@pikku/core 0.12.84 → 0.12.86

package/src/wirings/workflow/workflow-approval-policy.test.ts

@@ -166,9 +166,14 @@ describe('approval policy enforcement', () => {
     })
     await runToGate(ws, runId)
 
-    await ws.approveStep(runId, 'Release funds', { ok: true }, {
-      userId: 'someone-else',
-    })
+    await ws.approveStep(
+      runId,
+      'Release funds',
+      { ok: true },
+      {
+        userId: 'someone-else',
+      }
+    )
     await ws.runWorkflowJob(runId, {})
 
     assert.equal((await ws.getRun(runId))?.status, 'completed')
@@ -188,15 +193,25 @@ describe('approval policy enforcement', () => {
     await runToGate(ws, runId)
 
     await assert.rejects(
-      ws.approveStep(runId, 'Release funds', { ok: true }, {
-        userId: 'initiator',
-      }),
+      ws.approveStep(
+        runId,
+        'Release funds',
+        { ok: true },
+        {
+          userId: 'initiator',
+        }
+      ),
       WorkflowApprovalForbiddenError
     )
 
-    await ws.approveStep(runId, 'Release funds', { ok: true }, {
-      userId: 'reviewer',
-    })
+    await ws.approveStep(
+      runId,
+      'Release funds',
+      { ok: true },
+      {
+        userId: 'reviewer',
+      }
+    )
     await ws.runWorkflowJob(runId, {})
 
     assert.equal((await ws.getRun(runId))?.status, 'completed')
@@ -216,15 +231,25 @@ describe('approval policy enforcement', () => {
     await runToGate(ws, runId)
 
     await assert.rejects(
-      ws.approveStep(runId, 'Release funds', { ok: true }, {
-        userId: 'attacker',
-      }),
+      ws.approveStep(
+        runId,
+        'Release funds',
+        { ok: true },
+        {
+          userId: 'attacker',
+        }
+      ),
       WorkflowApprovalForbiddenError
     )
 
-    await ws.approveStep(runId, 'Release funds', { ok: true }, {
-      userId: 'initiator',
-    })
+    await ws.approveStep(
+      runId,
+      'Release funds',
+      { ok: true },
+      {
+        userId: 'initiator',
+      }
+    )
     await ws.runWorkflowJob(runId, {})
 
     assert.equal((await ws.getRun(runId))?.status, 'completed')
@@ -244,17 +269,27 @@ describe('approval policy enforcement', () => {
     await runToGate(ws, runId)
 
     await assert.rejects(
-      ws.approveStep(runId, 'Release funds', { ok: true }, {
-        userId: 'reviewer',
-        scopes: ['payments:read'],
-      }),
+      ws.approveStep(
+        runId,
+        'Release funds',
+        { ok: true },
+        {
+          userId: 'reviewer',
+          scopes: ['payments:read'],
+        }
+      ),
       WorkflowApprovalForbiddenError
     )
 
-    await ws.approveStep(runId, 'Release funds', { ok: true }, {
-      userId: 'reviewer',
-      scopes: ['payments:approve'],
-    })
+    await ws.approveStep(
+      runId,
+      'Release funds',
+      { ok: true },
+      {
+        userId: 'reviewer',
+        scopes: ['payments:approve'],
+      }
+    )
     await ws.runWorkflowJob(runId, {})
 
     assert.equal((await ws.getRun(runId))?.status, 'completed')
@@ -280,10 +315,15 @@ describe('approval policy enforcement', () => {
     })
     await runToGate(ws, runId)
 
-    await ws.approveStep(runId, 'Release funds', { ok: true }, {
-      userId: 'reviewer',
-      scopes: ['payments:approve'],
-    })
+    await ws.approveStep(
+      runId,
+      'Release funds',
+      { ok: true },
+      {
+        userId: 'reviewer',
+        scopes: ['payments:approve'],
+      }
+    )
     await ws.runWorkflowJob(runId, {})
 
     const step = await ws.getStepState(
@@ -343,9 +383,14 @@ describe('approval policy enforcement', () => {
 
     // The gate has not been reached, so no policy has been published and the
     // submission cannot be judged here — it is accepted and judged on replay.
-    await ws.approveStep(runId, 'Release funds', { ok: true }, {
-      userId: 'initiator',
-    })
+    await ws.approveStep(
+      runId,
+      'Release funds',
+      { ok: true },
+      {
+        userId: 'initiator',
+      }
+    )
 
     await runToGate(ws, runId)
 
@@ -392,10 +437,15 @@ describe('approval audit trail', () => {
       pikkuUserId: 'initiator',
     })
     await runToGate(ws, runId)
-    await ws.approveStep(runId, 'Release funds', { ok: true }, {
-      userId: 'reviewer',
-      scopes: ['payments:approve'],
-    })
+    await ws.approveStep(
+      runId,
+      'Release funds',
+      { ok: true },
+      {
+        userId: 'reviewer',
+        scopes: ['payments:approve'],
+      }
+    )
     await ws.runWorkflowJob(runId, {})
 
     assert.equal(events.length, 1)
@@ -428,9 +478,14 @@ describe('approval audit trail', () => {
     await runToGate(ws, runId)
 
     await assert.rejects(
-      ws.approveStep(runId, 'Release funds', { ok: true }, {
-        userId: 'initiator',
-      }),
+      ws.approveStep(
+        runId,
+        'Release funds',
+        { ok: true },
+        {
+          userId: 'initiator',
+        }
+      ),
       WorkflowApprovalForbiddenError
     )
 
@@ -462,9 +517,14 @@ describe('approval audit trail', () => {
 
     // Submitted before the gate published its policy, so it is accepted here
     // and only refused on replay.
-    await ws.approveStep(runId, 'Release funds', { ok: true }, {
-      userId: 'initiator',
-    })
+    await ws.approveStep(
+      runId,
+      'Release funds',
+      { ok: true },
+      {
+        userId: 'initiator',
+      }
+    )
     assert.equal(events[0].outcome, 'success')
 
     await runToGate(ws, runId)
@@ -495,9 +555,14 @@ describe('approval audit trail', () => {
       pikkuUserId: 'initiator',
     })
     await runToGate(ws, runId)
-    await ws.approveStep(runId, 'Release funds', { ok: true }, {
-      userId: 'reviewer',
-    })
+    await ws.approveStep(
+      runId,
+      'Release funds',
+      { ok: true },
+      {
+        userId: 'reviewer',
+      }
+    )
     await ws.runWorkflowJob(runId, {})
 
     assert.equal((await ws.getRun(runId))?.status, 'completed')
@@ -513,12 +578,17 @@ describe('approval audit trail', () => {
       pikkuUserId: 'initiator',
     })
     await runToGate(ws, runId)
-    await ws.approveStep(runId, 'Release funds', { ok: true }, {
-      userId: 'reviewer',
-    })
+    await ws.approveStep(
+      runId,
+      'Release funds',
+      { ok: true },
+      {
+        userId: 'reviewer',
+      }
+    )
     await ws.runWorkflowJob(runId, {})
 
     assert.equal((await ws.getRun(runId))?.status, 'completed')
     cleanup()
   })
-})
+})

package/src/wirings/workflow/workflow-approval.ts

@@ -202,7 +202,8 @@ export const evaluateApprovalStep = async (
   }
 
   const stateKey = approvalStateKey(approvalStepName)
-  let record = ((await store.getRunState(runId))[stateKey] ?? {}) as ApprovalRecord
+  let record = ((await store.getRunState(runId))[stateKey] ??
+    {}) as ApprovalRecord
 
   const policy: WorkflowApprovalPolicy = {
     approvers: options.approvers,

package/src/wirings/workflow/workflow-run-engine.types.ts

@@ -1,4 +1,5 @@
-import type { PikkuRawWire, SerializedError } from '../../types/core.types.js'
+import type { PikkuRawWire } from '../../types/core.types.js'
+import type { SerializedError } from '../../errors/serialized-error.js'
 import type {
   CoreWorkflow,
   PikkuWorkflowWire,

package/src/wirings/workflow/workflow.types.ts

@@ -1,4 +1,5 @@
-import type { SerializedError, CommonWireMeta } from '../../types/core.types.js'
+import type { CommonWireMeta } from '../../types/core.types.js'
+import type { SerializedError } from '../../errors/serialized-error.js'
 import type { CorePikkuFunctionConfig } from '../../function/functions.types.js'
 import type { GroupConcurrencyConfig } from '../queue/queue.types.js'
 
@@ -62,21 +63,12 @@ export interface WorkflowPlannedStep {
 }
 
 export type WorkflowStatus =
-  | 'running'
-  | 'suspended'
-  | 'completed'
-  | 'failed'
-  | 'cancelled'
+  'running' | 'suspended' | 'completed' | 'failed' | 'cancelled'
 
 export type WorkflowVersionStatus = 'draft' | 'active' | 'declined'
 
 export type StepStatus =
-  | 'pending'
-  | 'running'
-  | 'scheduled'
-  | 'succeeded'
-  | 'failed'
-  | 'suspended'
+  'pending' | 'running' | 'scheduled' | 'succeeded' | 'failed' | 'suspended'
 
 export interface WorkflowRun {
   id: string

package/src/wirings-stay-decoupled.test.ts

@@ -25,13 +25,16 @@ const ALLOWED: Record<string, string[]> = {
   http: ['channel'],
   cli: ['channel'],
   // An agent streams over a channel and is invoked over rpc, and grades itself
-  // as the last thing a finished run does.
-  agent: ['channel', 'rpc', 'agent-scorer'],
+  // as the last thing a finished run does. Its own functions may come from an
+  // installed addon, so it builds that addon's services the same way rpc does.
+  agent: ['channel', 'rpc', 'agent-scorer', 'addon'],
   // A judge is a degenerate agent — it builds agent messages and runs them —
   // and a grade is dispatched to a queue.
   'agent-scorer': ['agent', 'queue'],
   // `wire.rpc.agent` — the facade lives with the agent runtime it delegates to.
-  rpc: ['agent'],
+  // An rpc call is how an installed addon's function is reached, so the runner
+  // resolves the addon instance that owns the namespace.
+  rpc: ['agent', 'addon'],
   gateway: ['http'],
   mcp: ['rpc'],
   trigger: ['rpc'],