirings/virtual-user/virtual-user-target.d.ts +1 -0
  318. package/dist/wirings/webhook/define-outgoing-webhook.d.ts +20 -0
  319. package/dist/wirings/webhook/define-outgoing-webhook.js +9 -0
  320. package/dist/wirings/workflow/dsl/workflow-dsl.types.d.ts +8 -4
  321. package/dist/wirings/workflow/dsl/workflow-runner.d.ts +7 -0
  322. package/dist/wirings/workflow/dsl/workflow-runner.js +7 -0
  323. package/dist/wirings/workflow/feature.d.ts +12 -0
  324. package/dist/wirings/workflow/feature.js +12 -0
  325. package/dist/wirings/workflow/graph/graph-node.d.ts +5 -0
  326. package/dist/wirings/workflow/graph/graph-node.js +5 -0
  327. package/dist/wirings/workflow/graph/template.d.ts +6 -0
  328. package/dist/wirings/workflow/graph/template.js +5 -0
  329. package/dist/wirings/workflow/graph/wire-workflow-graph.d.ts +12 -0
  330. package/dist/wirings/workflow/graph/wire-workflow-graph.js +10 -0
  331. package/dist/wirings/workflow/graph/workflow-graph.types.d.ts +11 -0
  332. package/dist/wirings/workflow/graph/workflow-graph.types.js +1 -0
  333. package/dist/{services → wirings/workflow}/in-memory-workflow-service.d.ts +8 -3
  334. package/dist/{services → wirings/workflow}/in-memory-workflow-service.js +9 -4
  335. package/dist/wirings/workflow/pikku-scenario-service.d.ts +1 -1
  336. package/dist/wirings/workflow/pikku-scenario-service.js +2 -2
  337. package/dist/wirings/workflow/pikku-workflow-service.d.ts +1 -0
  338. package/dist/wirings/workflow/pikku-workflow-service.js +1 -0
  339. package/dist/wirings/workflow/run-timeline.d.ts +21 -0
  340. package/dist/wirings/workflow/run-timeline.js +15 -7
  341. package/dist/wirings/workflow/scenario-coverage.d.ts +1 -0
  342. package/dist/wirings/workflow/scenario-poll.d.ts +1 -0
  343. package/dist/wirings/workflow/scenario-prose.d.ts +6 -0
  344. package/dist/wirings/workflow/scenario-prose.js +6 -0
  345. package/dist/wirings/workflow/scenario-run.types.d.ts +3 -0
  346. package/dist/wirings/workflow/scenario-step.types.d.ts +1 -0
  347. package/dist/wirings/workflow/scenario-step.types.js +1 -0
  348. package/dist/wirings/workflow/scenario-surface.js +1 -13
  349. package/dist/wirings/workflow/scenario.types.d.ts +6 -0
  350. package/dist/wirings/workflow/workflow-approval-policy.d.ts +6 -0
  351. package/dist/wirings/workflow/workflow-approval-policy.js +6 -0
  352. package/dist/wirings/workflow/workflow-constants.d.ts +7 -1
  353. package/dist/wirings/workflow/workflow-constants.js +10 -1
  354. package/dist/wirings/workflow/workflow-errors.d.ts +13 -0
  355. package/dist/wirings/workflow/workflow-errors.js +13 -0
  356. package/dist/wirings/workflow/workflow-invocation-id.d.ts +4 -0
  357. package/dist/wirings/workflow/workflow-invocation-id.js +4 -0
  358. package/dist/wirings/workflow/workflow-queue-workers.d.ts +3 -0
  359. package/dist/wirings/workflow/workflow-run-ownership.d.ts +1 -0
  360. package/dist/wirings/workflow/workflow-run-ownership.js +1 -0
  361. package/dist/wirings/workflow/workflow-status-stream.d.ts +1 -0
  362. package/dist/wirings/workflow/workflow-unwind-plan.js +2 -7
  363. package/dist/wirings/workflow/workflow.types.d.ts +40 -0
  364. package/package.json +26 -9
  365. package/CHANGELOG.md +0 -6978
  366. package/dist/services/in-memory-trigger-service.d.ts +0 -4
  367. package/dist/services/local-gateway-service.d.ts +0 -6
  368. package/dist/utils/hash.d.ts +0 -2
  369. package/dist/utils/hash.js +0 -23
  370. package/knowledge/decisions/index.md +0 -19
  371. package/knowledge/decisions/internals/a-credential-name-declared-twice-must-agree-on-schema-and-type.md +0 -29
  372. package/knowledge/decisions/internals/a-grant-can-name-a-scope-declared-without-its-addon.md +0 -29
  373. package/knowledge/decisions/internals/a-held-run-is-woken-later-not-retried.md +0 -28
  374. package/knowledge/decisions/internals/a-latency-budget-is-asserted-by-its-cause.md +0 -32
  375. package/knowledge/decisions/internals/a-non-streaming-agent-run-registers-with-agentrunstate-too.md +0 -22
  376. package/knowledge/decisions/internals/a-reset-suite-makes-the-dev-seed-the-fixture.md +0 -50
  377. package/knowledge/decisions/internals/a-resumed-agent-turn-is-as-interruptible-as-the-first.md +0 -20
  378. package/knowledge/decisions/internals/a-scenario-step-template-is-offered-unfilled.md +0 -21
  379. package/knowledge/decisions/internals/a-scheduled-task-writes-its-caller-session-before-it-runs.md +0 -22
  380. package/knowledge/decisions/internals/a-secret-set-in-memory-shadows-the-variable-of-the-same-name.md +0 -28
  381. package/knowledge/decisions/internals/a-secret-that-fails-to-decrypt-fails-the-whole-read.md +0 -49
  382. package/knowledge/decisions/internals/a-virtual-user-acts-through-invokeraw-so-a-refusal-is-data.md +0 -32
  383. package/knowledge/decisions/internals/a-virtual-user-cadence-is-a-row-not-a-timer.md +0 -66
  384. package/knowledge/decisions/internals/a-virtual-user-converse-signs-in-before-its-first-turn.md +0 -24
  385. package/knowledge/decisions/internals/a-virtual-user-decides-whether-to-trust-memory-once-per-turn.md +0 -21
  386. package/knowledge/decisions/internals/a-virtual-user-email-is-computed-with-the-run-id-as-a-sub-address.md +0 -34
  387. package/knowledge/decisions/internals/a-virtual-user-run-is-not-a-workflow-but-it-needs-a-trigger.md +0 -65
  388. package/knowledge/decisions/internals/a-wall-clock-threshold-is-a-load-test-in-disguise.md +0 -49
  389. package/knowledge/decisions/internals/a-workflow-wire-is-built-from-the-run-not-from-the-rpc-service.md +0 -45
  390. package/knowledge/decisions/internals/addon-package-roots-resolve-by-walking-node-module-search-paths.md +0 -26
  391. package/knowledge/decisions/internals/addon-pikku-meta-ships-at-the-package-root-or-under-dist.md +0 -32
  392. package/knowledge/decisions/internals/addon-singleton-services-are-cached-per-namespace-not-per-package.md +0 -33
  393. package/knowledge/decisions/internals/addon-workflow-names-are-prefixed-with-the-consumer-namespace.md +0 -28
  394. package/knowledge/decisions/internals/agent-agui-bridge-obeys-the-client-ordering-contract.md +0 -29
  395. package/knowledge/decisions/internals/agent-audio-chunks-carry-the-format-the-provider-returned.md +0 -20
  396. package/knowledge/decisions/internals/agent-context-waits-for-a-tool-result-still-being-written.md +0 -21
  397. package/knowledge/decisions/internals/agent-credential-suspensions-hide-the-tool-result.md +0 -26
  398. package/knowledge/decisions/internals/agent-delegate-and-supervise-hide-different-text.md +0 -26
  399. package/knowledge/decisions/internals/agent-llm-tool-arguments-have-nulls-stripped.md +0 -23
  400. package/knowledge/decisions/internals/agent-model-config-stays-a-single-resolution-seam.md +0 -25
  401. package/knowledge/decisions/internals/agent-onerror-hooks-cannot-change-the-failure.md +0 -22
  402. package/knowledge/decisions/internals/agent-runner-methods-must-keep-their-receiver.md +0 -22
  403. package/knowledge/decisions/internals/agent-speech-travels-as-a-custom-agui-event.md +0 -22
  404. package/knowledge/decisions/internals/agent-stream-persistence-is-best-effort.md +0 -27
  405. package/knowledge/decisions/internals/agent-sub-agents-inherit-the-parent-context-block.md +0 -26
  406. package/knowledge/decisions/internals/agent-tool-execute-failures-are-logged-unconditionally.md +0 -25
  407. package/knowledge/decisions/internals/agent-voice-input-transcribes-audio-parts-in-place.md +0 -22
  408. package/knowledge/decisions/internals/agent-working-memory-is-persisted-only-when-valid.md +0 -25
  409. package/knowledge/decisions/internals/an-addon-scope-root-loses-to-a-root-the-host-already-declares.md +0 -39
  410. package/knowledge/decisions/internals/an-agent-interrupt-is-not-a-failure.md +0 -23
  411. package/knowledge/decisions/internals/an-agent-is-offered-under-its-registry-key-and-only-within-the-virtual-users-scopes.md +0 -27
  412. package/knowledge/decisions/internals/an-agent-run-owned-by-another-instance-says-so.md +0 -25
  413. package/knowledge/decisions/internals/an-agent-stream-send-must-return-the-inner-sends-promise.md +0 -22
  414. package/knowledge/decisions/internals/an-empty-text-part-is-omitted-from-an-agent-message.md +0 -20
  415. package/knowledge/decisions/internals/an-empty-transcript-is-not-recorded.md +0 -22
  416. package/knowledge/decisions/internals/an-oauth2-credential-implies-an-optional-app-secret.md +0 -26
  417. package/knowledge/decisions/internals/an-unref-d-timer-cannot-be-awaited-under-node-test.md +0 -66
  418. package/knowledge/decisions/internals/analytics-identity-resolvers-run-in-declared-order.md +0 -22
  419. package/knowledge/decisions/internals/channel-message-handlers-accept-three-config-shapes.md +0 -30
  420. package/knowledge/decisions/internals/channel-middleware-caches-only-statically-resolved-middleware.md +0 -31
  421. package/knowledge/decisions/internals/channel-state-accessors-are-unsound-generics-that-every-implementation-asserts.md +0 -33
  422. package/knowledge/decisions/internals/channel-state-is-per-socket-session-state-is-per-user.md +0 -29
  423. package/knowledge/decisions/internals/channel-user-id-is-persisted-after-onconnect-middleware-runs.md +0 -28
  424. package/knowledge/decisions/internals/cli-option-names-are-camelcase-in-state-and-kebab-on-the-command-line.md +0 -27
  425. package/knowledge/decisions/internals/cli-parse-errors-are-routed-by-message-prefix.md +0 -28
  426. package/knowledge/decisions/internals/cli-stdout-is-reserved-for-machine-readable-output.md +0 -34
  427. package/knowledge/decisions/internals/cli-unknown-long-options-warn-instead-of-failing.md +0 -29
  428. package/knowledge/decisions/internals/core-column-form-is-an-axis-of-its-own.md +0 -84
  429. package/knowledge/decisions/internals/core-data-classification-brand-is-an-optional-property.md +0 -41
  430. package/knowledge/decisions/internals/core-function-runner-restores-the-wire-fields-it-overwrites.md +0 -44
  431. package/knowledge/decisions/internals/core-hot-reload-merges-generated-meta-never-replaces-it.md +0 -39
  432. package/knowledge/decisions/internals/core-hot-reload-owns-its-module-registry.md +0 -42
  433. package/knowledge/decisions/internals/core-middleware-order-is-scope-then-priority.md +0 -39
  434. package/knowledge/decisions/internals/core-schema-defaults-apply-on-every-transport.md +0 -43
  435. package/knowledge/decisions/internals/core-scopes-are-an-and-gate-separate-from-permissions.md +0 -38
  436. package/knowledge/decisions/internals/core-state-is-a-global-map-written-only-at-registration-time.md +0 -44
  437. package/knowledge/decisions/internals/email-meta-is-read-uncached-because-codegen-rewrites-it-mid-session.md +0 -27
  438. package/knowledge/decisions/internals/feature-flag-declarations-refuse-an-empty-anyof-and-conflicting-scopes.md +0 -22
  439. package/knowledge/decisions/internals/feature-flags-fail-open-and-never-enforce-access.md +0 -28
  440. package/knowledge/decisions/internals/flag-sync-rewrites-only-the-declared-text.md +0 -24
  441. package/knowledge/decisions/internals/gateway-adapters-resolve-lazily-and-are-promise-cached.md +0 -32
  442. package/knowledge/decisions/internals/gateway-listener-middleware-runs-without-an-rpc-on-the-wire.md +0 -43
  443. package/knowledge/decisions/internals/gateway-webhook-challenges-echo-bytes-not-json.md +0 -28
  444. package/knowledge/decisions/internals/gateway-wiring-is-a-meta-wiring-over-http-and-channels.md +0 -31
  445. package/knowledge/decisions/internals/generated-src-paths-in-pikku-meta-are-absolute.md +0 -26
  446. package/knowledge/decisions/internals/global-middleware-resolves-from-the-root-namespace-too.md +0 -32
  447. package/knowledge/decisions/internals/hot-reload-reads-the-changed-source-never-a-compiled-copy.md +0 -38
  448. package/knowledge/decisions/internals/hot-reload-writes-into-the-function-map-captured-at-startup.md +0 -26
  449. package/knowledge/decisions/internals/http-request-bodies-are-read-once-and-shared.md +0 -32
  450. package/knowledge/decisions/internals/http-route-groups-cascade-config-in-a-fixed-order.md +0 -28
  451. package/knowledge/decisions/internals/http-router-matches-normalized-paths-but-returns-registered-ones.md +0 -30
  452. package/knowledge/decisions/internals/http-runner-logs-through-a-trace-scoped-logger-functions-do-not.md +0 -26
  453. package/knowledge/decisions/internals/http-set-cookie-headers-are-appended-never-joined.md +0 -28
  454. package/knowledge/decisions/internals/http-sse-streams-flush-headers-only-after-middleware.md +0 -32
  455. package/knowledge/decisions/internals/http-wiring-without-metadata-is-skipped-not-fatal.md +0 -26
  456. package/knowledge/decisions/internals/in-a-scenario-a-4xx-is-data-not-an-exception.md +0 -25
  457. package/knowledge/decisions/internals/in-memory-workflow-history-aliases-the-live-step-object.md +0 -26
  458. package/knowledge/decisions/internals/index.md +0 -182
  459. package/knowledge/decisions/internals/istanbul-statement-counts-attach-to-the-start-line-only.md +0 -25
  460. package/knowledge/decisions/internals/local-trigger-and-gateway-services-assume-a-single-process.md +0 -26
  461. package/knowledge/decisions/internals/mcp-wire-names-are-assigned-over-the-whole-registry.md +0 -39
  462. package/knowledge/decisions/internals/node-only-builtins-are-imported-dynamically.md +0 -24
  463. package/knowledge/decisions/internals/one-project-shape-check-two-validators.md +0 -53
  464. package/knowledge/decisions/internals/only-exposed-functions-enter-a-virtual-user-catalogue.md +0 -21
  465. package/knowledge/decisions/internals/queue-group-concurrency-keeps-one-shared-queue-fair.md +0 -28
  466. package/knowledge/decisions/internals/queue-jobs-always-carry-an-explicit-attempts-count.md +0 -27
  467. package/knowledge/decisions/internals/remote-addons-dispatch-over-http-instead-of-local-meta.md +0 -31
  468. package/knowledge/decisions/internals/role-names-cannot-contain-the-scope-separator.md +0 -30
  469. package/knowledge/decisions/internals/rpc-names-resolve-through-package-scope-before-root.md +0 -32
  470. package/knowledge/decisions/internals/scenario-agent-calls-sign-in-on-401-only.md +0 -31
  471. package/knowledge/decisions/internals/scenario-given-and-when-are-sugar-but-then-is-not.md +0 -24
  472. package/knowledge/decisions/internals/scenario-meta-lives-apart-from-app-meta-but-merges-when-read-off-disk.md +0 -26
  473. package/knowledge/decisions/internals/scenario-steps-return-drained-response-records.md +0 -27
  474. package/knowledge/decisions/internals/scenarios-live-in-files-named-for-them.md +0 -48
  475. package/knowledge/decisions/internals/scope-roots-may-be-co-declared-by-an-addon-and-its-host-app.md +0 -30
  476. package/knowledge/decisions/internals/serverless-channel-disconnect-must-tolerate-a-missing-channel.md +0 -28
  477. package/knowledge/decisions/internals/side-effects-are-an-allowlist-not-a-boolean.md +0 -34
  478. package/knowledge/decisions/internals/speech-synthesis-picks-a-voice-per-sentence-and-warns-once.md +0 -24
  479. package/knowledge/decisions/internals/the-agent-done-event-goes-through-the-middleware-and-is-awaited.md +0 -26
  480. package/knowledge/decisions/internals/the-api-report-pins-members-not-just-names.md +0 -43
  481. package/knowledge/decisions/internals/the-core-scope-validator-refuses-separator-wildcard-and-empty-segments.md +0 -22
  482. package/knowledge/decisions/internals/the-dev-queue-copies-prod-timing-and-serialization-semantics.md +0 -30
  483. package/knowledge/decisions/internals/the-ecosystem-entry-point-carries-the-adapter-surface.md +0 -83
  484. package/knowledge/decisions/internals/the-embedding-model-is-pinned-per-service-and-doc-query-embedding-is-split.md +0 -29
  485. package/knowledge/decisions/internals/the-in-memory-workflow-service-is-inline-only-and-single-process.md +0 -27
  486. package/knowledge/decisions/internals/the-kek-salt-is-scoped-to-the-key-version.md +0 -40
  487. package/knowledge/decisions/internals/the-mcp-handshake-is-challenged-only-when-every-target-is-gated.md +0 -29
  488. package/knowledge/decisions/internals/the-middleware-resolution-cache-is-deliberately-unbounded.md +0 -40
  489. package/knowledge/decisions/internals/the-per-invocation-rpc-view-is-a-class.md +0 -40
  490. package/knowledge/decisions/internals/the-pikku-user-id-resolves-in-a-fixed-order.md +0 -24
  491. package/knowledge/decisions/internals/the-runner-resolves-wire-services-itself.md +0 -31
  492. package/knowledge/decisions/internals/the-schema-service-is-never-stubbed.md +0 -26
  493. package/knowledge/decisions/internals/the-transcript-event-is-sent-ahead-of-the-run.md +0 -25
  494. package/knowledge/decisions/internals/the-virtual-user-catalogue-is-the-only-gate-on-what-may-be-called.md +0 -21
  495. package/knowledge/decisions/internals/the-virtual-user-prompt-says-json-because-of-json-object-mode.md +0 -22
  496. package/knowledge/decisions/internals/the-virtual-user-runtime-is-exported-from-the-virtual-user-entry-point.md +0 -28
  497. package/knowledge/decisions/internals/the-worker-disposition-is-the-one-that-is-not-testing.md +0 -22
  498. package/knowledge/decisions/internals/thread-history-records-the-transcript-not-the-audio.md +0 -25
  499. package/knowledge/decisions/internals/trigger-declaration-is-split-from-trigger-source.md +0 -33
  500. package/knowledge/decisions/internals/typed-secret-service-caches-for-the-process-lifetime.md +0 -26
  501. package/knowledge/decisions/internals/validate-checks-virtual-users-through-a-shared-module.md +0 -43
  502. package/knowledge/decisions/internals/validate-runs-checks-by-precondition.md +0 -115
  503. package/knowledge/decisions/internals/virtual-user-conversation-drives-the-target-through-a-transport-seam.md +0 -24
  504. package/knowledge/decisions/internals/virtual-user-conversation-verdicts-are-llm-self-evaluations.md +0 -25
  505. package/knowledge/decisions/internals/virtual-user-conversations-seed-a-hidden-kickoff-message.md +0 -23
  506. package/knowledge/decisions/internals/virtual-user-step-order-comes-from-insertion-order.md +0 -21
  507. package/knowledge/decisions/internals/virtual-users-are-declared-in-one-definevirtualusers-call-per-codebase.md +0 -30
  508. package/knowledge/decisions/internals/voice-output-speaks-unless-voice-input-explicitly-says-otherwise.md +0 -24
  509. package/knowledge/decisions/internals/webhook-delivery-history-records-every-attempt-best-effort.md +0 -26
  510. package/knowledge/decisions/internals/webhook-service-collaborators-are-constructor-args-not-locator-lookups.md +0 -25
  511. package/knowledge/decisions/internals/whether-a-run-is-inline-is-read-from-the-run-record.md +0 -58
  512. package/knowledge/decisions/internals/wiring-registries-erase-the-generics-their-wire-functions-capture.md +0 -35
  513. package/knowledge/decisions/internals/workflow-approval-expiry-is-decided-from-a-recorded-deadline.md +0 -34
  514. package/knowledge/decisions/internals/workflow-core-never-imports-a-browser-driver.md +0 -42
  515. package/knowledge/decisions/internals/workflow-dsl-meta-separates-runtime-expressions-from-literals.md +0 -38
  516. package/knowledge/decisions/internals/workflow-features-resolve-scenarios-by-object-identity.md +0 -29
  517. package/knowledge/decisions/internals/workflow-graph-inline-and-queued-runs-share-one-planner.md +0 -42
  518. package/knowledge/decisions/internals/workflow-graph-node-notes-are-excluded-from-the-graph-hash.md +0 -25
  519. package/knowledge/decisions/internals/workflow-inline-runs-report-their-run-id-before-they-can-fail.md +0 -29
  520. package/knowledge/decisions/internals/workflow-invocation-id-is-the-dedupe-key-not-step-id.md +0 -43
  521. package/knowledge/decisions/internals/workflow-queued-step-dispatch-requires-an-explicit-opt-in.md +0 -29
  522. package/knowledge/decisions/internals/workflow-queues-are-per-workflow-by-default.md +0 -42
  523. package/knowledge/decisions/internals/workflow-repeated-step-names-get-an-ordinal-suffix.md +0 -33
  524. package/knowledge/decisions/internals/workflow-replay-reads-its-steps-once-and-caches-only-the-immutable-half.md +0 -32
  525. package/knowledge/decisions/internals/workflow-retries-are-owned-by-the-workflow-not-the-queue.md +0 -31
  526. package/knowledge/decisions/internals/workflow-run-capabilities-are-extensions-not-subclasses.md +0 -39
  527. package/knowledge/decisions/internals/workflow-run-mirror-is-never-a-source-of-truth.md +0 -29
  528. package/knowledge/decisions/internals/workflow-run-polling-backs-off-to-the-callers-ceiling.md +0 -33
  529. package/knowledge/decisions/internals/workflow-run-timeline-is-a-pure-fold-over-durable-history.md +0 -37
  530. package/knowledge/decisions/internals/workflow-scenario-assertions-never-retry-and-record-one-step.md +0 -54
  531. package/knowledge/decisions/internals/workflow-scenario-hooks-are-a-scenario-only-affordance.md +0 -43
  532. package/knowledge/decisions/internals/workflow-scenario-prose-is-rendered-from-typed-calls-not-parsed-from-english.md +0 -32
  533. package/knowledge/decisions/internals/workflow-scenario-quarantine-reason-lives-in-code.md +0 -18
  534. package/knowledge/decisions/internals/workflow-scenario-step-targets-are-string-literals-for-the-inspector.md +0 -34
  535. package/knowledge/decisions/internals/workflow-step-compensation-runs-as-its-own-durable-step.md +0 -29
  536. package/knowledge/decisions/internals/workflow-step-dispatch-failure-is-transient-not-a-run-failure.md +0 -33
  537. package/knowledge/decisions/internals/workflow-step-lock-is-held-only-to-claim-the-step.md +0 -34
  538. package/knowledge/decisions/internals/workflow-step-rpc-name-is-provenance-only.md +0 -34
  539. package/knowledge/decisions/internals/workflow-suspend-and-approval-reasons-are-durable-step-identities.md +0 -38
  540. package/knowledge/decisions/internals/workflow-suspended-runs-keep-their-in-process-context.md +0 -30
  541. package/knowledge/decisions/security/a-bearer-token-checked-against-a-secret-reads-it-per-request.md +0 -26
  542. package/knowledge/decisions/security/a-call-without-a-session-raises-missing-session-not-forbidden.md +0 -20
  543. package/knowledge/decisions/security/a-caller-cookie-wins-over-the-jar-for-the-same-name.md +0 -23
  544. package/knowledge/decisions/security/a-channel-lifecycle-acts-as-the-socket-upgrade-session.md +0 -16
  545. package/knowledge/decisions/security/a-channel-requires-a-session-unless-it-says-auth-false.md +0 -26
  546. package/knowledge/decisions/security/a-credential-read-path-follows-its-declared-type-not-absence.md +0 -32
  547. package/knowledge/decisions/security/a-credential-type-is-a-literal-the-inspector-checks-at-declaration.md +0 -27
  548. package/knowledge/decisions/security/a-dropped-audit-write-is-always-logged.md +0 -28
  549. package/knowledge/decisions/security/a-first-party-cookie-is-written-only-after-its-purposes-consent.md +0 -33
  550. package/knowledge/decisions/security/a-function-never-receives-the-secret-service.md +0 -37
  551. package/knowledge/decisions/security/a-graph-run-starts-at-an-entry-node-the-graph-declared.md +0 -33
  552. package/knowledge/decisions/security/a-permission-gets-a-wire-it-cannot-reply-on.md +0 -33
  553. package/knowledge/decisions/security/a-public-function-says-so-with-auth-false.md +0 -34
  554. package/knowledge/decisions/security/a-readonly-session-reaches-only-readonly-functions.md +0 -25
  555. package/knowledge/decisions/security/a-scaffold-flag-says-a-surface-exists-not-who-may-call-it.md +0 -52
  556. package/knowledge/decisions/security/a-scheduled-virtual-user-run-needs-no-admin-at-run-time.md +0 -27
  557. package/knowledge/decisions/security/a-scoped-credential-view-is-limited-to-declared-names.md +0 -26
  558. package/knowledge/decisions/security/a-scoped-secret-view-reads-only-declared-keys-and-never-writes.md +0 -25
  559. package/knowledge/decisions/security/a-secret-is-sent-only-to-the-hosts-it-declares.md +0 -29
  560. package/knowledge/decisions/security/a-step-can-name-an-identity-no-virtual-user-holds-through-per-call-headers.md +0 -25
  561. package/knowledge/decisions/security/a-step-runs-the-function-the-workflow-dispatched-it-with.md +0 -37
  562. package/knowledge/decisions/security/a-stopped-run-by-id-skips-the-ownership-check.md +0 -24
  563. package/knowledge/decisions/security/a-vault-secret-redacts-on-serialization-and-throws-on-coercion.md +0 -29
  564. package/knowledge/decisions/security/a-virtual-user-catalogue-entry-is-filtered-by-scope-and-approval-is-denied-by-default.md +0 -30
  565. package/knowledge/decisions/security/a-virtual-user-environment-fails-closed.md +0 -38
  566. package/knowledge/decisions/security/a-virtual-user-is-never-offered-a-step-that-would-forge-its-own-oracle.md +0 -27
  567. package/knowledge/decisions/security/a-virtual-user-never-runs-against-production.md +0 -23
  568. package/knowledge/decisions/security/a-virtual-user-reads-its-roles-from-the-apps-own-rpc-before-better-auth.md +0 -27
  569. package/knowledge/decisions/security/a-virtual-user-run-treats-an-unresolved-environment-as-production.md +0 -41
  570. package/knowledge/decisions/security/a-virtual-user-scopes-are-expanded-from-its-roles-once-at-run-preparation.md +0 -25
  571. package/knowledge/decisions/security/a-virtual-user-whose-roles-drift-from-the-declaration-refuses-to-run.md +0 -32
  572. package/knowledge/decisions/security/a-workflow-run-is-read-and-approved-by-its-owner.md +0 -50
  573. package/knowledge/decisions/security/addon-auth-and-tags-only-tighten.md +0 -43
  574. package/knowledge/decisions/security/addon-config-gates-apply-only-at-the-namespaced-rpc-boundary.md +0 -52
  575. package/knowledge/decisions/security/addon-scopes-are-resolved-where-the-function-runs.md +0 -46
  576. package/knowledge/decisions/security/addon-screen-scopes-hide-and-do-not-enforce.md +0 -20
  577. package/knowledge/decisions/security/agent-approval-forwarding-requires-a-symbol-brand.md +0 -27
  578. package/knowledge/decisions/security/agent-credential-requests-are-symbol-branded.md +0 -37
  579. package/knowledge/decisions/security/agent-gate-requires-a-session-only-when-auth-is-true.md +0 -31
  580. package/knowledge/decisions/security/agent-ownership-failures-never-echo-the-resource.md +0 -23
  581. package/knowledge/decisions/security/agent-resume-re-runs-the-authorization-gate.md +0 -22
  582. package/knowledge/decisions/security/agent-sessionless-deployments-have-no-thread-ownership.md +0 -39
  583. package/knowledge/decisions/security/agent-thread-ownership-composes-the-session-principal.md +0 -30
  584. package/knowledge/decisions/security/agent-tool-filtering-reads-the-live-function-config.md +0 -24
  585. package/knowledge/decisions/security/an-addon-header-can-only-narrow-the-session.md +0 -26
  586. package/knowledge/decisions/security/an-addon-instance-reads-only-the-secrets-and-credentials-it-is-named.md +0 -33
  587. package/knowledge/decisions/security/an-addon-may-reach-only-itself-and-the-addons-it-uses.md +0 -16
  588. package/knowledge/decisions/security/an-agent-approval-is-claimed-before-the-tool-runs.md +0 -33
  589. package/knowledge/decisions/security/an-api-key-is-jwt-decoded-into-the-session.md +0 -26
  590. package/knowledge/decisions/security/an-approval-answer-outlives-the-run-it-answered.md +0 -59
  591. package/knowledge/decisions/security/an-empty-owners-constraint-matches-nothing.md +0 -30
  592. package/knowledge/decisions/security/an-exposed-ungated-function-is-a-codegen-warning.md +0 -52
  593. package/knowledge/decisions/security/an-external-virtual-user-caller-presents-one-signed-statement.md +0 -38
  594. package/knowledge/decisions/security/an-inbound-webhook-source-dispatches-only-verified-requests.md +0 -31
  595. package/knowledge/decisions/security/an-mcp-call-with-no-http-request-stays-anonymous.md +0 -18
  596. package/knowledge/decisions/security/an-mcp-refusal-is-decided-before-dispatch.md +0 -48
  597. package/knowledge/decisions/security/an-oauth2-credential-is-read-by-its-account-row.md +0 -40
  598. package/knowledge/decisions/security/an-omitted-user-id-addresses-the-platform-credential.md +0 -32
  599. package/knowledge/decisions/security/an-upload-is-counted-as-it-arrives-not-buffered-then-measured.md +0 -24
  600. package/knowledge/decisions/security/analytics-identity-is-stamped-from-the-session-not-the-event.md +0 -24
  601. package/knowledge/decisions/security/app-access-is-a-scope-tree-synthesised-from-virtual-users.md +0 -26
  602. package/knowledge/decisions/security/approval-policy-decides-who-answers-a-tool-call.md +0 -27
  603. package/knowledge/decisions/security/auth-false-on-a-session-function-warns-and-still-requires-one.md +0 -25
  604. package/knowledge/decisions/security/bearer-token-hashes-are-unpeppered-sha256.md +0 -18
  605. package/knowledge/decisions/security/consent-is-read-from-a-cookie-and-a-recognised-denial-counts-as-refusal.md +0 -29
  606. package/knowledge/decisions/security/console-addon-privileged-functions-gate-themselves.md +0 -84
  607. package/knowledge/decisions/security/core-safe-fetch-blocks-ssrf-by-host-literal-not-dns.md +0 -39
  608. package/knowledge/decisions/security/core-secrets-use-a-per-secret-dek-wrapped-by-a-kek.md +0 -37
  609. package/knowledge/decisions/security/cors-defaults-to-any-origin-and-refuses-the-wildcard-with-credentials.md +0 -22
  610. package/knowledge/decisions/security/credential-backends-share-one-conformance-suite-for-per-user-isolation.md +0 -29
  611. package/knowledge/decisions/security/each-stage-has-one-virtual-user-key-pair.md +0 -27
  612. package/knowledge/decisions/security/gateway-handlers-run-through-the-function-runner-gate.md +0 -41
  613. package/knowledge/decisions/security/gateway-middleware-sessions-must-be-bridged-onto-the-wire.md +0 -30
  614. package/knowledge/decisions/security/global-permissions-and-function-permissions-are-independent-gates.md +0 -40
  615. package/knowledge/decisions/security/hmac-verification-fails-closed-on-empty-inputs.md +0 -25
  616. package/knowledge/decisions/security/http-error-detail-is-withheld-from-clients-in-production.md +0 -33
  617. package/knowledge/decisions/security/http-request-bodies-are-bounded-before-they-are-buffered.md +0 -46
  618. package/knowledge/decisions/security/index.md +0 -135
  619. package/knowledge/decisions/security/local-content-refuses-private-buckets-under-the-public-segment.md +0 -21
  620. package/knowledge/decisions/security/mail-is-allowlisted-before-a-virtual-user-run-sees-it.md +0 -38
  621. package/knowledge/decisions/security/mcp-internal-error-details-are-double-gated-on-production.md +0 -27
  622. package/knowledge/decisions/security/mcp-resources-tools-and-prompts-take-sessionless-functions.md +0 -18
  623. package/knowledge/decisions/security/origin-locked-routes-match-the-origin-exactly.md +0 -22
  624. package/knowledge/decisions/security/oss-auth-works-without-pikku-studio-cloud.md +0 -26
  625. package/knowledge/decisions/security/outbound-webhooks-use-an-allowlist-when-configured.md +0 -24
  626. package/knowledge/decisions/security/passphrases-are-stretched-key-material-is-expanded.md +0 -40
  627. package/knowledge/decisions/security/permission-auth-filtering-requires-live-permission-functions.md +0 -31
  628. package/knowledge/decisions/security/pikku-carries-virtual-user-scopes-as-data-and-the-app-grants-them.md +0 -35
  629. package/knowledge/decisions/security/queue-job-identities-are-signed-at-enqueue.md +0 -69
  630. package/knowledge/decisions/security/queue-jobs-carry-the-producers-pikku-user-id.md +0 -39
  631. package/knowledge/decisions/security/remote-addon-tokens-are-client-credentials-not-mesh-trust.md +0 -34
  632. package/knowledge/decisions/security/scaffold-features-are-authenticated-unless-opted-out.md +0 -55
  633. package/knowledge/decisions/security/scenario-step-functions-are-never-externally-invocable.md +0 -30
  634. package/knowledge/decisions/security/scope-resolution-happens-at-the-session-boundary-and-sync-never-deletes.md +0 -28
  635. package/knowledge/decisions/security/scoped-content-access-is-a-root-folder-with-longest-prefix-grants.md +0 -31
  636. package/knowledge/decisions/security/self-authentication-is-declared-not-detected.md +0 -34
  637. package/knowledge/decisions/security/services-without-secrets-get-a-throwing-secrets-accessor.md +0 -22
  638. package/knowledge/decisions/security/shared-guards-refuse-to-mutate-or-shadow-a-system-role.md +0 -34
  639. package/knowledge/decisions/security/signed-content-urls-bind-the-request-path.md +0 -37
  640. package/knowledge/decisions/security/signed-uploads-are-verified-by-the-same-check-as-signed-reads.md +0 -26
  641. package/knowledge/decisions/security/system-role-scopes-must-be-declared-with-define-scope.md +0 -24
  642. package/knowledge/decisions/security/system-roles-are-additive-and-immutable.md +0 -16
  643. package/knowledge/decisions/security/the-channel-rpc-does-not-send-the-callers-session.md +0 -21
  644. package/knowledge/decisions/security/the-remote-jobs-inbox-fails-closed-without-a-secret.md +0 -24
  645. package/knowledge/decisions/security/the-remote-rpc-gate-fails-closed-and-binds-the-token-to-its-function.md +0 -34
  646. package/knowledge/decisions/security/the-workflow-status-stream-rechecks-ownership-on-every-poll.md +0 -16
  647. package/knowledge/decisions/security/two-credentials-on-one-key-must-share-a-read-mode.md +0 -29
  648. package/knowledge/decisions/security/verified-bearer-claims-are-pass-through-data-that-core-never-fills.md +0 -23
  649. package/knowledge/decisions/security/virtual-user-catalogue-excludes-the-machinery-that-runs-virtual-users.md +0 -25
  650. package/knowledge/decisions/security/virtual-user-conversation-missing-approval-decisions-default-to-denied.md +0 -22
  651. package/knowledge/decisions/security/virtual-user-run-records-are-gated-behind-a-read-scope.md +0 -18
  652. package/knowledge/decisions/security/virtual-user-sign-in-does-not-exist-in-production.md +0 -25
  653. package/knowledge/decisions/security/virtual-user-sign-in-has-one-door.md +0 -42
  654. package/knowledge/decisions/security/virtual-user-sign-in-is-proven-by-set-cookie-not-a-non-empty-jar.md +0 -29
  655. package/knowledge/decisions/security/virtual-user-sign-in-only-works-for-virtual-user-flagged-users.md +0 -29
  656. package/knowledge/decisions/security/webhook-bodies-are-signed-before-they-are-enqueued.md +0 -25
  657. package/knowledge/decisions/security/wire-addon-expose-selects-the-rpc-surface.md +0 -51
  658. package/knowledge/decisions/security/workflow-approval-payloads-are-validated-on-replay-inside-the-workflow.md +0 -40
  659. package/knowledge/decisions/security/workflow-helper-functions-are-sessionless-by-declaration.md +0 -18
  660. package/knowledge/decisions/security/workflow-queued-steps-rehydrate-their-session-from-the-run-wire.md +0 -32
  661. package/knowledge/decisions/security/workflow-scenario-sessions-are-isolated-per-virtual-user-and-per-scenario.md +0 -32
  662. package/knowledge/decisions/security/workflow-scenario-steps-are-never-network-invocable.md +0 -31
  663. package/knowledge/decisions/security/workflow-virtual-user-steps-always-use-the-real-transport.md +0 -34
  664. package/knowledge/decisions/security/writing-a-virtual-user-schedule-is-gated-by-its-own-scope.md +0 -18
  665. package/knowledge/index.md +0 -24
  666. package/knowledge/questions/a-bearer-jwt-with-no-identity-becomes-a-session.md +0 -24
  667. package/knowledge/questions/channel-middleware-accepts-bare-factories-that-nothing-resolves.md +0 -35
  668. package/knowledge/questions/dev-quick-login-as-impersonation.md +0 -25
  669. package/knowledge/questions/does-a-delayed-rpc-run-as-the-session-it-was-scheduled-with.md +0 -26
  670. package/knowledge/questions/does-a-user-id-with-a-colon-read-another-users-credentials.md +0 -27
  671. package/knowledge/questions/does-a-wirecli-command-need-a-session-by-default.md +0 -26
  672. package/knowledge/questions/does-an-adversarial-in-scope-success-count-as-a-finding.md +0 -26
  673. package/knowledge/questions/does-approve-step-need-the-run-owners-session-or-the-gates-approvers.md +0 -34
  674. package/knowledge/questions/does-cors-origin-true-reflect-any-origin-with-credentials.md +0 -20
  675. package/knowledge/questions/does-skip-user-session-do-anything-on-a-channel.md +0 -24
  676. package/knowledge/questions/does-the-store-session-match-the-other-two.md +0 -19
  677. package/knowledge/questions/index.md +0 -41
  678. package/knowledge/questions/is-the-agent-score-worker-reachable-without-a-session.md +0 -21
  679. package/knowledge/questions/live-scheduled-tests-may-write.md +0 -19
  680. package/knowledge/questions/provision-virtual-users-has-no-caller-in-this-repo.md +0 -23
  681. package/knowledge/questions/remote-secret-refuses-requests-without-a-remote-token-on-every-path.md +0 -32
  682. package/knowledge/questions/should-a-middleware-set-session-persist-to-the-store.md +0 -25
  683. package/knowledge/questions/should-a-scoped-secret-view-throw-from-has-secret-for-a-disallowed-key.md +0 -23
  684. package/knowledge/questions/should-a-wrong-bearer-token-be-anonymous-or-refused.md +0 -35
  685. package/knowledge/questions/should-an-empty-webhook-signing-secret-send-unsigned.md +0 -23
  686. package/knowledge/questions/should-http-virtual-user-sessions-reset-between-scenarios-in-one-run.md +0 -27
  687. package/knowledge/questions/should-the-cookie-jar-scope-cookies-to-the-api-origin.md +0 -26
  688. package/knowledge/questions/should-voice-input-fetch-audio-urls-without-a-host-allowlist.md +0 -20
  689. package/knowledge/questions/staging-impersonation-rules.md +0 -27
  690. package/knowledge/questions/unauthorized-channel-replies-escape-the-declared-out-type.md +0 -44
  691. package/knowledge/questions/virtual-user-keys-on-cloud-stages-are-pikku-studios-to-build.md +0 -33
  692. package/knowledge/questions/virtual-user-statement-replay-is-per-process.md +0 -20
  693. package/knowledge/questions/what-an-impersonated-session-carries.md +0 -22
  694. package/run-tests.sh +0 -68
  695. package/scripts/generate-api-report.d.mts +0 -1
  696. package/scripts/generate-api-report.mjs +0 -96
  697. package/scripts/generate-api-report.mts +0 -333
  698. package/src/public-surface.json +0 -637
  699. package/src/public-surface.json.README +0 -43
  700. /package/dist/{function/compensation-name.d.ts → compensation-name.d.ts} +0 -0
  701. /package/dist/{function/compensation-name.js → compensation-name.js} +0 -0
@@ -1,4 +1,4 @@
1
- import { isCompensationStepName } from './workflow-constants.js';
1
+ import { isCompensationStepName, STEP_IN_FLIGHT_STATES, } from './workflow-constants.js';
2
2
  const LIFECYCLE_ORDER = {
3
3
  pending: 0,
4
4
  scheduled: 1,
@@ -6,6 +6,11 @@ const LIFECYCLE_ORDER = {
6
6
  succeeded: 3,
7
7
  failed: 3,
8
8
  };
9
+ /**
10
+ * Flattens a run's step history into a {@link RunTimeline}: one event per
11
+ * recorded transition, ordered by timestamp, then lifecycle order, then history
12
+ * order, and numbered with `seq`.
13
+ */
9
14
  export function buildRunTimeline(history) {
10
15
  const raw = [];
11
16
  history.forEach((entry, order) => {
@@ -57,11 +62,13 @@ export function buildRunTimeline(history) {
57
62
  });
58
63
  return raw.map(({ order: _order, ...event }, seq) => ({ ...event, seq }));
59
64
  }
60
- const IN_FLIGHT = new Set([
61
- 'pending',
62
- 'scheduled',
63
- 'running',
64
- ]);
65
+ /**
66
+ * Replays a timeline up to a point, for stepping through a run after the fact.
67
+ *
68
+ * @param timeline - The run's timeline, from {@link buildRunTimeline}.
69
+ * @param at - The last event to apply, by `seq`, or every event up to a time.
70
+ * @returns The run as it stood at that point.
71
+ */
65
72
  export function reconstructStateAt(timeline, at) {
66
73
  const cutoff = (event) => typeof at === 'number'
67
74
  ? event.seq <= at
@@ -120,13 +127,14 @@ export function reconstructStateAt(timeline, at) {
120
127
  phase: derivePhase(orderedSteps),
121
128
  };
122
129
  }
130
+ /** The run as its whole timeline leaves it. */
123
131
  export function reconstructFinalState(timeline) {
124
132
  return reconstructStateAt(timeline, timeline.length - 1);
125
133
  }
126
134
  function derivePhase(steps) {
127
135
  if (steps.length === 0)
128
136
  return 'pending';
129
- if (steps.some((s) => IN_FLIGHT.has(s.status)))
137
+ if (steps.some((s) => STEP_IN_FLIGHT_STATES.has(s.status)))
130
138
  return 'running';
131
139
  if (steps.some((s) => s.status === 'failed'))
132
140
  return 'failed';
@@ -33,6 +33,7 @@ export interface UncoveredMutation {
33
33
  id: string;
34
34
  sourceFile?: string;
35
35
  }
36
+ /** How much of the app the scenario suite exercises: API lines, user mutations and routes. */
36
37
  export interface ScenarioCoverage {
37
38
  /** Line coverage across every scenario; `null` until a run with `--coverage` has been recorded. */
38
39
  api: {
@@ -1,3 +1,4 @@
1
+ /** How long `pollUntil` keeps trying (default 15s) and how often (default 250ms). */
1
2
  export interface PollOptions {
2
3
  timeoutMs?: number;
3
4
  intervalMs?: number;
@@ -1,5 +1,11 @@
1
1
  import type { ScenarioStepPhase } from './scenario-step.types.js';
2
+ /**
3
+ * Fills a step template's `{key}` placeholders from its input, collapsing whitespace. Missing values render as empty.
4
+ */
2
5
  export declare const renderStepTemplate: (template: string, input: unknown) => string;
6
+ /**
7
+ * Renders one scenario step as a Gherkin-style sentence — keyword, virtual user, then the step text.
8
+ */
3
9
  export declare const composeStepProse: ({ phase, description, template, input, virtualUser, virtualUserRole, continuesPhase, continuesVirtualUser, keywordWidth, }: {
4
10
  phase: ScenarioStepPhase;
5
11
  description: string;
@@ -1,3 +1,6 @@
1
+ /**
2
+ * Fills a step template's `{key}` placeholders from its input, collapsing whitespace. Missing values render as empty.
3
+ */
1
4
  export const renderStepTemplate = (template, input) => {
2
5
  const values = input && typeof input === 'object' ? input : {};
3
6
  return template
@@ -14,6 +17,9 @@ const formatValue = (value) => {
14
17
  }
15
18
  return String(value);
16
19
  };
20
+ /**
21
+ * Renders one scenario step as a Gherkin-style sentence — keyword, virtual user, then the step text.
22
+ */
17
23
  export const composeStepProse = ({ phase, description, template, input, virtualUser, virtualUserRole, continuesPhase, continuesVirtualUser, keywordWidth, }) => {
18
24
  const keyword = capitalise(continuesPhase ? 'and' : phase);
19
25
  // The virtual user key is the subject verbatim, with no article in front of it.
@@ -93,6 +93,7 @@ export interface ScenarioFailureDetail {
93
93
  expected?: boolean;
94
94
  browser?: ScenarioBrowserFailure[];
95
95
  }
96
+ /** The outcome of one scenario in a run. */
96
97
  export interface ScenarioResult {
97
98
  name: string;
98
99
  /**
@@ -136,6 +137,7 @@ export interface ScenarioSkip {
136
137
  name: string;
137
138
  reason: string;
138
139
  }
140
+ /** Everything one scenario run produced, scenario by scenario. */
139
141
  export interface ScenarioRunReport {
140
142
  environment: string;
141
143
  results: ScenarioResult[];
@@ -149,6 +151,7 @@ export interface ScenarioRunReport {
149
151
  /** Feature-level hook failures, which belong to no single scenario. */
150
152
  hookFailures: string[];
151
153
  }
154
+ /** The state of a whole scenario run. */
152
155
  export type ScenarioRunStatus = 'running' | 'passed' | 'failed';
153
156
  /**
154
157
  * The filters a run was selected with, recorded when it was narrowed at all.
@@ -43,6 +43,7 @@ export type ScenarioStepKind = 'virtualUser' | 'platform' | 'addon';
43
43
  * can never itself fall back.
44
44
  */
45
45
  export type ScenarioSurface = 'browser' | 'cli' | 'default';
46
+ /** Every {@link ScenarioSurface}, in order of preference. */
46
47
  export declare const SCENARIO_SURFACES: readonly ScenarioSurface[];
47
48
  /**
48
49
  * How a step's declared surfaces resolve for one run.
@@ -1,3 +1,4 @@
1
+ /** Every {@link ScenarioSurface}, in order of preference. */
1
2
  export const SCENARIO_SURFACES = [
2
3
  'browser',
3
4
  'cli',
@@ -1,3 +1,4 @@
1
+ import { stableStringify } from '../../utils/stable-stringify.js';
1
2
  /**
2
3
  * Resolve which of a step's declared bindings run, for one step, in one run.
3
4
  *
@@ -41,16 +42,3 @@ export const witnessesAgree = (a, b) => {
41
42
  }
42
43
  return stableStringify(a) === stableStringify(b);
43
44
  };
44
- const stableStringify = (value) => {
45
- if (value === null || typeof value !== 'object') {
46
- return JSON.stringify(value) ?? 'undefined';
47
- }
48
- if (Array.isArray(value)) {
49
- return `[${value.map(stableStringify).join(',')}]`;
50
- }
51
- const entries = Object.entries(value)
52
- .filter(([, v]) => v !== undefined)
53
- .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
54
- .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`);
55
- return `{${entries.join(',')}}`;
56
- };
@@ -1,10 +1,14 @@
1
1
  import type { CorePikkuFunctionConfig, CorePikkuFunctionHook } from '../../function/functions.types.js';
2
2
  export type { ScenarioStepInvocation, ScenarioStepMeta, PikkuScenarioWire, } from './dsl/workflow-dsl.types.js';
3
3
  export type { ScenarioStepPhase, ScenarioStepKind, ScenarioStepOptions, PikkuScenarioStepWire, ScenarioEnvironment, ScenarioSurface, ScenarioSurfaceResolution, PikkuBrowserWire, ScenarioScreenshotOptions, TestIdSelector, ScenarioBrowserProvider, ScenarioBrowserFailure, } from './scenario-step.types.js';
4
+ /**
5
+ * A scenario a feature runs: the scenario itself, or the scenario paired with the input it runs with.
6
+ */
4
7
  export type CoreFeatureScenario = CorePikkuFunctionConfig<any, any, any> | {
5
8
  scenario: CorePikkuFunctionConfig<any, any, any>;
6
9
  data: unknown;
7
10
  };
11
+ /** What `pikkuFeature` takes: a named group of scenarios, with hooks around them. */
8
12
  export type CoreFeature = {
9
13
  name: string;
10
14
  description?: string;
@@ -25,6 +29,7 @@ export type FeatureMetaEntry = {
25
29
  scenario: string;
26
30
  data?: unknown;
27
31
  };
32
+ /** Generated metadata for one feature. */
28
33
  export type FeatureMeta = {
29
34
  id: string;
30
35
  name: string;
@@ -37,6 +42,7 @@ export type FeatureMeta = {
37
42
  hasBefore: boolean;
38
43
  hasAfter: boolean;
39
44
  };
45
+ /** Generated metadata for every feature, keyed by id. */
40
46
  export type FeaturesMeta = Record<string, FeatureMeta>;
41
47
  export type FeaturePlanEntry = {
42
48
  featureId: string;
@@ -1,6 +1,12 @@
1
1
  import { ForbiddenError } from '../../errors/errors.js';
2
2
  import type { CoreUserSession } from '../../types/core.types.js';
3
3
  import type { ApprovalDecider, WorkflowApprovalPolicy } from './dsl/workflow-dsl.types.js';
4
+ /**
5
+ * A decision on an approval gate was refused by the gate's declared policy:
6
+ * the decider lacks its `approverScope`, or is not the permitted approver under
7
+ * `approvers` (`owner` or `not-initiator`). Responds 403; the refusal is
8
+ * audited before it is thrown.
9
+ */
4
10
  export declare class WorkflowApprovalForbiddenError extends ForbiddenError {
5
11
  payload: {
6
12
  reason: string;
@@ -1,5 +1,11 @@
1
1
  import { ForbiddenError } from '../../errors/errors.js';
2
2
  import { addError } from '../../errors/error-handler.js';
3
+ /**
4
+ * A decision on an approval gate was refused by the gate's declared policy:
5
+ * the decider lacks its `approverScope`, or is not the permitted approver under
6
+ * `approvers` (`owner` or `not-initiator`). Responds 403; the refusal is
7
+ * audited before it is thrown.
8
+ */
3
9
  export class WorkflowApprovalForbiddenError extends ForbiddenError {
4
10
  payload;
5
11
  constructor(reason, detail) {
@@ -1,8 +1,14 @@
1
+ import type { StepStatus } from './workflow.types.js';
2
+ /**
3
+ * How many times a failed step is retried when neither the step nor the app's `workflow.retries` config says.
4
+ */
1
5
  export declare const DEFAULT_STEP_RETRIES = 5;
2
6
  /** Statuses from which a run never advances again on its own. */
3
7
  export declare const WORKFLOW_END_STATES: ReadonlySet<string>;
4
8
  /** Statuses a run cannot leave at all. */
5
9
  export declare const WORKFLOW_TERMINAL_STATES: ReadonlySet<string>;
10
+ /** Step statuses that mean the step has not settled yet. */
11
+ export declare const STEP_IN_FLIGHT_STATES: ReadonlySet<StepStatus>;
6
12
  export declare const NO_COMPENSATE_STATE_PREFIX = "noCompensate:";
7
13
  export declare const MILESTONE_STEP_PREFIX = "__milestone__:";
8
14
  export declare const milestoneStepName: (name: string) => string;
@@ -72,4 +78,4 @@ export declare const isStepLeaseLive: (leaseExpiresAt: Date | null | undefined,
72
78
  export declare const RUN_LEASE_RETRY_MS = 1000;
73
79
  /** Bound on the in-process backoff map, so a long-lived process cannot grow it without bound. */
74
80
  export declare const REDISPATCH_BACKOFF_MAX_ENTRIES = 10000;
75
- export { COMPENSATION_STEP_SUFFIX, compensationStepName, forwardStepName, isCompensationStepName, } from '../../function/compensation-name.js';
81
+ export { COMPENSATION_STEP_SUFFIX, compensationStepName, forwardStepName, isCompensationStepName, } from '../../compensation-name.js';
@@ -1,3 +1,6 @@
1
+ /**
2
+ * How many times a failed step is retried when neither the step nor the app's `workflow.retries` config says.
3
+ */
1
4
  export const DEFAULT_STEP_RETRIES = 5;
2
5
  /** Statuses from which a run never advances again on its own. */
3
6
  export const WORKFLOW_END_STATES = new Set([
@@ -16,6 +19,12 @@ export const WORKFLOW_TERMINAL_STATES = new Set([
16
19
  'compensated',
17
20
  'compensation_failed',
18
21
  ]);
22
+ /** Step statuses that mean the step has not settled yet. */
23
+ export const STEP_IN_FLIGHT_STATES = new Set([
24
+ 'pending',
25
+ 'scheduled',
26
+ 'running',
27
+ ]);
19
28
  export const NO_COMPENSATE_STATE_PREFIX = 'noCompensate:';
20
29
  export const MILESTONE_STEP_PREFIX = '__milestone__:';
21
30
  export const milestoneStepName = (name) => `${MILESTONE_STEP_PREFIX}${name}`;
@@ -85,4 +94,4 @@ export const isStepLeaseLive = (leaseExpiresAt, now = Date.now()) => leaseExpire
85
94
  export const RUN_LEASE_RETRY_MS = 1_000;
86
95
  /** Bound on the in-process backoff map, so a long-lived process cannot grow it without bound. */
87
96
  export const REDISPATCH_BACKOFF_MAX_ENTRIES = 10_000;
88
- export { COMPENSATION_STEP_SUFFIX, compensationStepName, forwardStepName, isCompensationStepName, } from '../../function/compensation-name.js';
97
+ export { COMPENSATION_STEP_SUFFIX, compensationStepName, forwardStepName, isCompensationStepName, } from '../../compensation-name.js';
@@ -18,11 +18,15 @@ export declare class WorkflowCancelledException extends Error {
18
18
  readonly reason?: string | undefined;
19
19
  constructor(runId: string, reason?: string | undefined);
20
20
  }
21
+ /**
22
+ * Thrown to stop a run that is now waiting to be resumed — a `suspend`, an approval gate. Not a failure.
23
+ */
21
24
  export declare class WorkflowSuspendedException extends Error {
22
25
  readonly runId: string;
23
26
  readonly reason: string;
24
27
  constructor(runId: string, reason: string);
25
28
  }
29
+ /** A step could not be queued; the queue's error is the `cause`. */
26
30
  export declare class WorkflowDispatchException extends Error {
27
31
  readonly runId: string;
28
32
  readonly stepName: string;
@@ -30,9 +34,11 @@ export declare class WorkflowDispatchException extends Error {
30
34
  cause?: unknown;
31
35
  });
32
36
  }
37
+ /** No workflow is registered under the name asked for. Responds 404. */
33
38
  export declare class WorkflowNotFoundError extends PikkuError {
34
39
  constructor(name: string);
35
40
  }
41
+ /** No run exists with the id asked for. Responds 404. */
36
42
  export declare class WorkflowRunNotFoundError extends PikkuError {
37
43
  constructor(runId: string);
38
44
  }
@@ -45,6 +51,9 @@ export declare class WorkflowRunFailedError extends PikkuError {
45
51
  export declare class WorkflowRunCancelledError extends PikkuError {
46
52
  constructor();
47
53
  }
54
+ /**
55
+ * The approval gate already has a recorded outcome, so a second decision is refused. Responds 409.
56
+ */
48
57
  export declare class WorkflowApprovalResolvedError extends PikkuError {
49
58
  payload: {
50
59
  reason: string;
@@ -52,6 +61,10 @@ export declare class WorkflowApprovalResolvedError extends PikkuError {
52
61
  };
53
62
  constructor(reason: string, outcome: ApprovalOutcome<unknown>['status']);
54
63
  }
64
+ /**
65
+ * A queued step named a different function from the one the workflow recorded
66
+ * when it dispatched the step, so the worker refuses to run it. Responds 409.
67
+ */
55
68
  export declare class WorkflowStepFunctionMismatchError extends PikkuError {
56
69
  readonly runId: string;
57
70
  readonly stepName: string;
@@ -27,6 +27,9 @@ export class WorkflowCancelledException extends Error {
27
27
  this.name = 'WorkflowCancelledException';
28
28
  }
29
29
  }
30
+ /**
31
+ * Thrown to stop a run that is now waiting to be resumed — a `suspend`, an approval gate. Not a failure.
32
+ */
30
33
  export class WorkflowSuspendedException extends Error {
31
34
  runId;
32
35
  reason;
@@ -37,6 +40,7 @@ export class WorkflowSuspendedException extends Error {
37
40
  this.name = 'WorkflowSuspendedException';
38
41
  }
39
42
  }
43
+ /** A step could not be queued; the queue's error is the `cause`. */
40
44
  export class WorkflowDispatchException extends Error {
41
45
  runId;
42
46
  stepName;
@@ -47,6 +51,7 @@ export class WorkflowDispatchException extends Error {
47
51
  this.name = 'WorkflowDispatchException';
48
52
  }
49
53
  }
54
+ /** No workflow is registered under the name asked for. Responds 404. */
50
55
  export class WorkflowNotFoundError extends PikkuError {
51
56
  constructor(name) {
52
57
  super(`Workflow not found: ${name}`);
@@ -56,6 +61,7 @@ addError(WorkflowNotFoundError, {
56
61
  status: 404,
57
62
  message: 'Workflow not found.',
58
63
  });
64
+ /** No run exists with the id asked for. Responds 404. */
59
65
  export class WorkflowRunNotFoundError extends PikkuError {
60
66
  constructor(runId) {
61
67
  super(`Workflow run not found: ${runId}`);
@@ -85,6 +91,9 @@ addError(WorkflowRunCancelledError, {
85
91
  status: 409,
86
92
  message: 'Workflow was cancelled.',
87
93
  });
94
+ /**
95
+ * The approval gate already has a recorded outcome, so a second decision is refused. Responds 409.
96
+ */
88
97
  export class WorkflowApprovalResolvedError extends PikkuError {
89
98
  payload;
90
99
  constructor(reason, outcome) {
@@ -96,6 +105,10 @@ addError(WorkflowApprovalResolvedError, {
96
105
  status: 409,
97
106
  message: 'Approval has already been resolved.',
98
107
  });
108
+ /**
109
+ * A queued step named a different function from the one the workflow recorded
110
+ * when it dispatched the step, so the worker refuses to run it. Responds 409.
111
+ */
99
112
  export class WorkflowStepFunctionMismatchError extends PikkuError {
100
113
  runId;
101
114
  stepName;
@@ -1,2 +1,6 @@
1
+ /** A name-based (version 5) UUID, deterministic for the same name and namespace. */
1
2
  export declare const uuidv5: (name: string, namespace?: string) => string;
3
+ /**
4
+ * A stable id for one step of one run, the same on every retry and replay — usable as an idempotency key.
5
+ */
2
6
  export declare const deriveInvocationId: (runId: string, stepName: string) => string;
@@ -81,6 +81,7 @@ const sha1 = (message) => {
81
81
  [h0, h1, h2, h3, h4].forEach((h, i) => outView.setUint32(i * 4, h));
82
82
  return out;
83
83
  };
84
+ /** A name-based (version 5) UUID, deterministic for the same name and namespace. */
84
85
  export const uuidv5 = (name, namespace = PIKKU_WORKFLOW_NAMESPACE) => {
85
86
  const ns = parseUuid(namespace);
86
87
  const nameBytes = encoder.encode(name);
@@ -92,4 +93,7 @@ export const uuidv5 = (name, namespace = PIKKU_WORKFLOW_NAMESPACE) => {
92
93
  bytes[8] = (bytes[8] & 0x3f) | 0x80;
93
94
  return formatUuid(bytes);
94
95
  };
96
+ /**
97
+ * A stable id for one step of one run, the same on every retry and replay — usable as an idempotency key.
98
+ */
95
99
  export const deriveInvocationId = (runId, stepName) => uuidv5(`${runId}:${stepName}`);
@@ -1,4 +1,5 @@
1
1
  import type { PikkuRPC } from '../rpc/rpc-types.js';
2
+ /** The job the workflow step-worker queue carries: one step of one run. */
2
3
  export interface WorkflowStepInput {
3
4
  runId: string;
4
5
  stepName: string;
@@ -6,9 +7,11 @@ export interface WorkflowStepInput {
6
7
  data: unknown;
7
8
  fromStepName?: string;
8
9
  }
10
+ /** The job the workflow orchestrator queue carries: a run to advance. */
9
11
  export interface PikkuWorkflowOrchestratorInput {
10
12
  runId: string;
11
13
  }
14
+ /** The job that wakes a run when a `sleep` step's duration has passed. */
12
15
  export interface PikkuWorkflowSleeperInput {
13
16
  runId: string;
14
17
  stepId: string;
@@ -1,6 +1,7 @@
1
1
  import { ForbiddenError } from '../../errors/errors.js';
2
2
  import type { CoreUserSession } from '../../types/core.types.js';
3
3
  import type { WorkflowRunWire } from './workflow.types.js';
4
+ /** The caller is not the user who started this workflow run. Responds 403. */
4
5
  export declare class WorkflowRunForbiddenError extends ForbiddenError {
5
6
  constructor();
6
7
  }
@@ -1,5 +1,6 @@
1
1
  import { ForbiddenError } from '../../errors/errors.js';
2
2
  import { addError } from '../../errors/error-handler.js';
3
+ /** The caller is not the user who started this workflow run. Responds 403. */
3
4
  export class WorkflowRunForbiddenError extends ForbiddenError {
4
5
  constructor() {
5
6
  super('Not authorized to access this workflow run');
@@ -1,6 +1,7 @@
1
1
  import type { CoreUserSession } from '../../types/core.types.js';
2
2
  import type { PikkuChannel } from '../channel/channel.types.js';
3
3
  import type { WorkflowRunService } from './workflow.types.js';
4
+ /** What `streamWorkflowRunStatus` streams, to whom, and how much detail it includes. */
4
5
  export interface WorkflowStatusStreamParams {
5
6
  workflowRunService: WorkflowRunService;
6
7
  runId: string;
@@ -1,9 +1,4 @@
1
- import { isCompensationStepName, isMilestoneStepName, } from './workflow-constants.js';
2
- const IN_FLIGHT = new Set([
3
- 'pending',
4
- 'scheduled',
5
- 'running',
6
- ]);
1
+ import { isCompensationStepName, isMilestoneStepName, STEP_IN_FLIGHT_STATES, } from './workflow-constants.js';
7
2
  const startedAt = (record) => record.createdAt.getTime();
8
3
  const finishedAt = (record) => (record.succeededAt ?? record.failedAt ?? record.updatedAt).getTime();
9
4
  export function planUnwind(input) {
@@ -16,7 +11,7 @@ export function planUnwind(input) {
16
11
  .sort((a, b) => finishedAt(b) - finishedAt(a) ||
17
12
  input.records.indexOf(b) - input.records.indexOf(a));
18
13
  const lastMilestone = milestones[0];
19
- const forwardInFlight = forward.some((r) => IN_FLIGHT.has(r.status) && input.hasCompensation(r));
14
+ const forwardInFlight = forward.some((r) => STEP_IN_FLIGHT_STATES.has(r.status) && input.hasCompensation(r));
20
15
  let candidates = forward.filter((r) => {
21
16
  if (!r.rpcName || input.skip.has(r.stepName))
22
17
  return false;
@@ -6,6 +6,10 @@ import type { LeaseService } from '../../services/lease-service.js';
6
6
  export type { WorkflowService } from '../../services/workflow-service.js';
7
7
  export type { WorkflowStepOptions, WorkflowWireDoRPC, WorkflowApprovalOptions, ApprovalOutcome, InputSource, OutputBinding, RpcStepMeta, Condition, BranchStepMeta, ParallelGroupStepMeta, FanoutStepMeta, ReturnStepMeta, InlineStepMeta, SleepStepMeta, CancelStepMeta, SuspendStepMeta, MilestoneStepMeta, ApprovalStepMeta, SetStepMeta, SwitchCaseMeta, SwitchStepMeta, FilterStepMeta, ArrayPredicateStepMeta, WorkflowStepMeta, WorkflowStepWire, PikkuWorkflowWire, } from './dsl/workflow-dsl.types.js';
8
8
  import type { WorkflowStepMeta } from './dsl/workflow-dsl.types.js';
9
+ /**
10
+ * How a run was started: the wire type, the parent run and step for a child
11
+ * workflow, and the user whose session started it — who becomes its owner.
12
+ */
9
13
  export interface WorkflowRunWire {
10
14
  type: string;
11
15
  id?: string;
@@ -13,6 +17,9 @@ export interface WorkflowRunWire {
13
17
  parentStepId?: string;
14
18
  pikkuUserId?: string;
15
19
  }
20
+ /**
21
+ * The resolved `workflow` section of the app config: default retries and the queue names the engine uses.
22
+ */
16
23
  export interface WorkflowServiceConfig {
17
24
  retries: number;
18
25
  retryDelay: number;
@@ -20,6 +27,13 @@ export interface WorkflowServiceConfig {
20
27
  stepWorkerQueueName: string;
21
28
  sleeperRPCName: string;
22
29
  }
30
+ /**
31
+ * How a workflow service routes its jobs. `per-workflow` (the default) uses a
32
+ * workflow's dedicated queue when one is declared; `shared-groups` sends every
33
+ * job through the shared queues, grouped by workflow, with
34
+ * `queueGroupConcurrency` (default 2) per group. `queueConcurrency` defaults
35
+ * to 20.
36
+ */
23
37
  export interface WorkflowQueueOptions {
24
38
  queueStrategy?: 'per-workflow' | 'shared-groups';
25
39
  queueConcurrency?: number;
@@ -34,13 +48,20 @@ export interface WorkflowQueueOptions {
34
48
  export interface WorkflowServiceOptions extends WorkflowQueueOptions {
35
49
  leaseService: LeaseService;
36
50
  }
51
+ /** A step a deterministic workflow is known to run, before it runs. */
37
52
  export interface WorkflowPlannedStep {
38
53
  stepName: string;
39
54
  displayName?: string;
40
55
  }
56
+ /**
57
+ * Where a run stands. `compensating` and the two after it belong to a saga unwinding after a failure.
58
+ */
41
59
  export type WorkflowStatus = 'running' | 'suspended' | 'completed' | 'failed' | 'cancelled' | 'compensating' | 'compensated' | 'compensation_failed';
60
+ /** Whether a recorded version of a workflow's graph may be run. */
42
61
  export type WorkflowVersionStatus = 'draft' | 'active' | 'declined';
62
+ /** Where one step attempt stands. */
43
63
  export type StepStatus = 'pending' | 'running' | 'scheduled' | 'succeeded' | 'failed' | 'suspended';
64
+ /** One stored workflow run. */
44
65
  export interface WorkflowRun {
45
66
  id: string;
46
67
  workflow: string;
@@ -56,6 +77,7 @@ export interface WorkflowRun {
56
77
  createdAt: Date;
57
78
  updatedAt: Date;
58
79
  }
80
+ /** One stored attempt at a workflow step. */
59
81
  export interface StepState {
60
82
  stepId: string;
61
83
  status: StepStatus;
@@ -89,6 +111,7 @@ export interface StepState {
89
111
  succeededAt?: Date;
90
112
  failedAt?: Date;
91
113
  }
114
+ /** A run summarised for display: status, steps and outcome. */
92
115
  export interface WorkflowRunStatus {
93
116
  id: string;
94
117
  status: WorkflowStatus;
@@ -112,6 +135,11 @@ export interface WorkflowRunStatus {
112
135
  error: string;
113
136
  }>;
114
137
  }
138
+ /**
139
+ * Read and delete access to stored workflow runs, for consoles and status
140
+ * routes. It applies no ownership check of its own: callers that expose it to
141
+ * users check with `assertWorkflowRunOwner` first.
142
+ */
115
143
  export interface WorkflowRunService {
116
144
  listRuns(options?: {
117
145
  workflowName?: string;
@@ -135,6 +163,11 @@ export interface WorkflowRunService {
135
163
  } | null>;
136
164
  deleteRun(id: string): Promise<boolean>;
137
165
  }
166
+ /**
167
+ * A secondary store that receives a copy of every write a workflow service
168
+ * makes — for reporting or a console database. A failed mirror write is logged
169
+ * and ignored, and the engine never reads from it.
170
+ */
138
171
  export interface WorkflowRunMirror {
139
172
  createRun(runId: string, workflowName: string, input: any, inline: boolean, graphHash: string, wire: WorkflowRunWire, options?: {
140
173
  deterministic?: boolean;
@@ -159,12 +192,14 @@ export interface WorkflowRunMirror {
159
192
  upsertWorkflowVersion(name: string, graphHash: string, graph: any, source: string, status?: WorkflowVersionStatus): Promise<void>;
160
193
  updateWorkflowVersionStatus(name: string, graphHash: string, status: WorkflowVersionStatus): Promise<void>;
161
194
  }
195
+ /** A registered workflow: its name and the function that runs it. */
162
196
  export type CoreWorkflow<PikkuFunctionConfig extends CorePikkuFunctionConfig<any, any, any> = CorePikkuFunctionConfig<any, any, any>> = {
163
197
  name: string;
164
198
  func: PikkuFunctionConfig;
165
199
  middleware?: PikkuFunctionConfig['middleware'];
166
200
  tags?: string[];
167
201
  };
202
+ /** Start, read and cancel runs of one workflow. */
168
203
  export interface PikkuWorkflow {
169
204
  start: <I>(input: I) => Promise<{
170
205
  runId: string;
@@ -172,12 +207,15 @@ export interface PikkuWorkflow {
172
207
  getRun: (runId: string) => Promise<WorkflowRun>;
173
208
  cancelRun: (runId: string) => Promise<void>;
174
209
  }
210
+ /** One declared workflow context variable: its type, default and description. */
175
211
  export interface ContextVariable {
176
212
  type: 'string' | 'number' | 'boolean' | 'object' | 'array';
177
213
  default?: unknown;
178
214
  description?: string;
179
215
  }
216
+ /** A workflow's declared context variables, keyed by name. */
180
217
  export type WorkflowContext = Record<string, ContextVariable>;
218
+ /** Generated metadata for every workflow, keyed by name. */
181
219
  export type WorkflowsMeta = Record<string, CommonWireMeta & {
182
220
  name: string;
183
221
  steps: WorkflowStepMeta[];
@@ -195,6 +233,7 @@ export type WorkflowsMeta = Record<string, CommonWireMeta & {
195
233
  skip?: string;
196
234
  virtualUsers?: string[];
197
235
  }>;
236
+ /** The slice of a workflow's generated metadata the engine needs at run time. */
198
237
  export interface WorkflowRuntimeMeta {
199
238
  name: string;
200
239
  pikkuFuncId: string;
@@ -208,4 +247,5 @@ export interface WorkflowRuntimeMeta {
208
247
  deterministic?: boolean;
209
248
  plannedSteps?: WorkflowPlannedStep[];
210
249
  }
250
+ /** Runtime workflow metadata, keyed by name. */
211
251
  export type WorkflowsRuntimeMeta = Record<string, WorkflowRuntimeMeta>;