@pikku/core 0.12.8 → 0.12.9

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 ## 0.12.4
 
+## 0.12.9
+
+### Patch Changes
+
+- e412b4d: Replace raw Error throws in AI agent runner/stream/prepare with typed PikkuError subclasses. `AIProviderNotConfiguredError` (503) replaces "AIAgentRunnerService not available" with a user-friendly message. `AIProviderAuthError` (401) available for API key validation errors.
+- 53dc8c8: Fix toWebRequest to respect x-forwarded-proto and x-forwarded-host headers behind reverse proxies. Previously always used http:// which broke OAuth callback URLs behind TLS-terminating proxies like Fly.io.
+- 0a1cc51: Add secure defaults for cookie authentication: httpOnly, secure, sameSite 'lax', and path '/'. User-provided options override these defaults.
+- 0a1cc51: Prevent internal error details from leaking to clients. Stack traces via exposeErrors are now blocked in production. SSE and WebSocket error handlers use registered error responses instead of raw error messages. Secret key names and route paths are no longer included in error messages.
+- 0a1cc51: Cap form-urlencoded parameters at 256 to prevent abuse via unbounded parameter parsing.
+- 0a1cc51: Add path traversal protection to LocalContent file operations. Asset keys are now validated to stay within the configured upload directory.
+- 0a1cc51: Use private Symbol for global pikku state key to prevent external code from accessing framework internals via Symbol.for().
+- 0a1cc51: Filter out **proto**, constructor, and prototype keys during request data merging to prevent prototype pollution.
+- 0a1cc51: Improve LocalContent URL signing with proper signedAt/expiresAt parameters. When an optional JWTService is provided, URLs include a cryptographic signature for verification.
+- 0a1cc51: Fix timeout middleware to use Promise.race instead of throwing inside setTimeout, which caused uncatchable exceptions that crashed the process.
+- 0a1cc51: Use constant-time comparison for static bearer token authentication to prevent timing side-channel attacks.
+- 8b9b2e9: Fix child workflow completion in queued execution mode. When a sub-workflow completes, the parent step is now marked as succeeded and the parent orchestrator resumes automatically via `onChildWorkflowCompleted`. Adds `parentStepId` to `WorkflowRunWire` to track the parent step without querying. Retains advisory locks in PgKyselyWorkflowService for concurrency safety. Fixes pgboss `registerQueues` to accept an optional logger parameter.
+- 8b9b2e9: Add debug-level logging to workflow service for step scheduling, execution, and orchestration to aid troubleshooting.
+- b973d44: Add `inline` property to workflow function definitions. When `inline: true` is set on a workflow, it always executes inline without dispatching to the queue service, even when a queue service is available. This is useful for workflows that should run synchronously within the parent process (e.g. scaffolding/setup steps that produce local files).
+
+  The flag flows from the function definition through the inspector, into the serialized workflow graph, and is checked at runtime by the workflow service.
+
+- 8b9b2e9: Strip undefined values from workflow step data before dispatching to the queue service, preventing postgres UNDEFINED_VALUE errors.
+- 8b9b2e9: Support sub-workflow invocation in graph-based workflow steps. When a step's rpcName refers to a registered workflow instead of an RPC function, `executeGraphStep` now starts it as a child workflow and polls for completion. Respects the `inline` meta flag on the sub-workflow.
+
 ## 0.12.8
 
 ### Patch Changes

package/dist/env.d.ts

@@ -0,0 +1 @@
+export declare const isProduction: () => boolean;

package/dist/env.js

@@ -0,0 +1 @@
+export const isProduction = () => process.env.NODE_ENV === 'production';

package/dist/errors/errors.d.ts

@@ -204,3 +204,17 @@ export declare class MaxComputeTimeReachedError extends PikkuError {
  */
 export declare class MissingSchemaError extends PikkuError {
 }
+/**
+ * An AI provider has not been configured. Set up an AI provider (e.g. OpenAI, Anthropic) to use agent features.
+ * @group Error
+ */
+export declare class AIProviderNotConfiguredError extends PikkuError {
+    constructor();
+}
+/**
+ * The AI provider API key is missing or invalid.
+ * @group Error
+ */
+export declare class AIProviderAuthError extends PikkuError {
+    constructor(message?: string);
+}

package/dist/errors/errors.js

@@ -347,3 +347,30 @@ addError(MissingSchemaError, {
     status: 500,
     message: 'A required schema was not found. Ensure schema generation has been run.',
 });
+/**
+ * An AI provider has not been configured. Set up an AI provider (e.g. OpenAI, Anthropic) to use agent features.
+ * @group Error
+ */
+export class AIProviderNotConfiguredError extends PikkuError {
+    constructor() {
+        super('No AI provider configured. Please set up an AI provider (e.g. OpenAI, Anthropic) and provide a valid API key to use this agent.');
+    }
+}
+addError(AIProviderNotConfiguredError, {
+    status: 503,
+    message: 'No AI provider configured. Please set up an AI provider (e.g. OpenAI, Anthropic) and provide a valid API key to use this agent.',
+});
+/**
+ * The AI provider API key is missing or invalid.
+ * @group Error
+ */
+export class AIProviderAuthError extends PikkuError {
+    constructor(message) {
+        super(message ||
+            'AI provider API key is missing or invalid. Please check your API key configuration.');
+    }
+}
+addError(AIProviderAuthError, {
+    status: 401,
+    message: 'AI provider API key is missing or invalid. Please check your API key configuration.',
+});

package/dist/handle-error.js

@@ -1,3 +1,4 @@
+import { isProduction } from './env.js';
 import { getErrorResponse } from './errors/error-handler.js';
 import { NotFoundError } from './errors/errors.js';
 /**
@@ -41,7 +42,7 @@ export const handleHTTPError = (e, http, trackerId, logger, logWarningsForStatus
         if (trackerId) {
             logger.warn(`Error id: ${trackerId}`);
             const errorBody = { errorId: trackerId };
-            if (exposeErrors && e instanceof Error) {
+            if (exposeErrors && !isProduction() && e instanceof Error) {
                 errorBody.message = e.message;
                 errorBody.stack = e.stack;
             }

package/dist/middleware/auth-bearer.js

@@ -1,5 +1,14 @@
 import { InvalidSessionError } from '../errors/errors.js';
 import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+const constantTimeEqual = (a, b) => {
+    if (a.length !== b.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return result === 0;
+};
 /**
  * Bearer token middleware that extracts and validates tokens from the Authorization header.
  *
@@ -41,7 +50,7 @@ export const authBearer = pikkuMiddlewareFactory(({ token } = {}) => pikkuMiddle
             throw new InvalidSessionError();
         }
         let userSession = null;
-        if (token && bearerToken === token.value) {
+        if (token && constantTimeEqual(bearerToken, token.value)) {
             userSession = token.userSession;
         }
         else if (jwtService && !token) {

package/dist/middleware/auth-cookie.js

@@ -28,31 +28,40 @@ import { getRelativeTimeOffsetFromNow } from '../time-utils.js';
  * ])
  * ```
  */
-export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn }) => pikkuMiddleware(async ({ jwt: jwtService, logger }, { http, setSession, getSession, session, hasSessionChanged }, next) => {
-    if (!http?.request || !setSession || session) {
-        return next();
-    }
-    const cookieValue = http.request.cookie(name);
-    if (cookieValue && jwtService) {
-        const userSession = await jwtService.decode(cookieValue);
-        if (userSession) {
-            setSession?.(userSession);
+export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn }) => {
+    const mergedOptions = {
+        httpOnly: true,
+        secure: true,
+        sameSite: 'lax',
+        path: '/',
+        ...options,
+    };
+    return pikkuMiddleware(async ({ jwt: jwtService, logger }, { http, setSession, getSession, session, hasSessionChanged }, next) => {
+        if (!http?.request || !setSession || session) {
+            return next();
         }
-    }
-    await next();
-    if (!http?.response) {
-        return;
-    }
-    if (hasSessionChanged?.()) {
-        const currentSession = await getSession?.();
-        if (jwtService) {
-            http.response.cookie(name, await jwtService.encode(expiresIn, currentSession), {
-                ...options,
-                expires: getRelativeTimeOffsetFromNow(expiresIn),
-            });
+        const cookieValue = http.request.cookie(name);
+        if (cookieValue && jwtService) {
+            const userSession = await jwtService.decode(cookieValue);
+            if (userSession) {
+                setSession?.(userSession);
+            }
         }
-        else {
-            logger.warn('No JWT service available, unable to set cookie');
+        await next();
+        if (!http?.response) {
+            return;
         }
-    }
-}));
+        if (hasSessionChanged?.()) {
+            const currentSession = await getSession?.();
+            if (jwtService) {
+                http.response.cookie(name, await jwtService.encode(expiresIn, currentSession), {
+                    ...mergedOptions,
+                    expires: getRelativeTimeOffsetFromNow(expiresIn),
+                });
+            }
+            else {
+                logger.warn('No JWT service available, unable to set cookie');
+            }
+        }
+    });
+});

package/dist/middleware/timeout.js

@@ -1,9 +1,15 @@
 import { RequestTimeoutError } from '../errors/errors.js';
 import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
 export const timeout = () => pikkuMiddlewareFactory(({ timeout }) => pikkuMiddleware(async (_services, _wire, next) => {
-    const timeoutId = setTimeout(() => {
-        throw new RequestTimeoutError();
-    }, timeout);
-    await next();
-    clearTimeout(timeoutId);
+    let timeoutId;
+    await Promise.race([
+        next(),
+        new Promise((_resolve, reject) => {
+            timeoutId = setTimeout(() => reject(new RequestTimeoutError()), timeout);
+        }),
+    ]).finally(() => {
+        if (timeoutId !== undefined) {
+            clearTimeout(timeoutId);
+        }
+    });
 }));

package/dist/pikku-state.js

@@ -1,4 +1,4 @@
-const PIKKU_STATE_KEY = Symbol.for('@pikku/core/state');
+const PIKKU_STATE_KEY = Symbol('@pikku/core/state');
 export const getAllPackageStates = () => {
     if (!globalThis[PIKKU_STATE_KEY]) {
         ;

package/dist/services/local-content.d.ts

@@ -1,4 +1,4 @@
-import type { ContentService, Logger } from '@pikku/core/services';
+import type { ContentService, JWTService, Logger } from '@pikku/core/services';
 export interface LocalContentConfig {
     localFileUploadPath: string;
     uploadUrlPrefix: string;
@@ -9,10 +9,13 @@ export interface LocalContentConfig {
 export declare class LocalContent implements ContentService {
     private config;
     private logger;
-    constructor(config: LocalContentConfig, logger: Logger);
+    private jwt?;
+    constructor(config: LocalContentConfig, logger: Logger, jwt?: JWTService | undefined);
+    private safePath;
     init(): Promise<void>;
-    signURL(url: string): Promise<string>;
-    signContentKey(assetKey: string): Promise<string>;
+    private signParams;
+    signURL(url: string, dateLessThan: Date, dateGreaterThan?: Date): Promise<string>;
+    signContentKey(assetKey: string, dateLessThan: Date, dateGreaterThan?: Date): Promise<string>;
     getUploadURL(assetKey: string): Promise<{
         uploadUrl: string;
         assetKey: string;

package/dist/services/local-content.js

@@ -1,21 +1,51 @@
 import { createReadStream, createWriteStream, promises } from 'fs';
 import { mkdir, readFile } from 'fs/promises';
+import { resolve, normalize } from 'path';
 import { pipeline } from 'stream/promises';
 export class LocalContent {
     config;
     logger;
-    constructor(config, logger) {
+    jwt;
+    constructor(config, logger, jwt) {
         this.config = config;
         this.logger = logger;
+        this.jwt = jwt;
+    }
+    safePath(assetKey) {
+        const base = resolve(this.config.localFileUploadPath);
+        const target = resolve(base, normalize(assetKey));
+        if (!target.startsWith(base + '/') && target !== base) {
+            throw new Error('Invalid asset key');
+        }
+        return target;
     }
     async init() { }
-    async signURL(url) {
-        return `${url}?signed=true`;
+    async signParams(dateLessThan, dateGreaterThan) {
+        const signedAt = Date.now();
+        const expiresAt = dateLessThan.getTime();
+        const params = new URLSearchParams({
+            signedAt: String(signedAt),
+            expiresAt: String(expiresAt),
+        });
+        if (dateGreaterThan) {
+            params.set('notBefore', String(dateGreaterThan.getTime()));
+        }
+        if (this.jwt) {
+            const expiresInSeconds = Math.max(1, Math.floor((expiresAt - signedAt) / 1000));
+            const signature = await this.jwt.encode({ value: expiresInSeconds, unit: 'second' }, { signedAt, expiresAt });
+            params.set('signature', signature);
+        }
+        return params.toString();
+    }
+    async signURL(url, dateLessThan, dateGreaterThan) {
+        const params = await this.signParams(dateLessThan, dateGreaterThan);
+        return `${url}?${params}`;
     }
-    async signContentKey(assetKey) {
-        return this.config.server
-            ? `${this.config.server}${this.config.assetUrlPrefix}/${assetKey}?signed=true`
-            : `${this.config.assetUrlPrefix}/${assetKey}?signed=true`;
+    async signContentKey(assetKey, dateLessThan, dateGreaterThan) {
+        const base = this.config.server
+            ? `${this.config.server}${this.config.assetUrlPrefix}/${assetKey}`
+            : `${this.config.assetUrlPrefix}/${assetKey}`;
+        return this.signURL(base, dateLessThan, dateGreaterThan);
     }
     async getUploadURL(assetKey) {
         this.logger.debug(`Going to upload with key: ${assetKey}`);
@@ -26,7 +56,7 @@ export class LocalContent {
     }
     async writeFile(assetKey, stream) {
         this.logger.debug(`Writing file: ${assetKey}`);
-        const path = `${this.config.localFileUploadPath}/${assetKey}`;
+        const path = this.safePath(assetKey);
         try {
             await this.createDirectoryForFile(path);
             const fileStream = createWriteStream(path);
@@ -43,7 +73,7 @@ export class LocalContent {
     async copyFile(assetKey, fromAbsolutePath) {
         this.logger.debug(`Writing file: ${assetKey}`);
         try {
-            const path = `${this.config.localFileUploadPath}/${assetKey}`;
+            const path = this.safePath(assetKey);
             await this.createDirectoryForFile(path);
             await promises.copyFile(fromAbsolutePath, path);
         }
@@ -55,7 +85,7 @@ export class LocalContent {
     }
     async readFile(assetKey) {
         this.logger.debug(`Getting key: ${assetKey}`);
-        const filePath = `${this.config.localFileUploadPath}/${assetKey}`;
+        const filePath = this.safePath(assetKey);
         try {
             const stream = createReadStream(filePath);
             // Handle early stream errors (like file not found, permission denied, etc.)
@@ -70,14 +100,14 @@ export class LocalContent {
         }
     }
     async readFileAsBuffer(assetKey) {
-        const filePath = `${this.config.localFileUploadPath}/${assetKey}`;
+        const filePath = this.safePath(assetKey);
         this.logger.debug(`Reading file as buffer: ${assetKey}`);
         return readFile(filePath);
     }
     async deleteFile(assetKey) {
         this.logger.debug(`deleting key: ${assetKey}`);
         try {
-            await promises.unlink(`${this.config.localFileUploadPath}/${assetKey}`);
+            await promises.unlink(this.safePath(assetKey));
             return true;
         }
         catch (e) {

package/dist/services/local-secrets.js

@@ -30,7 +30,7 @@ export class LocalSecretService {
         if (value) {
             return JSON.parse(value);
         }
-        throw new Error(`Secret Not Found: ${key}`);
+        throw new Error('Requested secret not found');
     }
     /**
      * Retrieves a secret by key.
@@ -50,7 +50,7 @@ export class LocalSecretService {
         if (value) {
             return value;
         }
-        throw new Error(`Secret Not Found: ${key}`);
+        throw new Error('Requested secret not found');
     }
     /**
      * Stores a JSON value as a secret in local storage.

package/dist/testing/service-tests.js

@@ -523,7 +523,7 @@ export function defineServiceTests(config) {
             test('getSecret throws for missing key', async () => {
                 const service = await factory({ key: kek });
                 await assert.rejects(() => service.getSecret('nonexistent'), {
-                    message: 'Secret not found: nonexistent',
+                    message: 'Requested secret not found',
                 });
             });
             test('setSecretJSON upserts existing key', async () => {

package/dist/wirings/ai-agent/ai-agent-prepare.js

@@ -1,4 +1,5 @@
 import { PikkuError } from '../../errors/error-handler.js';
+import { AIProviderNotConfiguredError } from '../../errors/errors.js';
 import { pikkuState, getSingletonServices } from '../../pikku-state.js';
 import { createMiddlewareSessionWireProps } from '../../services/user-session-service.js';
 import { randomUUID } from 'crypto';
@@ -354,7 +355,7 @@ export async function prepareAgentRun(agentName, input, params, agentSessionMap,
     const { agent, packageName, resolvedName } = resolveAgent(agentName);
     const agentRunner = singletonServices.aiAgentRunner;
     if (!agentRunner) {
-        throw new Error('AIAgentRunnerService not available in singletonServices');
+        throw new AIProviderNotConfiguredError();
     }
     if (agent.dynamicWorkflows && singletonServices.workflowService) {
         const persisted = await singletonServices.workflowService.getAIGeneratedWorkflows(resolvedName);

package/dist/wirings/ai-agent/ai-agent-runner.js

@@ -3,6 +3,7 @@ import { prepareAgentRun, resolveAgent, buildInstructions, buildToolDefs, } from
 import { checkForApprovals, appendStepMessages } from './ai-agent-stream.js';
 import { pikkuState, getSingletonServices } from '../../pikku-state.js';
 import { resolveModelConfig } from './ai-agent-model-config.js';
+import { AIProviderNotConfiguredError } from '../../errors/errors.js';
 import { randomUUID } from 'crypto';
 export async function runAIAgent(agentName, input, params, agentSessionMap) {
     const sessionMap = agentSessionMap ?? new Map();
@@ -262,7 +263,7 @@ export async function resumeAIAgentSync(runId, approvals, params, expectedAgentN
     const memoryConfig = agent.memory;
     const agentRunner = singletonServices.aiAgentRunner;
     if (!agentRunner) {
-        throw new Error('AIAgentRunnerService not available');
+        throw new AIProviderNotConfiguredError();
     }
     const approvedIds = new Set(approvals.filter((a) => a.approved).map((a) => a.toolCallId));
     const rejectedIds = new Set(approvals.filter((a) => !a.approved).map((a) => a.toolCallId));

package/dist/wirings/ai-agent/ai-agent-stream.js

@@ -1,4 +1,5 @@
 import { pikkuState, getSingletonServices } from '../../pikku-state.js';
+import { AIProviderNotConfiguredError } from '../../errors/errors.js';
 import { combineChannelMiddleware, wrapChannelWithMiddleware, } from '../channel/channel-middleware-runner.js';
 import { randomUUID } from 'crypto';
 import { parseWorkingMemory, deepMergeWorkingMemory, resolveMemoryServices, loadContextMessages, trimMessages, } from './ai-agent-memory.js';
@@ -471,7 +472,7 @@ export async function resumeAIAgent(input, channel, params, options) {
     const memoryConfig = agent.memory;
     const agentRunner = singletonServices.aiAgentRunner;
     if (!agentRunner) {
-        throw new Error('AIAgentRunnerService not available in singletonServices');
+        throw new AIProviderNotConfiguredError();
     }
     if (!input.approved) {
         if (pending.type === 'agent-call') {

package/dist/wirings/channel/local/local-channel-runner.js

@@ -3,6 +3,8 @@ import { createHTTPWire } from '../../http/http-runner.js';
 import { closeWireServices } from '../../../utils.js';
 import { processMessageHandlers } from '../channel-handler.js';
 import { PikkuLocalChannelHandler } from './local-channel-handler.js';
+import { isProduction } from '../../../env.js';
+import { getErrorResponse } from '../../../errors/error-handler.js';
 import { handleHTTPError } from '../../../handle-error.js';
 import { PikkuSessionService, createMiddlewareSessionWireProps, } from '../../../services/user-session-service.js';
 import { runChannelLifecycleWithMiddleware } from '../channel-common.js';
@@ -75,9 +77,10 @@ export const runLocalChannel = async ({ channelId, request, response, route, ski
                     }
                     catch (e) {
                         singletonServices.logger.error(`Error handling onConnect: ${e}`);
+                        const errorResponse = getErrorResponse(e);
                         channel.send({
-                            error: e.message || 'Unknown error',
-                            errorName: e.constructor?.name,
+                            error: errorResponse?.message ?? (isProduction() ? 'Internal server error' : e.message),
+                            ...(!isProduction() && { errorName: e.constructor?.name }),
                         });
                     }
                 }
@@ -97,9 +100,10 @@ export const runLocalChannel = async ({ channelId, request, response, route, ski
                     }
                     catch (e) {
                         singletonServices.logger.error(`Error handling onDisconnect: ${e}`);
+                        const errorResponse = getErrorResponse(e);
                         channel.send({
-                            error: e.message || 'Unknown error',
-                            errorName: e.constructor?.name,
+                            error: errorResponse?.message ?? (isProduction() ? 'Internal server error' : e.message),
+                            ...(!isProduction() && { errorName: e.constructor?.name }),
                         });
                     }
                 }
@@ -113,9 +117,10 @@ export const runLocalChannel = async ({ channelId, request, response, route, ski
                 }
                 catch (e) {
                     singletonServices.logger.error(e);
+                    const errorResponse = getErrorResponse(e);
                     channel.send({
-                        error: e.message || 'Unknown error',
-                        errorName: e.constructor?.name,
+                        error: errorResponse?.message ?? (isProduction() ? 'Internal server error' : e.message),
+                        ...(!isProduction() && { errorName: e.constructor?.name }),
                     });
                     setTimeout(() => channel.close(), 200);
                 }

package/dist/wirings/http/http-runner.js

@@ -2,6 +2,7 @@ import { NotFoundError, PikkuMissingMetaError } from '../../errors/errors.js';
 import { closeWireServices, createWeakUID, isSerializable, } from '../../utils.js';
 import { getSingletonServices, getCreateWireServices, } from '../../pikku-state.js';
 import { PikkuSessionService } from '../../services/user-session-service.js';
+import { getErrorResponse } from '../../errors/error-handler.js';
 import { handleHTTPError } from '../../handle-error.js';
 import { pikkuState } from '../../pikku-state.js';
 import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
@@ -379,7 +380,7 @@ export const fetchData = async (request, response, { skipUserSession = false, re
                 apiRoute,
                 apiType,
             });
-            throw new NotFoundError(`Route not found: ${apiRoute}`);
+            throw new NotFoundError();
         }
         // Execute the matched route along with its middleware and session management
         ;
@@ -396,9 +397,10 @@ export const fetchData = async (request, response, { skipUserSession = false, re
             // For SSE routes, send error through the stream since the response is already in stream mode
             singletonServices.logger.error(e instanceof Error ? e.message : e);
             try {
+                const errorResponse = getErrorResponse(e);
                 response.arrayBuffer(JSON.stringify({
                     type: 'error',
-                    errorText: e instanceof Error ? e.message : String(e),
+                    errorText: errorResponse?.message ?? 'Internal server error',
                 }));
                 response.arrayBuffer(JSON.stringify({ type: 'done' }));
             }

package/dist/wirings/http/pikku-fetch-http-request.js

@@ -89,6 +89,9 @@ export class PikkuFetchHTTPRequest {
         const merged = {};
         for (const part of parts) {
             for (const [key, value] of Object.entries(part)) {
+                if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+                    continue;
+                }
                 if (key in merged && !valuesAreEquivalent(merged[key], value)) {
                     throw new UnprocessableContentError(`Conflicting values for key "${key}": "${merged[key]}" vs "${value}"`);
                 }
@@ -124,7 +127,14 @@ export class PikkuFetchHTTPRequest {
             }
             else if (contentType === 'application/x-www-form-urlencoded') {
                 const text = await this.request.text();
-                body = Object.fromEntries(new URLSearchParams(text));
+                const params = new URLSearchParams(text);
+                let count = 0;
+                for (const _ of params) {
+                    if (++count > 256) {
+                        throw new UnprocessableContentError('Too many form parameters');
+                    }
+                }
+                body = Object.fromEntries(params);
             }
             else {
                 throw new UnprocessableContentError(`Unsupported content type ${contentType}`);

package/dist/wirings/workflow/graph/graph-runner.d.ts

@@ -1,5 +1,12 @@
 import type { PikkuWorkflowService } from '../pikku-workflow-service.js';
 import type { WorkflowRuntimeMeta, WorkflowRunWire } from '../workflow.types.js';
+export declare class ChildWorkflowStartedException extends Error {
+    parentRunId: string;
+    stepId: string;
+    childRunId: string;
+    name: string;
+    constructor(parentRunId: string, stepId: string, childRunId: string);
+}
 export declare function continueGraph(workflowService: PikkuWorkflowService, runId: string, graphName: string, overrideMeta?: WorkflowRuntimeMeta): Promise<void>;
 export declare function executeGraphStep(workflowService: PikkuWorkflowService, rpcService: any, runId: string, stepId: string, nodeId: string, rpcName: string, data: any, graphName: string): Promise<any>;
 export declare function onGraphNodeComplete(workflowService: PikkuWorkflowService, runId: string, graphName: string): Promise<void>;

package/dist/wirings/workflow/graph/graph-runner.js

@@ -1,5 +1,17 @@
-import { pikkuState } from '../../../pikku-state.js';
+import { pikkuState, getSingletonServices } from '../../../pikku-state.js';
 import { RPCNotFoundError } from '../../rpc/rpc-runner.js';
+export class ChildWorkflowStartedException extends Error {
+    parentRunId;
+    stepId;
+    childRunId;
+    name = 'ChildWorkflowStartedException';
+    constructor(parentRunId, stepId, childRunId) {
+        super(`Child workflow started: ${childRunId}`);
+        this.parentRunId = parentRunId;
+        this.stepId = stepId;
+        this.childRunId = childRunId;
+    }
+}
 function buildTemplateRegex(nodeId) {
     if (!nodeId.includes('${'))
         return null;
@@ -321,15 +333,46 @@ export async function executeGraphStep(workflowService, rpcService, runId, stepI
         getState: () => workflowService.getRunState(runId),
     };
     try {
-        const result = await rpcService.rpcWithWire(rpcName, data, {
-            graph: graphWire,
-        });
+        let result;
+        const subWorkflowMeta = pikkuState(null, 'workflows', 'meta')[rpcName];
+        if (subWorkflowMeta) {
+            const childWire = {
+                type: 'workflow',
+                id: rpcName,
+                parentRunId: runId,
+                parentStepId: stepId,
+            };
+            const shouldInline = subWorkflowMeta.inline || !getSingletonServices()?.queueService;
+            const { runId: childRunId } = await workflowService.startWorkflow(rpcName, data, childWire, rpcService, { inline: shouldInline });
+            await workflowService.setStepChildRunId(stepId, childRunId);
+            if (shouldInline) {
+                const childRun = await workflowService.getRun(childRunId);
+                if (childRun?.status === 'failed') {
+                    throw new Error(childRun.error?.message || 'Sub-workflow failed');
+                }
+                if (childRun?.status === 'cancelled') {
+                    throw new Error('Sub-workflow was cancelled');
+                }
+                result = childRun?.output;
+            }
+            else {
+                throw new ChildWorkflowStartedException(runId, stepId, childRunId);
+            }
+        }
+        else {
+            result = await rpcService.rpcWithWire(rpcName, data, {
+                graph: graphWire,
+            });
+        }
         if (wireState.branchKey) {
             await workflowService.setBranchTaken(stepId, wireState.branchKey);
         }
         return result;
     }
     catch (error) {
+        if (error instanceof ChildWorkflowStartedException) {
+            throw error;
+        }
         if (error instanceof RPCNotFoundError) {
             await workflowService.updateRunStatus(runId, 'suspended', undefined, {
                 message: `RPC '${rpcName}' not found. Deploy the missing function and resume.`,
@@ -381,9 +424,31 @@ async function executeGraphNodeInline(workflowService, rpcService, runId, graphN
         getState: () => workflowService.getRunState(runId),
     };
     try {
-        const result = await rpcService.rpcWithWire(rpcName, input, {
-            graph: graphWire,
-        });
+        let result;
+        const subWorkflowMeta = pikkuState(null, 'workflows', 'meta')[rpcName];
+        if (subWorkflowMeta) {
+            const childWire = {
+                type: 'workflow',
+                id: rpcName,
+                parentRunId: runId,
+                parentStepId: stepState.stepId,
+            };
+            const { runId: childRunId } = await workflowService.startWorkflow(rpcName, input, childWire, rpcService, { inline: true });
+            await workflowService.setStepChildRunId(stepState.stepId, childRunId);
+            const childRun = await workflowService.getRun(childRunId);
+            if (childRun?.status === 'failed') {
+                throw new Error(childRun.error?.message || 'Sub-workflow failed');
+            }
+            if (childRun?.status === 'cancelled') {
+                throw new Error('Sub-workflow was cancelled');
+            }
+            result = childRun?.output;
+        }
+        else {
+            result = await rpcService.rpcWithWire(rpcName, input, {
+                graph: graphWire,
+            });
+        }
         if (wireState.branchKey) {
             await workflowService.setBranchTaken(stepState.stepId, wireState.branchKey);
         }