@pikku/core 0.12.8 → 0.12.10

package/dist/wirings/credential/validate-credential-definitions.js

@@ -0,0 +1,38 @@
+export function validateAndBuildCredentialDefinitionsMeta(definitions, schemaLookup) {
+    const meta = {};
+    for (const def of definitions) {
+        const existing = meta[def.name];
+        if (existing) {
+            if (def.schema && existing.schema) {
+                const defSchemaRef = schemaLookup.get(def.schema);
+                const existingSchemaRef = schemaLookup.get(existing.schema);
+                if (defSchemaRef && existingSchemaRef) {
+                    if (defSchemaRef.variableName !== existingSchemaRef.variableName ||
+                        defSchemaRef.sourceFile !== existingSchemaRef.sourceFile) {
+                        throw new Error(`Credential '${def.name}' is defined with different schemas.\n` +
+                            `  First definition: ${existing.sourceFile} (schema: ${existingSchemaRef.variableName})\n` +
+                            `  Second definition: ${def.sourceFile} (schema: ${defSchemaRef.variableName})\n` +
+                            `Credentials sharing a name must use the same schema.`);
+                    }
+                }
+            }
+            if (def.type !== existing.type) {
+                throw new Error(`Credential '${def.name}' is defined with different types.\n` +
+                    `  First definition: ${existing.sourceFile} (type: ${existing.type})\n` +
+                    `  Second definition: ${def.sourceFile} (type: ${def.type})\n` +
+                    `Credentials sharing a name must use the same type.`);
+            }
+            continue;
+        }
+        meta[def.name] = {
+            name: def.name,
+            displayName: def.displayName,
+            description: def.description,
+            type: def.type,
+            schema: def.schema,
+            oauth2: def.oauth2,
+            sourceFile: def.sourceFile,
+        };
+    }
+    return meta;
+}

package/dist/wirings/credential/wire-credential.d.ts

@@ -0,0 +1,48 @@
+import type { CoreCredential } from './credential.types.js';
+/**
+ * No-op function for declaring credentials.
+ * This exists purely for TypeScript type checking and will be tree-shaken.
+ * The CLI extracts metadata via AST parsing.
+ *
+ * @example
+ * ```typescript
+ * // Per-user API key
+ * wireCredential({
+ *   name: 'stripe',
+ *   displayName: 'Stripe API Key',
+ *   type: 'wire',
+ *   schema: z.object({ apiKey: z.string() }),
+ * })
+ *
+ * // Per-user OAuth
+ * wireCredential({
+ *   name: 'google-sheets',
+ *   displayName: 'Google Sheets',
+ *   type: 'wire',
+ *   schema: z.object({ accessToken: z.string(), refreshToken: z.string() }),
+ *   oauth2: {
+ *     appCredentialSecretId: 'GOOGLE_OAUTH_APP',
+ *     authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+ *     tokenUrl: 'https://oauth2.googleapis.com/token',
+ *     scopes: ['https://www.googleapis.com/auth/spreadsheets'],
+ *     tokenSecretId: 'GOOGLE_OAUTH_TOKENS',
+ *   }
+ * })
+ *
+ * // Platform-level OAuth (singleton)
+ * wireCredential({
+ *   name: 'slack',
+ *   displayName: 'Slack',
+ *   type: 'singleton',
+ *   schema: z.object({ accessToken: z.string(), refreshToken: z.string() }),
+ *   oauth2: {
+ *     appCredentialSecretId: 'SLACK_OAUTH_APP',
+ *     authorizationUrl: 'https://slack.com/oauth/v2/authorize',
+ *     tokenUrl: 'https://slack.com/api/oauth.v2.access',
+ *     scopes: ['chat:write', 'channels:read'],
+ *     tokenSecretId: 'SLACK_OAUTH_TOKENS',
+ *   }
+ * })
+ * ```
+ */
+export declare const wireCredential: <T>(_config: CoreCredential<T>) => void;

package/dist/wirings/credential/wire-credential.js

@@ -0,0 +1,47 @@
+/**
+ * No-op function for declaring credentials.
+ * This exists purely for TypeScript type checking and will be tree-shaken.
+ * The CLI extracts metadata via AST parsing.
+ *
+ * @example
+ * ```typescript
+ * // Per-user API key
+ * wireCredential({
+ *   name: 'stripe',
+ *   displayName: 'Stripe API Key',
+ *   type: 'wire',
+ *   schema: z.object({ apiKey: z.string() }),
+ * })
+ *
+ * // Per-user OAuth
+ * wireCredential({
+ *   name: 'google-sheets',
+ *   displayName: 'Google Sheets',
+ *   type: 'wire',
+ *   schema: z.object({ accessToken: z.string(), refreshToken: z.string() }),
+ *   oauth2: {
+ *     appCredentialSecretId: 'GOOGLE_OAUTH_APP',
+ *     authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+ *     tokenUrl: 'https://oauth2.googleapis.com/token',
+ *     scopes: ['https://www.googleapis.com/auth/spreadsheets'],
+ *     tokenSecretId: 'GOOGLE_OAUTH_TOKENS',
+ *   }
+ * })
+ *
+ * // Platform-level OAuth (singleton)
+ * wireCredential({
+ *   name: 'slack',
+ *   displayName: 'Slack',
+ *   type: 'singleton',
+ *   schema: z.object({ accessToken: z.string(), refreshToken: z.string() }),
+ *   oauth2: {
+ *     appCredentialSecretId: 'SLACK_OAUTH_APP',
+ *     authorizationUrl: 'https://slack.com/oauth/v2/authorize',
+ *     tokenUrl: 'https://slack.com/api/oauth.v2.access',
+ *     scopes: ['chat:write', 'channels:read'],
+ *     tokenSecretId: 'SLACK_OAUTH_TOKENS',
+ *   }
+ * })
+ * ```
+ */
+export const wireCredential = (_config) => { };

package/dist/wirings/http/http-runner.js

@@ -2,6 +2,8 @@ import { NotFoundError, PikkuMissingMetaError } from '../../errors/errors.js';
 import { closeWireServices, createWeakUID, isSerializable, } from '../../utils.js';
 import { getSingletonServices, getCreateWireServices, } from '../../pikku-state.js';
 import { PikkuSessionService } from '../../services/user-session-service.js';
+import { getErrorResponse } from '../../errors/error-handler.js';
+import { PikkuCredentialWireService, createMiddlewareCredentialWireProps, } from '../../services/credential-wire-service.js';
 import { handleHTTPError } from '../../handle-error.js';
 import { pikkuState } from '../../pikku-state.js';
 import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
@@ -196,6 +198,7 @@ export const createHTTPWire = (request, response) => {
  */
 const executeRoute = async (services, matchedRoute, http, options) => {
     const userSession = new PikkuSessionService();
+    const credentialWire = new PikkuCredentialWireService();
     const { params, route, meta } = matchedRoute;
     const { singletonServices, createWireServices, skipUserSession, requestId } = services;
     // Attach URL parameters to the request object
@@ -256,6 +259,7 @@ const executeRoute = async (services, matchedRoute, http, options) => {
         setSession: (s) => userSession.setInitial(s),
         getSession: () => userSession.get(),
         hasSessionChanged: () => userSession.sessionChanged,
+        ...createMiddlewareCredentialWireProps(credentialWire),
     };
     result = await runPikkuFunc('http', `${meta.method}:${meta.route}`, meta.pikkuFuncId, {
         singletonServices,
@@ -270,6 +274,7 @@ const executeRoute = async (services, matchedRoute, http, options) => {
         tags: route.tags,
         wire,
         sessionService: userSession,
+        credentialWireService: credentialWire,
         packageName: meta.packageName,
     });
     if (!matchedRoute.route.sse) {
@@ -379,7 +384,7 @@ export const fetchData = async (request, response, { skipUserSession = false, re
                 apiRoute,
                 apiType,
             });
-            throw new NotFoundError(`Route not found: ${apiRoute}`);
+            throw new NotFoundError();
         }
         // Execute the matched route along with its middleware and session management
         ;
@@ -396,9 +401,10 @@ export const fetchData = async (request, response, { skipUserSession = false, re
             // For SSE routes, send error through the stream since the response is already in stream mode
             singletonServices.logger.error(e instanceof Error ? e.message : e);
             try {
+                const errorResponse = getErrorResponse(e);
                 response.arrayBuffer(JSON.stringify({
                     type: 'error',
-                    errorText: e instanceof Error ? e.message : String(e),
+                    errorText: errorResponse?.message ?? 'Internal server error',
                 }));
                 response.arrayBuffer(JSON.stringify({ type: 'done' }));
             }

package/dist/wirings/http/pikku-fetch-http-request.js

@@ -89,6 +89,9 @@ export class PikkuFetchHTTPRequest {
         const merged = {};
         for (const part of parts) {
             for (const [key, value] of Object.entries(part)) {
+                if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+                    continue;
+                }
                 if (key in merged && !valuesAreEquivalent(merged[key], value)) {
                     throw new UnprocessableContentError(`Conflicting values for key "${key}": "${merged[key]}" vs "${value}"`);
                 }
@@ -124,7 +127,14 @@ export class PikkuFetchHTTPRequest {
             }
             else if (contentType === 'application/x-www-form-urlencoded') {
                 const text = await this.request.text();
-                body = Object.fromEntries(new URLSearchParams(text));
+                const params = new URLSearchParams(text);
+                let count = 0;
+                for (const _ of params) {
+                    if (++count > 256) {
+                        throw new UnprocessableContentError('Too many form parameters');
+                    }
+                }
+                body = Object.fromEntries(params);
             }
             else {
                 throw new UnprocessableContentError(`Unsupported content type ${contentType}`);

package/dist/wirings/oauth2/index.d.ts

@@ -1,3 +1,4 @@
 export { OAuth2Client } from './oauth2-client.js';
-export { wireOAuth2Credential } from './wire-oauth2-credential.js';
+export { createOAuth2Handler } from './oauth2-routes.js';
+export type { CreateOAuth2HandlerOptions } from './oauth2-routes.js';
 export type { OAuth2AppCredential, OAuth2Token } from './oauth2.types.js';

package/dist/wirings/oauth2/index.js

@@ -1,2 +1,2 @@
 export { OAuth2Client } from './oauth2-client.js';
-export { wireOAuth2Credential } from './wire-oauth2-credential.js';
+export { createOAuth2Handler } from './oauth2-routes.js';

package/dist/wirings/oauth2/oauth2-client.js

@@ -26,7 +26,8 @@
  * })
  * ```
  */
-const DEFAULT_TIMEOUT_MS = 30000;
+const DEFAULT_TIMEOUT_MS = 30_000;
+const TOKEN_EXPIRY_BUFFER_MS = 60_000;
 /**
  * Helper to fetch with a timeout using AbortController.
  */
@@ -114,16 +115,13 @@ export class OAuth2Client {
      * Uses a promise lock to prevent concurrent refresh attempts.
      */
     async refreshAndGetToken() {
-        // If already refreshing, wait for that to complete
         if (this.refreshPromise) {
             const token = await this.refreshPromise;
             return token.accessToken;
         }
-        // Start refresh
         this.refreshPromise = this.doRefreshToken();
         try {
             const token = await this.refreshPromise;
-            this.cachedToken = token;
             return token.accessToken;
         }
         finally {
@@ -169,9 +167,8 @@ export class OAuth2Client {
             tokenType: data.token_type || 'Bearer',
             scope: data.scope,
         };
-        // Cache and persist the refreshed token
-        this.cachedToken = token;
         await this.secrets.setSecretJSON(this.oauth2Config.tokenSecretId, token);
+        this.cachedToken = token;
         return token;
     }
     /**
@@ -181,8 +178,7 @@ export class OAuth2Client {
         if (!token.expiresAt) {
             return true; // No expiry info, assume valid
         }
-        // Add 60 second buffer to account for clock skew
-        return token.expiresAt > Date.now() + 60000;
+        return token.expiresAt > Date.now() + TOKEN_EXPIRY_BUFFER_MS;
     }
     /**
      * Get app credentials (cached).

package/dist/wirings/oauth2/oauth2-routes.d.ts

@@ -0,0 +1,35 @@
+import type { CredentialDefinitionsMeta } from '../credential/credential.types.js';
+export type CreateOAuth2HandlerOptions = {
+    credentialsMeta: CredentialDefinitionsMeta;
+    basePath?: string;
+};
+/**
+ * Creates OAuth2 route handlers for user credential management.
+ *
+ * Returns individual handler functions for connect/callback/disconnect/status
+ * that handle the OAuth2 authorization code flow and store tokens in CredentialService.
+ *
+ * @example
+ * ```typescript
+ * const oauth2 = createOAuth2Handler({ credentialsMeta })
+ *
+ * const oauth2Routes = defineHTTPRoutes({
+ *   auth: true,
+ *   basePath: '/credentials',
+ *   routes: {
+ *     connect: { method: 'get', route: '/:name/connect', func: oauth2.connect },
+ *     callback: { method: 'get', route: '/:name/callback', func: oauth2.callback, auth: false },
+ *     disconnect: { method: 'delete', route: '/:name', func: oauth2.disconnect },
+ *     status: { method: 'get', route: '/:name/status', func: oauth2.status },
+ *   },
+ * })
+ *
+ * wireHTTPRoutes({ routes: { credentials: oauth2Routes } })
+ * ```
+ */
+export declare const createOAuth2Handler: (options: CreateOAuth2HandlerOptions) => {
+    connect: any;
+    callback: any;
+    disconnect: any;
+    status: any;
+};

package/dist/wirings/oauth2/oauth2-routes.js

@@ -0,0 +1,146 @@
+import { OAuth2Client } from './oauth2-client.js';
+const TOKEN_EXPIRY_BUFFER_MS = 60_000;
+function getCredentialMeta(ctx, name) {
+    const meta = ctx.credentialsMeta[name];
+    if (!meta) {
+        throw new Error(`Credential '${name}' not found`);
+    }
+    if (!meta.oauth2) {
+        throw new Error(`Credential '${name}' is not an OAuth2 credential`);
+    }
+    return meta;
+}
+/**
+ * Creates OAuth2 route handlers for user credential management.
+ *
+ * Returns individual handler functions for connect/callback/disconnect/status
+ * that handle the OAuth2 authorization code flow and store tokens in CredentialService.
+ *
+ * @example
+ * ```typescript
+ * const oauth2 = createOAuth2Handler({ credentialsMeta })
+ *
+ * const oauth2Routes = defineHTTPRoutes({
+ *   auth: true,
+ *   basePath: '/credentials',
+ *   routes: {
+ *     connect: { method: 'get', route: '/:name/connect', func: oauth2.connect },
+ *     callback: { method: 'get', route: '/:name/callback', func: oauth2.callback, auth: false },
+ *     disconnect: { method: 'delete', route: '/:name', func: oauth2.disconnect },
+ *     status: { method: 'get', route: '/:name/status', func: oauth2.status },
+ *   },
+ * })
+ *
+ * wireHTTPRoutes({ routes: { credentials: oauth2Routes } })
+ * ```
+ */
+export const createOAuth2Handler = (options) => {
+    const basePath = options.basePath ?? '/credentials';
+    const ctx = {
+        credentialsMeta: options.credentialsMeta,
+        basePath,
+    };
+    const connectHandler = async (services, _data, wire) => {
+        const { name } = wire.http.request.params();
+        const meta = getCredentialMeta(ctx, name);
+        const queryParams = wire.http.request.query();
+        const redirectUrl = queryParams.redirect_url || queryParams.redirect;
+        const oauth2Client = new OAuth2Client(meta.oauth2, meta.oauth2.appCredentialSecretId, services.secrets);
+        const userId = wire.session?.userId;
+        if (!userId) {
+            throw new Error('Authentication required for OAuth2 connect');
+        }
+        const state = await services.jwt.encode({ value: 10, unit: 'minute' }, {
+            userId,
+            credentialName: name,
+            redirectUrl,
+        });
+        let origin = wire.http.request.header('origin');
+        if (!origin) {
+            const host = wire.http.request.header('host');
+            if (!host) {
+                throw new Error('Unable to determine request origin for OAuth2 callback');
+            }
+            const protocol = wire.http.request.header('x-forwarded-proto') || 'http';
+            origin = `${protocol}://${host}`;
+        }
+        const callbackUrl = `${origin}${basePath}/${name}/callback`;
+        const authUrl = await oauth2Client.getAuthorizationUrl(state, callbackUrl);
+        return Response.redirect(authUrl, 302);
+    };
+    const callbackHandler = async (services, _data, wire) => {
+        const { name } = wire.http.request.params();
+        const meta = getCredentialMeta(ctx, name);
+        const queryParams = wire.http.request.query();
+        const code = queryParams.code;
+        const state = queryParams.state;
+        if (!code || !state) {
+            throw new Error('Missing code or state parameter');
+        }
+        let statePayload;
+        try {
+            statePayload = await services.jwt.decode(state);
+        }
+        catch {
+            throw new Error('Invalid or expired OAuth2 state');
+        }
+        if (statePayload.credentialName !== name) {
+            throw new Error('Credential name mismatch in state');
+        }
+        const oauth2Client = new OAuth2Client(meta.oauth2, meta.oauth2.appCredentialSecretId, services.secrets);
+        let origin = wire.http.request.header('origin');
+        if (!origin) {
+            const host = wire.http.request.header('host');
+            if (!host) {
+                throw new Error('Unable to determine request origin for OAuth2 callback');
+            }
+            const protocol = wire.http.request.header('x-forwarded-proto') || 'http';
+            origin = `${protocol}://${host}`;
+        }
+        const callbackUrl = `${origin}${basePath}/${name}/callback`;
+        const tokens = await oauth2Client.exchangeCode(code, callbackUrl);
+        await services.credentialService.set(name, tokens, statePayload.userId);
+        services.logger.info(`OAuth2 tokens stored for user '${statePayload.userId}', credential '${name}'`);
+        if (statePayload.redirectUrl) {
+            return Response.redirect(statePayload.redirectUrl, 302);
+        }
+        else {
+            return { success: true, credentialName: name };
+        }
+    };
+    const disconnectHandler = async (services, _data, wire) => {
+        const { name } = wire.http.request.params();
+        const userId = wire.session?.userId;
+        if (!userId) {
+            throw new Error('Authentication required');
+        }
+        await services.credentialService.delete(name, userId);
+        services.logger.info(`OAuth2 credential '${name}' disconnected for user '${userId}'`);
+        return { success: true };
+    };
+    const statusHandler = async (services, _data, wire) => {
+        const { name } = wire.http.request.params();
+        const userId = wire.session?.userId;
+        if (!userId) {
+            throw new Error('Authentication required');
+        }
+        const credential = await services.credentialService.get(name, userId);
+        if (!credential) {
+            return { connected: false };
+        }
+        return {
+            connected: true,
+            hasRefreshToken: !!credential.refreshToken,
+            expiresAt: credential.expiresAt,
+            isExpired: credential.expiresAt
+                ? credential.expiresAt < Date.now() + TOKEN_EXPIRY_BUFFER_MS
+                : false,
+        };
+    };
+    return {
+        connect: { func: connectHandler },
+        callback: { func: callbackHandler },
+        disconnect: { func: disconnectHandler },
+        status: { func: statusHandler },
+    };
+};

package/dist/wirings/oauth2/oauth2.types.d.ts

@@ -37,29 +37,3 @@ export type OAuth2Config = {
     /** Additional query parameters for authorization URL */
     additionalParams?: Record<string, string>;
 };
-/**
- * Configuration for wireOAuth2Credential.
- * Combines standard credential fields with OAuth2-specific config.
- */
-export type CoreOAuth2Credential = {
-    /** Unique identifier for this credential */
-    name: string;
-    /** Human-readable name for UI display */
-    displayName: string;
-    /** Optional description for UI */
-    description?: string;
-    /** Key used with SecretService to retrieve app credentials (clientId/clientSecret) */
-    secretId: string;
-    /** Where access/refresh tokens are stored */
-    tokenSecretId: string;
-    /** OAuth2 authorization URL */
-    authorizationUrl: string;
-    /** OAuth2 token exchange URL */
-    tokenUrl: string;
-    /** Required scopes */
-    scopes: string[];
-    /** Use PKCE flow */
-    pkce?: boolean;
-    /** Additional query parameters for authorization URL */
-    additionalParams?: Record<string, string>;
-};

package/dist/wirings/workflow/graph/graph-runner.d.ts

@@ -1,5 +1,12 @@
-import type { PikkuWorkflowService } from '../pikku-workflow-service.js';
+import { type PikkuWorkflowService } from '../pikku-workflow-service.js';
 import type { WorkflowRuntimeMeta, WorkflowRunWire } from '../workflow.types.js';
+export declare class ChildWorkflowStartedException extends Error {
+    parentRunId: string;
+    stepId: string;
+    childRunId: string;
+    name: string;
+    constructor(parentRunId: string, stepId: string, childRunId: string);
+}
 export declare function continueGraph(workflowService: PikkuWorkflowService, runId: string, graphName: string, overrideMeta?: WorkflowRuntimeMeta): Promise<void>;
 export declare function executeGraphStep(workflowService: PikkuWorkflowService, rpcService: any, runId: string, stepId: string, nodeId: string, rpcName: string, data: any, graphName: string): Promise<any>;
 export declare function onGraphNodeComplete(workflowService: PikkuWorkflowService, runId: string, graphName: string): Promise<void>;

package/dist/wirings/workflow/graph/graph-runner.js

@@ -1,5 +1,18 @@
-import { pikkuState } from '../../../pikku-state.js';
+import { WorkflowAsyncException, WorkflowSuspendedException, } from '../pikku-workflow-service.js';
+import { pikkuState, getSingletonServices } from '../../../pikku-state.js';
 import { RPCNotFoundError } from '../../rpc/rpc-runner.js';
+export class ChildWorkflowStartedException extends Error {
+    parentRunId;
+    stepId;
+    childRunId;
+    name = 'ChildWorkflowStartedException';
+    constructor(parentRunId, stepId, childRunId) {
+        super(`Child workflow started: ${childRunId}`);
+        this.parentRunId = parentRunId;
+        this.stepId = stepId;
+        this.childRunId = childRunId;
+    }
+}
 function buildTemplateRegex(nodeId) {
     if (!nodeId.includes('${'))
         return null;
@@ -321,15 +334,51 @@ export async function executeGraphStep(workflowService, rpcService, runId, stepI
         getState: () => workflowService.getRunState(runId),
     };
     try {
-        const result = await rpcService.rpcWithWire(rpcName, data, {
-            graph: graphWire,
-        });
+        let result;
+        const subWorkflowMeta = pikkuState(null, 'workflows', 'meta')[rpcName];
+        if (subWorkflowMeta) {
+            const childWire = {
+                type: 'workflow',
+                id: rpcName,
+                parentRunId: runId,
+                parentStepId: stepId,
+            };
+            const shouldInline = subWorkflowMeta.inline || !getSingletonServices()?.queueService;
+            const { runId: childRunId } = await workflowService.startWorkflow(rpcName, data, childWire, rpcService, { inline: shouldInline });
+            await workflowService.setStepChildRunId(stepId, childRunId);
+            if (shouldInline) {
+                const childRun = await workflowService.getRun(childRunId);
+                if (childRun?.status === 'failed') {
+                    throw new Error(childRun.error?.message || 'Sub-workflow failed');
+                }
+                if (childRun?.status === 'cancelled') {
+                    throw new Error('Sub-workflow was cancelled');
+                }
+                result = childRun?.output;
+            }
+            else {
+                throw new ChildWorkflowStartedException(runId, stepId, childRunId);
+            }
+        }
+        else {
+            result = await rpcService.rpcWithWire(rpcName, data, {
+                graph: graphWire,
+                workflow: workflowService.createWorkflowWire(graphName, runId, rpcService),
+            });
+        }
         if (wireState.branchKey) {
             await workflowService.setBranchTaken(stepId, wireState.branchKey);
         }
         return result;
     }
     catch (error) {
+        if (error instanceof WorkflowAsyncException ||
+            error instanceof WorkflowSuspendedException) {
+            throw error;
+        }
+        if (error instanceof ChildWorkflowStartedException) {
+            throw error;
+        }
         if (error instanceof RPCNotFoundError) {
             await workflowService.updateRunStatus(runId, 'suspended', undefined, {
                 message: `RPC '${rpcName}' not found. Deploy the missing function and resume.`,
@@ -381,15 +430,42 @@ async function executeGraphNodeInline(workflowService, rpcService, runId, graphN
         getState: () => workflowService.getRunState(runId),
     };
     try {
-        const result = await rpcService.rpcWithWire(rpcName, input, {
-            graph: graphWire,
-        });
+        let result;
+        const subWorkflowMeta = pikkuState(null, 'workflows', 'meta')[rpcName];
+        if (subWorkflowMeta) {
+            const childWire = {
+                type: 'workflow',
+                id: rpcName,
+                parentRunId: runId,
+                parentStepId: stepState.stepId,
+            };
+            const { runId: childRunId } = await workflowService.startWorkflow(rpcName, input, childWire, rpcService, { inline: true });
+            await workflowService.setStepChildRunId(stepState.stepId, childRunId);
+            const childRun = await workflowService.getRun(childRunId);
+            if (childRun?.status === 'failed') {
+                throw new Error(childRun.error?.message || 'Sub-workflow failed');
+            }
+            if (childRun?.status === 'cancelled') {
+                throw new Error('Sub-workflow was cancelled');
+            }
+            result = childRun?.output;
+        }
+        else {
+            result = await rpcService.rpcWithWire(rpcName, input, {
+                graph: graphWire,
+                workflow: workflowService.createWorkflowWire(graphName, runId, rpcService),
+            });
+        }
         if (wireState.branchKey) {
             await workflowService.setBranchTaken(stepState.stepId, wireState.branchKey);
         }
         await workflowService.setStepResult(stepState.stepId, result);
     }
     catch (error) {
+        if (error instanceof WorkflowAsyncException ||
+            error instanceof WorkflowSuspendedException) {
+            throw error;
+        }
         if (error instanceof RPCNotFoundError) {
             await workflowService.setStepError(stepState.stepId, error);
             await workflowService.updateRunStatus(runId, 'suspended', undefined, {
@@ -510,6 +586,10 @@ export async function runWorkflowGraph(workflowService, graphName, triggerInput,
                 await continueGraphInline(workflowService, rpcService, runId, graphName, nodes, triggerInput, entryNodes);
             }
             catch (error) {
+                if (error instanceof WorkflowAsyncException ||
+                    error instanceof WorkflowSuspendedException) {
+                    return;
+                }
                 await workflowService.updateRunStatus(runId, 'failed', undefined, {
                     message: error.message,
                     stack: error.stack || '',

package/dist/wirings/workflow/pikku-workflow-service.d.ts

@@ -1,5 +1,5 @@
 import type { SerializedError } from '../../types/core.types.js';
-import type { StepState, WorkflowRun, WorkflowRunWire, WorkflowStatus, WorkflowVersionStatus, WorkflowStepOptions } from './workflow.types.js';
+import type { PikkuWorkflowWire, StepState, WorkflowRun, WorkflowRunWire, WorkflowStatus, WorkflowVersionStatus, WorkflowStepOptions } from './workflow.types.js';
 import type { WorkflowService } from '../../services/workflow-service.js';
 import { PikkuError } from '../../errors/error-handler.js';
 /**
@@ -47,6 +47,7 @@ export declare class WorkflowStepNameNotString extends Error {
  */
 export declare abstract class PikkuWorkflowService implements WorkflowService {
     private inlineRuns;
+    protected get logger(): import("../../services/logger.js").Logger;
     constructor();
     /**
      * Check if a run is executing inline (without queues)
@@ -249,6 +250,8 @@ export declare abstract class PikkuWorkflowService implements WorkflowService {
         wire?: WorkflowRunWire;
     }): Promise<any>;
     runWorkflowJob(runId: string, rpcService: any): Promise<void>;
+    private onChildWorkflowCompleted;
+    private onChildWorkflowFailed;
     private runVersionMismatchFallback;
     /**
      * Execute a single workflow step (called by worker)
@@ -266,7 +269,7 @@ export declare abstract class PikkuWorkflowService implements WorkflowService {
     private sleepStep;
     private getSuspendStepName;
     private suspendStep;
-    private createWorkflowWire;
+    createWorkflowWire(name: string, runId: string, rpcService: any): PikkuWorkflowWire;
     private verifyStepName;
     private getConfig;
 }