@pikku/core 0.12.78 → 0.12.80

package/dist/wirings/rpc/rpc-runner.js

@@ -4,6 +4,12 @@ import { pikkuState } from '../../pikku-state.js';
 import { PikkuError, addError } from '../../errors/error-handler.js';
 import { parseVersionedId } from '../../version.js';
 import { resolveRemoteAddonToken } from './remote-addon-auth.js';
+import { createAgentRPC } from '../ai-agent/agent-rpc.js';
+/**
+ * The session for a wire: read through `getSession` when a runner attached one,
+ * otherwise whatever was placed on the wire directly.
+ */
+const resolveWireSession = async (wire) => typeof wire.getSession === 'function' ? await wire.getSession() : wire.session;
 export class RPCNotFoundError extends PikkuError {
     rpcName;
     constructor(rpcName) {
@@ -36,9 +42,6 @@ addError(RemoteAddonRequestError, {
     status: 502,
     message: 'Remote addon request failed.',
 });
-import { runAIAgent, resumeAIAgentSync } from '../ai-agent/ai-agent-runner.js';
-import { streamAIAgent, resumeAIAgent, interruptAIAgent, } from '../ai-agent/ai-agent-stream.js';
-import { wrapChannelWithAGUI } from '../ai-agent/ai-agent-agui.js';
 export const resolveNamespace = (namespacedFunction) => {
     const colonIndex = namespacedFunction.indexOf(':');
     if (colonIndex === -1) {
@@ -142,9 +145,7 @@ export class ContextAwareRPCService {
         catch (e) {
             if (e instanceof RPCNotFoundError) {
                 if (this.services.deploymentService) {
-                    const session = this.wire.getSession && typeof this.wire.getSession === 'function'
-                        ? await this.wire.getSession()
-                        : this.wire.session;
+                    const session = await resolveWireSession(this.wire);
                     return this.services.deploymentService.invoke(funcName, data, session, this.wire.traceId);
                 }
             }
@@ -276,9 +277,7 @@ export class ContextAwareRPCService {
         }
         catch (e) {
             if (e instanceof RPCNotFoundError && this.services.deploymentService) {
-                const session = this.wire.getSession && typeof this.wire.getSession === 'function'
-                    ? await this.wire.getSession()
-                    : this.wire.session;
+                const session = await resolveWireSession(this.wire);
                 return this.services.deploymentService.invoke(rpcName, data, session, this.wire.traceId);
             }
             throw e;
@@ -308,78 +307,22 @@ export class ContextAwareRPCService {
         };
         return this.services.workflowService.startWorkflow(workflowName, input, wire, this, options);
     }
+    /**
+     * The agent facade, built on access.
+     *
+     * The implementation lives in `ai-agent/agent-rpc.ts` so the agent surface is
+     * one file rather than a wing of this one; a getter rather than a field so a
+     * request that never touches an agent never builds it.
+     */
     get agent() {
-        return {
-            run: async (agentName, input) => {
-                const result = await runAIAgent(agentName, input, {
-                    sessionService: this.options.sessionService,
-                    getCredential: this.wire.getCredential?.bind(this.wire),
-                });
-                return {
-                    runId: result.runId,
-                    result: result.object ?? result.text,
-                    usage: result.usage,
-                    ...(result.status === 'suspended' && {
-                        status: 'suspended',
-                        pendingApprovals: result.pendingApprovals,
-                    }),
-                };
-            },
-            stream: async (agentName, input, options) => {
-                const channel = this.wire.channel;
-                if (!channel)
-                    throw new Error('No channel available for streaming');
-                let currentRunId;
-                await streamAIAgent(agentName, input, wrapChannelWithAGUI(channel, {
-                    threadId: input.threadId,
-                    getRunId: () => currentRunId,
-                }), {
-                    sessionService: this.options.sessionService,
-                    getCredential: this.wire.getCredential?.bind(this.wire),
-                }, undefined, {
-                    ...options,
-                    onRunCreated: (runId) => {
-                        currentRunId = runId;
-                        options?.onRunCreated?.(runId);
-                    },
-                });
-            },
-            resume: async (runId, input, options) => {
-                const channel = this.wire.channel;
-                if (!channel)
-                    throw new Error('No channel available for streaming');
-                await resumeAIAgent({ runId, ...input }, wrapChannelWithAGUI(channel, { runId }), {
-                    sessionService: this.options.sessionService,
-                    getCredential: this.wire.getCredential?.bind(this.wire),
-                }, options);
-            },
-            interrupt: async (runId, reason) => {
-                return interruptAIAgent({ runId, ...(reason ? { reason } : {}) }, { sessionService: this.options.sessionService });
-            },
-            approve: async (runId, approvals, expectedAgentName) => {
-                const result = await resumeAIAgentSync(runId, approvals, {
-                    sessionService: this.options.sessionService,
-                }, expectedAgentName);
-                return {
-                    runId: result.runId,
-                    result: result.object ?? result.text,
-                    usage: result.usage,
-                    ...(result.status === 'suspended' && {
-                        status: 'suspended',
-                        pendingApprovals: result.pendingApprovals,
-                    }),
-                };
-            },
-        };
+        return createAgentRPC(this.wire, this.options);
     }
     async remote(funcName, data) {
         if (!this.services.deploymentService) {
             throw new Error(`No DeploymentService configured for remote RPC: ${funcName}. ` +
                 `Set up a DeploymentService to enable remote function calls.`);
         }
-        const session = this.wire.getSession && typeof this.wire.getSession === 'function'
-            ? await this.wire.getSession()
-            : this.wire.session;
+        const session = await resolveWireSession(this.wire);
         return this.services.deploymentService.invoke(funcName, data, session, this.wire.traceId);
     }
 }
@@ -390,18 +333,42 @@ export class PikkuRPCService {
             ? requiresAuthOrOptions
             : { requiresAuth: requiresAuthOrOptions };
         const serviceRPC = new ContextAwareRPCService(services, wire, options, packageName);
-        return {
-            depth,
-            global: false,
-            invoke: serviceRPC.rpc.bind(serviceRPC),
-            remote: serviceRPC.remote.bind(serviceRPC),
-            exposed: serviceRPC.rpcExposed.bind(serviceRPC),
-            startWorkflow: serviceRPC.startWorkflow.bind(serviceRPC),
-            get agent() {
-                return serviceRPC.agent;
-            },
-            rpcWithWire: serviceRPC.rpcWithWire.bind(serviceRPC),
-        };
+        // `TypedRPC` is named by the caller from its generated RPC map. Nothing
+        // concrete can satisfy a type the caller has not chosen yet.
+        return new ContextRPCView(serviceRPC, depth);
+    }
+}
+/**
+ * The per-invocation `wire.rpc`.
+ *
+ * A class rather than an object literal because `agent` has to stay lazy — most
+ * requests never touch it — and an accessor declared on an object literal is
+ * defined per instance, which drops the literal off V8's fast construction
+ * path. Measured at ~1.15µs per request as a literal against ~0.47µs here, on
+ * the hot path every request takes.
+ *
+ * knowledge: decisions/internals/the-per-invocation-rpc-view-is-a-class.md
+ */
+class ContextRPCView {
+    serviceRPC;
+    depth;
+    global = false;
+    invoke;
+    remote;
+    exposed;
+    startWorkflow;
+    rpcWithWire;
+    constructor(serviceRPC, depth) {
+        this.serviceRPC = serviceRPC;
+        this.depth = depth;
+        this.invoke = serviceRPC.rpc.bind(serviceRPC);
+        this.remote = serviceRPC.remote.bind(serviceRPC);
+        this.exposed = serviceRPC.rpcExposed.bind(serviceRPC);
+        this.startWorkflow = serviceRPC.startWorkflow.bind(serviceRPC);
+        this.rpcWithWire = serviceRPC.rpcWithWire.bind(serviceRPC);
+    }
+    get agent() {
+        return this.serviceRPC.agent;
     }
 }
 export const rpcService = new PikkuRPCService();

package/dist/wirings/rpc/rpc-types.d.ts

@@ -1,3 +1,4 @@
+import type { PikkuRawWire } from '../../types/core.types.js';
 import type { AgentInterruptResult } from '../ai-agent/ai-agent-interrupt.js';
 export type PikkuRPC<Invoke extends (...args: any[]) => any = (...args: any[]) => any, Remote extends (...args: any[]) => any = (...args: any[]) => any, startWorkflow extends (...args: any[]) => any = (...args: any[]) => any, AgentRun extends (...args: any[]) => any = (...args: any[]) => any, AgentStream extends (...args: any[]) => any = (...args: any[]) => any> = {
     depth: number;
@@ -5,6 +6,8 @@ export type PikkuRPC<Invoke extends (...args: any[]) => any = (...args: any[]) =
     invoke: Invoke;
     remote: Remote;
     exposed: (name: string, data: any) => Promise<any>;
+    /** Invoke an RPC with explicit wire fields merged over the caller's. */
+    rpcWithWire: <In = any, Out = any>(rpcName: string, data: In, wire: PikkuRawWire) => Promise<Out>;
     startWorkflow: startWorkflow;
     agent: {
         run: AgentRun;

package/dist/wirings/secret/validate-secret-definitions.js

@@ -34,6 +34,7 @@ export function validateAndBuildSecretDefinitionsMeta(definitions, schemaLookup)
                     schema: def.schema,
                     oauth2: def.oauth2,
                     rotationPeriod: def.rotationPeriod,
+                    allowedHosts: def.allowedHosts,
                     docsUrl: def.docsUrl,
                     sourceFile: def.sourceFile,
                 };
@@ -50,6 +51,7 @@ export function validateAndBuildSecretDefinitionsMeta(definitions, schemaLookup)
                 schema: def.schema,
                 oauth2: def.oauth2,
                 rotationPeriod: def.rotationPeriod,
+                allowedHosts: def.allowedHosts,
                 docsUrl: def.docsUrl,
                 sourceFile: def.sourceFile,
             };

package/dist/wirings/trigger/pikku-trigger-service.d.ts

@@ -5,10 +5,6 @@ export type TriggerTarget = {
     targetName: string;
     startNode?: string;
 };
-export type TriggerSourceInfo = {
-    name: string;
-    input: unknown;
-};
 export declare abstract class PikkuTriggerService implements TriggerService {
     protected activeTriggers: Map<string, TriggerInstance>;
     abstract start(): Promise<void>;

package/dist/wirings/trigger/trigger-runner.js

@@ -24,6 +24,7 @@ export const wireTriggerSource = (source) => {
     if (triggerSources.has(source.name)) {
         throw new Error(`Trigger source already exists: ${source.name}`);
     }
+    // knowledge: decisions/internals/wiring-registries-erase-the-generics-their-wire-functions-capture.md
     triggerSources.set(source.name, source);
     addFunction(triggerSourceMeta.pikkuFuncId, source.func, triggerSourceMeta.packageName);
 };

package/dist/wirings/virtual-user/run-virtual-user.js

@@ -97,7 +97,9 @@ export const rememberIds = (body, into, depth = 0) => {
         return into;
     }
     for (const [key, value] of Object.entries(body)) {
-        if (typeof value === 'string' && MEMORABLE.test(key) && value.length < 200) {
+        if (typeof value === 'string' &&
+            MEMORABLE.test(key) &&
+            value.length < 200) {
             into[key] = value;
         }
         else if (typeof value === 'object') {
@@ -203,7 +205,8 @@ export const runVirtualUser = async (params) => {
             stoppedBy = 'budget-duration';
             break;
         }
-        if (budget?.mutations !== undefined && tally.mutations >= budget.mutations) {
+        if (budget?.mutations !== undefined &&
+            tally.mutations >= budget.mutations) {
             stoppedBy = 'budget-mutations';
             break;
         }
@@ -243,10 +246,7 @@ export const runVirtualUser = async (params) => {
         if (tick.move === 'resume' || tick.move === 'suspend') {
             messages.push(msg('user', `You were pulled away and have come back to this. Things may have changed since.`));
         }
-        // Whether this user trusts its notes this turn or goes and looks again.
-        // `stale` almost always trusts them, a newcomer has none to trust, and an
-        // auditor checks nearly everything — which is the whole difference between
-        // those runs, expressed as one roll rather than as prose.
+        // knowledge: decisions/internals/a-virtual-user-decides-whether-to-trust-memory-once-per-turn.md
         if (Object.keys(memory).length && !rng.chance(profile.reReadRate)) {
             messages.push(msg('user', `Things you have noted down: ${Object.entries(memory)
                 .slice(-25)
@@ -365,10 +365,7 @@ export const runVirtualUser = async (params) => {
             steps.push(record);
             continue;
         }
-        // What may be called is decided once, when the catalogue is narrowed: a
-        // read-only disposition is never offered a mutation and an approval-gated
-        // endpoint is never offered at all, so `index` is the gate and there is no
-        // second one here to drift out of step with it.
+        // knowledge: decisions/internals/the-virtual-user-catalogue-is-the-only-gate-on-what-may-be-called.md
         const mutating = !isReadOnly(entry);
         const args = readArgs(action.args);
         const repeats = profile.repeatRate > 0 && rng.chance(profile.repeatRate) ? 2 : 1;
@@ -379,7 +376,10 @@ export const runVirtualUser = async (params) => {
                 response = await target.call(entry.name, args);
             }
             catch (error) {
-                record.findingKinds = [...(record.findingKinds ?? []), 'transport-error'];
+                record.findingKinds = [
+                    ...(record.findingKinds ?? []),
+                    'transport-error',
+                ];
                 addFinding({
                     kind: 'transport-error',
                     detail: `${entry.name} threw: ${error.message}`,

package/dist/wirings/virtual-user/virtual-user-derive.js

@@ -18,24 +18,10 @@ const topLevelKeys = (schema) => {
 export const deriveCatalogue = (functions, schemas = {}) => {
     const entries = [];
     for (const [name, meta] of Object.entries(functions ?? {})) {
-        // Scenario bodies and their steps are never network-callable — they are
-        // held out of every deployed unit — so offering one would only ever waste
-        // a turn on a 404.
-        //
-        // For a platform or addon step this is not an efficiency argument but the
-        // oracle: a virtual user's findings are worth something only because it
-        // cannot manufacture the outcomes it is meant to discover. One that could
-        // invoke "Stripe's webhook arrives" would forge its own payment success,
-        // and every finding downstream of that is worthless. Same class of argument
-        // as `allowApprovalRequired` defaulting to false — and enforced here, at
-        // derivation, rather than by convention.
+        // knowledge: decisions/security/a-virtual-user-is-never-offered-a-step-that-would-forge-its-own-oracle.md
         if (meta.scenario || meta.scenarioStep || meta.scenarioStepKind)
             continue;
-        // `expose: true` is what puts a function on the rpc transport, and that is
-        // what the shipped target calls over. Absent is not permissive: an unexposed
-        // function 404s, and offering one spends a step to learn nothing about the
-        // product. Measured on the e2e app, 34 of its 72 functions are in exactly
-        // that state — nearly half a catalogue that cannot be called.
+        // knowledge: decisions/internals/only-exposed-functions-enter-a-virtual-user-catalogue.md
         if (meta.expose !== true)
             continue;
         const inputSchema = meta.inputSchemaName
@@ -76,10 +62,7 @@ const scenarioSteps = (meta) => {
             ? [{ stepFunc: step.stepFunc, phase: step.phase, actor: step.actor }]
             : []);
     }
-    // Insertion order is the order the CLI wrote the nodes in, which is the order
-    // the scenario declares them. Following `next` instead would buy an ordering
-    // that is already true and cost a traversal that has to decide what a branch
-    // means to a reader who will never take one.
+    // knowledge: decisions/internals/virtual-user-step-order-comes-from-insertion-order.md
     return Object.values(meta.nodes ?? {}).flatMap((node) => {
         const { rpcName, scenarioStepPhase, actor } = (node ?? {});
         if (!rpcName || !scenarioStepPhase)
@@ -115,11 +98,7 @@ export const deriveIntents = (workflows, functions = {}) => {
                 continue;
             steps.push(composeStepProse({
                 phase: step.phase,
-                // The template goes in unfilled, braces and all. A reporter fills its
-                // placeholders from a run that happened; there is no run yet, and
-                // "invites {email}" tells a user to pick someone where the filled-in
-                // form would have told it whom — which is the scenario's answer, not
-                // the user's own.
+                // knowledge: decisions/internals/a-scenario-step-template-is-offered-unfilled.md
                 description: template ?? description ?? '',
                 actor: step.actor,
             }));

package/dist/wirings/virtual-user/virtual-user-dispositions.js

@@ -78,10 +78,7 @@ export const DISPOSITIONS = {
         reReadRate: 0.2,
         invertedOracle: true,
     },
-    // The only disposition that is not testing anything. It is doing the job, so
-    // it abandons rarely, runs cool, and is told to stop and say so rather than
-    // guess — the failure mode here is a wrong action nobody asked for, not a
-    // missed bug.
+    // knowledge: decisions/internals/the-worker-disposition-is-the-one-that-is-not-testing.md
     accountable: {
         ...REALISTIC,
         instructions: [

package/dist/wirings/workflow/dsl/workflow-dsl.types.d.ts

@@ -288,7 +288,7 @@ export interface ReturnStepMeta {
     spread?: string[];
 }
 /**
- * Inline step metadata (legacy support)
+ * Inline step metadata
  */
 export interface InlineStepMeta {
     /** Inline form - local execution */
@@ -473,7 +473,34 @@ export interface PikkuWorkflowWire {
     /** Suspend workflow until a human records a decision against this gate */
     approval: WorkflowWireApproval;
 }
-export interface PikkuScenarioWire extends PikkuWorkflowWire {
+/**
+ * What a scenario has accumulated so far, shared by its body and its hooks.
+ *
+ * Typed as a partial of the scenario's own output because a scenario can fail
+ * at any step: the shape describes what a *completed* run produces, and the
+ * context holds however much of it this run reached. A scenario declaring no
+ * object output gets an open record rather than `Partial<never>`.
+ *
+ * `any` collapses to `any`, not to the union of both branches. `PikkuWire`'s
+ * default depends on that: the wire type is also used as a generic *constraint*,
+ * and a constraint carrying a concrete context would reject every wire whose
+ * scenario output differs from it.
+ */
+export type ScenarioContext<Out = unknown> = 0 extends 1 & Out ? any : Out extends object ? Partial<Out> : Record<string, unknown>;
+export interface PikkuScenarioWire<Out = unknown> extends PikkuWorkflowWire {
+    /**
+     * Scratch the body writes and the `before`/`after` hooks read.
+     *
+     * A hook is a separate function, so it cannot see the body's locals — which
+     * is why teardown had nowhere to learn the ids the body minted. Assigning
+     * them here (`scenario.context.projectId = project.projectId`) hands them to
+     * `after`, which runs in a `finally` and so cleans up on a failed run too.
+     *
+     * Deliberately *not* a world: it is scoped to one run, and scenario steps
+     * cannot reach it. Steps stay pure functions of their declared inputs, so the
+     * ladder in the report remains a complete account of what a step saw.
+     */
+    context: ScenarioContext<Out>;
     /**
      * Durable polling step: invoke `rpcName` (as an actor when `options.actor`
      * is set) until `predicate` passes or `options.within` elapses.

package/dist/wirings/workflow/feature.js

@@ -13,8 +13,10 @@ export const resolveFeatureScenarios = (features, registrations) => {
         const scenarios = feature.scenarios ?? [];
         for (let index = 0; index < scenarios.length; index++) {
             const entry = scenarios[index];
-            const paired = typeof entry === 'object' && entry !== null && 'scenario' in entry;
-            const config = paired ? entry.scenario : entry;
+            const pairing = typeof entry === 'object' && entry !== null && 'scenario' in entry
+                ? entry
+                : undefined;
+            const config = pairing ? pairing.scenario : entry;
             const scenarioName = nameByConfig.get(config);
             if (!scenarioName) {
                 unresolved.push({ featureId, index });
@@ -24,10 +26,11 @@ export const resolveFeatureScenarios = (features, registrations) => {
                 featureId,
                 featureName: feature.name ?? featureId,
                 scenarioName,
-                data: paired ? entry.data : undefined,
+                data: pairing?.data,
                 tags: [
                     ...new Set([
-                        ...(registrations.get(scenarioName)?.func?.tags ?? []),
+                        ...(registrations.get(scenarioName)?.func
+                            ?.tags ?? []),
                         ...(feature.tags ?? []),
                     ]),
                 ],

package/dist/wirings/workflow/graph/graph-runner.d.ts

@@ -1,4 +1,4 @@
-import { type PikkuWorkflowService } from '../pikku-workflow-service.js';
+import type { PikkuWorkflowService } from '../pikku-workflow-service.js';
 import type { WorkflowRuntimeMeta, WorkflowRunWire } from '../workflow.types.js';
 export declare class ChildWorkflowStartedException extends Error {
     parentRunId: string;
@@ -9,7 +9,6 @@ export declare class ChildWorkflowStartedException extends Error {
 }
 export declare function continueGraph(workflowService: PikkuWorkflowService, runId: string, graphName: string, overrideMeta?: WorkflowRuntimeMeta): Promise<void>;
 export declare function executeGraphStep(workflowService: PikkuWorkflowService, rpcService: any, runId: string, stepId: string, nodeId: string, rpcName: string, data: any, graphName: string): Promise<any>;
-export declare function onGraphNodeComplete(workflowService: PikkuWorkflowService, runId: string, graphName: string): Promise<void>;
 export declare function runFromMeta(workflowService: PikkuWorkflowService, runId: string, meta: WorkflowRuntimeMeta, _rpcService: any): Promise<void>;
 export declare function runWorkflowGraph(workflowService: PikkuWorkflowService, graphName: string, triggerInput: any, rpcService?: any, inline?: boolean, startNode?: string, wire?: WorkflowRunWire, overrideMeta?: WorkflowRuntimeMeta): Promise<{
     runId: string;

package/dist/wirings/workflow/graph/graph-runner.js

@@ -1,4 +1,5 @@
-import { WorkflowAsyncException, WorkflowSuspendedException, DEFAULT_STEP_RETRIES, } from '../pikku-workflow-service.js';
+import { WorkflowAsyncException, WorkflowSuspendedException, } from '../workflow-errors.js';
+import { DEFAULT_STEP_RETRIES } from '../workflow-constants.js';
 import { pikkuState, getSingletonServices } from '../../../pikku-state.js';
 import { RPCNotFoundError } from '../../rpc/rpc-runner.js';
 export class ChildWorkflowStartedException extends Error {
@@ -491,9 +492,6 @@ export async function executeGraphStep(workflowService, rpcService, runId, stepI
         throw error;
     }
 }
-export async function onGraphNodeComplete(workflowService, runId, graphName) {
-    await continueGraph(workflowService, runId, graphName);
-}
 export async function runFromMeta(workflowService, runId, meta, _rpcService) {
     await continueGraph(workflowService, runId, meta.name, meta);
 }
@@ -610,9 +608,12 @@ export async function runWorkflowGraph(workflowService, graphName, triggerInput,
         throw new Error(`Workflow graph '${graphName}' not found`);
     }
     const nodes = meta.nodes;
-    const entryNodes = startNode
-        ? [startNode]
-        : (meta.entryNodeIds ?? []);
+    const declaredEntryNodes = meta.entryNodeIds ?? [];
+    // knowledge: decisions/security/a-graph-run-starts-at-an-entry-node-the-graph-declared.md
+    if (startNode && !declaredEntryNodes.includes(startNode)) {
+        throw new Error(`Workflow graph '${graphName}': '${startNode}' is not an entry node`);
+    }
+    const entryNodes = startNode ? [startNode] : declaredEntryNodes;
     validateGraphReferences(graphName, nodes, entryNodes);
     if (entryNodes.length === 0) {
         throw new Error(`Workflow graph '${graphName}': no entry nodes found in meta or startNode`);

package/dist/wirings/workflow/graph/workflow-graph.types.d.ts

@@ -5,10 +5,6 @@ export interface RefValue {
 }
 export declare const createRef: (nodeId: string, path?: string) => RefValue;
 export declare const isRef: (value: unknown) => value is RefValue;
-export interface InputRef {
-    nodeId: string;
-    path?: string;
-}
 export type RefFn<NodeIds extends string = string> = (nodeId: NodeIds, path?: string) => RefValue;
 export type NextConfig<NodeIds extends string = string> = NodeIds | NodeIds[] | Record<string, NodeIds | NodeIds[]>;
 export interface GraphNodeConfig<NodeIds extends string = string> {

package/dist/wirings/workflow/index.d.ts

@@ -1,6 +1,11 @@
-export { PikkuWorkflowService, WorkflowCancelledException, WorkflowSuspendedException, WorkflowDispatchException, WorkflowNotFoundError, WorkflowRunNotFoundError, WorkflowApprovalResolvedError, DEFAULT_STEP_RETRIES, } from './pikku-workflow-service.js';
-export type { RunLifecycleContext, WorkflowRunEngine, WorkflowRunExtension, } from './pikku-workflow-service.js';
+export { PikkuWorkflowService } from './pikku-workflow-service.js';
+export { WorkflowCancelledException, WorkflowSuspendedException, WorkflowDispatchException, WorkflowNotFoundError, WorkflowRunNotFoundError, WorkflowApprovalResolvedError, WorkflowStepFunctionMismatchError, } from './workflow-errors.js';
+export { DEFAULT_STEP_RETRIES } from './workflow-constants.js';
+export { assertWorkflowRunOwner, WorkflowRunForbiddenError, } from './workflow-run-ownership.js';
+export type { RunLifecycleContext, WorkflowRunEngine, WorkflowRunExtension, } from './workflow-run-engine.types.js';
 export { deriveInvocationId, uuidv5 } from './workflow-invocation-id.js';
+export { isRef } from './graph/workflow-graph.types.js';
+export type { RefValue } from './graph/workflow-graph.types.js';
 export { buildRunTimeline, reconstructStateAt, reconstructFinalState, } from './run-timeline.js';
 export type { RunTimeline, RunTimelineEvent, ReconstructedRunState, ReconstructedStep, RunPhase, } from './run-timeline.js';
 export { addWorkflow } from './dsl/workflow-runner.js';

package/dist/wirings/workflow/index.js

@@ -1,5 +1,9 @@
-export { PikkuWorkflowService, WorkflowCancelledException, WorkflowSuspendedException, WorkflowDispatchException, WorkflowNotFoundError, WorkflowRunNotFoundError, WorkflowApprovalResolvedError, DEFAULT_STEP_RETRIES, } from './pikku-workflow-service.js';
+export { PikkuWorkflowService } from './pikku-workflow-service.js';
+export { WorkflowCancelledException, WorkflowSuspendedException, WorkflowDispatchException, WorkflowNotFoundError, WorkflowRunNotFoundError, WorkflowApprovalResolvedError, WorkflowStepFunctionMismatchError, } from './workflow-errors.js';
+export { DEFAULT_STEP_RETRIES } from './workflow-constants.js';
+export { assertWorkflowRunOwner, WorkflowRunForbiddenError, } from './workflow-run-ownership.js';
 export { deriveInvocationId, uuidv5 } from './workflow-invocation-id.js';
+export { isRef } from './graph/workflow-graph.types.js';
 export { buildRunTimeline, reconstructStateAt, reconstructFinalState, } from './run-timeline.js';
 export { addWorkflow } from './dsl/workflow-runner.js';
 export { addFeature, resolveFeatureScenarios } from './feature.js';

package/dist/wirings/workflow/pikku-scenario-service.d.ts

@@ -1,7 +1,7 @@
 import { PikkuError } from '../../errors/error-handler.js';
 import { InMemoryWorkflowService } from '../../services/in-memory-workflow-service.js';
-import { type RunLifecycleContext, type WorkflowRunEngine, type WorkflowRunExtension } from './pikku-workflow-service.js';
-import type { PikkuWire } from '../../types/core.types.js';
+import type { RunLifecycleContext, WorkflowRunEngine, WorkflowRunExtension } from './workflow-run-engine.types.js';
+import type { PikkuRawWire } from '../../types/core.types.js';
 import type { ScenarioPersonas } from '../../services/personas-service.js';
 import type { ScenarioBrowserProvider, ScenarioEnvironment, ScenarioSurface } from './scenario-step.types.js';
 import type { PikkuWorkflowWire, WorkflowQueueOptions } from './workflow.types.js';
@@ -126,6 +126,7 @@ export declare class ScenarioNoWitness extends PikkuError {
 export declare class PikkuScenarioService implements WorkflowRunExtension {
     private readonly engine;
     private runActors;
+    private runContexts;
     private scenarioBrowserProvider?;
     private scenarioEnvironment?;
     private runSurface;
@@ -154,7 +155,20 @@ export declare class PikkuScenarioService implements WorkflowRunExtension {
         actors?: ScenarioPersonas;
     }): Promise<void>;
     detachRunContext(runId: string): void;
-    decorateRunWire(wire: PikkuWire, context: {
+    /**
+     * What the run has accumulated, for a reporter that wants to say what a
+     * failed scenario left behind. Undefined for a plain workflow.
+     */
+    getRunContext(runId: string): Record<string, unknown> | undefined;
+    /**
+     * The run's context, created on demand.
+     *
+     * `attachRunContext` seeds it for an ordinary scenario run, but the wire is
+     * also built on paths that skip attach; without this the body would be
+     * writing to an `undefined` and teardown would read nothing.
+     */
+    private contextForRun;
+    decorateRunWire(wire: PikkuRawWire, context: {
         runId: string;
         workflowMeta: any;
         workflowWire: PikkuWorkflowWire;