@pikku/inspector 0.12.47 → 0.12.48

package/src/add/add-scenario-step.test.ts

@@ -0,0 +1,311 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { InspectorLogger } from '../types.js'
+import type { ScenarioStepMeta, WorkflowStepMeta } from '@pikku/core/workflow'
+
+function makeLogger(
+  criticals: Array<{ code: string; message: string }>
+): InspectorLogger {
+  return {
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: ({ code, message }: any) => {
+      criticals.push({ code, message })
+    },
+    critical: (code: any, message: string) => {
+      criticals.push({ code, message })
+    },
+    hasCriticalErrors: () => criticals.length > 0,
+  } as InspectorLogger
+}
+
+const STEPS = [
+  "import { pikkuScenarioStep } from '@pikku/core'",
+  'export const buysAnApple = pikkuScenarioStep({',
+  "  name: 'buysAnApple',",
+  "  description: 'buys an apple',",
+  '  browser: true,',
+  '  func: async ({ logger }, data: { qty: number }) => ({ ok: data.qty > 0 }),',
+  '})',
+  'export const seesAReceipt = pikkuScenarioStep({',
+  "  name: 'seesAReceipt',",
+  "  description: 'sees a receipt',",
+  '  func: async ({ logger }) => ({ ok: true }),',
+  '})',
+].join('\n')
+
+const scenarioSource = (body: string[], preamble: string[] = []) =>
+  [
+    "import { pikkuScenario } from '@pikku/core/workflow'",
+    'declare const actors: Record<string, any>',
+    ...preamble,
+    'export const shopFlow = pikkuScenario(async (_services, _input, { scenario }: any) => {',
+    ...body.map((line) => `  ${line}`),
+    '  return { ok: true }',
+    '})',
+  ].join('\n')
+
+async function run(body: string[], preamble: string[] = []) {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-scenario-step-'))
+  const stepsFile = join(rootDir, 'shop.steps.ts')
+  const scenarioFile = join(rootDir, 'shop.scenario.ts')
+  await writeFile(stepsFile, STEPS)
+  await writeFile(scenarioFile, scenarioSource(body, preamble))
+  const criticals: Array<{ code: string; message: string }> = []
+  const state = await inspect(
+    makeLogger(criticals),
+    [stepsFile, scenarioFile],
+    {
+      rootDir,
+    }
+  )
+  return {
+    state,
+    criticals,
+    cleanup: () => rm(rootDir, { recursive: true, force: true }),
+  }
+}
+
+const flatten = (steps: WorkflowStepMeta[]): WorkflowStepMeta[] =>
+  steps.flatMap((step) => [
+    step,
+    ...('body' in step && step.body
+      ? flatten(step.body as WorkflowStepMeta[])
+      : []),
+  ])
+
+const scenarioSteps = (state: any): ScenarioStepMeta[] =>
+  flatten(state.workflows.meta.shopFlow?.steps ?? []).filter(
+    (step): step is ScenarioStepMeta => step.type === 'scenarioStep'
+  )
+
+describe('pikkuScenarioStep', () => {
+  test('a step is registered under its declared name, not its export name', async () => {
+    const { state, cleanup } = await run([
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+    ])
+    try {
+      assert.ok(
+        state.functions.meta['buysAnApple'],
+        `expected a function registered as 'buysAnApple', got: ${Object.keys(state.functions.meta).join(', ')}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('a step is never registered as an RPC — a browser step must not be network-callable', async () => {
+    const { state, cleanup } = await run([
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+    ])
+    try {
+      assert.equal(
+        state.rpc.internalMeta['buysAnApple'],
+        undefined,
+        'scenario steps must not be RPC-callable'
+      )
+      assert.equal(
+        state.rpc.exposedMeta['buysAnApple'],
+        undefined,
+        'scenario steps must not be exposed over RPC'
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('given/when/then record phase, target and actor', async () => {
+    const { state, cleanup } = await run([
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+      "await scenario.then('sees a receipt', 'seesAReceipt', {}, { actor: actors.shopper })",
+    ])
+    try {
+      const steps = scenarioSteps(state)
+      assert.equal(
+        steps.length,
+        2,
+        `expected 2 scenario steps, got ${steps.length}`
+      )
+      assert.equal(steps[0]!.phase, 'given')
+      assert.equal(steps[0]!.stepFunc, 'buysAnApple')
+      assert.equal(steps[0]!.actor, 'shopper')
+      assert.equal(steps[1]!.phase, 'then')
+      assert.equal(steps[1]!.stepFunc, 'seesAReceipt')
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('the step target is bundled, so the step function is wired', async () => {
+    const { state, cleanup } = await run([
+      "await scenario.step('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+    ])
+    try {
+      assert.ok(
+        state.rpc.invokedFunctions.has('buysAnApple'),
+        `expected 'buysAnApple' to be bundled, got: ${[...state.rpc.invokedFunctions].join(', ')}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('a step inside a for..of loop is extracted, not silently dropped', async () => {
+    const { state, cleanup } = await run([
+      'const quantities = [1, 2]',
+      'for (const qty of quantities) {',
+      "  await scenario.when('buys an apple', 'buysAnApple', { qty }, { actor: actors.shopper })",
+      '}',
+    ])
+    try {
+      const steps = scenarioSteps(state)
+      assert.equal(
+        steps.length,
+        1,
+        `expected the looped step to appear in the fanout body, got ${steps.length} scenario steps`
+      )
+      assert.equal(steps[0]!.stepFunc, 'buysAnApple')
+      assert.ok(
+        state.rpc.invokedFunctions.has('buysAnApple'),
+        'a looped step must still be bundled'
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('a non-literal step target is a PKU678 critical', async () => {
+    const { criticals, cleanup } = await run([
+      'const target = Math.random() > 0.5 ? "buysAnApple" : "seesAReceipt"',
+      "await scenario.step('buys something', target as any, {}, { actor: actors.shopper })",
+    ])
+    try {
+      assert.ok(
+        criticals.find((c) => c.code === 'PKU678'),
+        `expected a PKU678 critical for a dynamic step target, got: ${JSON.stringify(criticals)}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('a browser step called without an actor is a PKU677 critical', async () => {
+    const { criticals, cleanup } = await run([
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 })",
+    ])
+    try {
+      assert.ok(
+        criticals.find((c) => c.code === 'PKU677'),
+        `expected a PKU677 critical for a browser step without an actor, got: ${JSON.stringify(criticals)}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('a non-browser step without an actor is allowed', async () => {
+    const { criticals, cleanup } = await run([
+      "await scenario.given('sees a receipt', 'seesAReceipt', {})",
+    ])
+    try {
+      assert.equal(
+        criticals.filter((c) => c.code === 'PKU677').length,
+        0,
+        `setup steps need no actor, got: ${JSON.stringify(criticals)}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('a step is marked as a step RPC in its function meta', async () => {
+    const { state, cleanup } = await run([
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+    ])
+    try {
+      // The fourth RPC kind, alongside public/private/remote: a name that is
+      // dispatched inside a run and refused everywhere else.
+      assert.equal(state.functions.meta['buysAnApple']?.scenarioStep, true)
+      assert.equal(state.functions.meta['seesAReceipt']?.scenarioStep, true)
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('an ordinary function is not a step RPC', async () => {
+    const { state, cleanup } = await run([
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+    ])
+    try {
+      assert.equal(state.functions.meta['shopFlow']?.scenarioStep, undefined)
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('a closure in the scenario body does not have its statements whitelisted', async () => {
+    const { state, cleanup } = await run([
+      'const safely = async (fn: any) => { try { return await fn() } catch { return null } }',
+      'void safely',
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+    ])
+    try {
+      const steps = scenarioSteps(state)
+      assert.equal(
+        steps.length,
+        1,
+        `a try/catch inside a closure must not drop the scenario's steps, got ${steps.length}`
+      )
+      assert.equal(steps[0]!.stepFunc, 'buysAnApple')
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('destructuring a step result is reported, not silently dropped', async () => {
+    const { state, criticals, cleanup } = await run([
+      "const { ok } = await scenario.given('sees a receipt', 'seesAReceipt', {})",
+      'void ok',
+    ])
+    try {
+      const steps = scenarioSteps(state)
+      assert.equal(
+        steps.length,
+        0,
+        'the DSL does not model a destructured step result'
+      )
+      assert.ok(
+        criticals.find((c) => c.code === 'PKU679'),
+        `a step the DSL cannot model must be loud, got: ${JSON.stringify(criticals)}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('a module-level constant used as step input is inlined, not read off the trigger', async () => {
+    const { state, cleanup } = await run(
+      [
+        "await scenario.given('buys an apple', 'buysAnApple', { qty: QTY }, { actor: actors.shopper })",
+      ],
+      ['const QTY = 3']
+    )
+    try {
+      const steps = scenarioSteps(state)
+      assert.equal(steps.length, 1)
+      assert.deepEqual(
+        steps[0]!.inputs?.qty,
+        { from: 'literal', value: 3 },
+        `a constant declared outside the scenario is not a trigger field, got: ${JSON.stringify(steps[0]!.inputs)}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+})

package/src/add/add-workflow-silent-drops.test.ts

@@ -146,6 +146,104 @@ describe('DSL extraction — constructs that must not be silently dropped', () =
     )
   })
 
+  test('a counting for-of (Array(n).keys()) hard-errors instead of silently dropping its step', async () => {
+    const { invoked, steps, diags } = await inspectWorkflow(
+      [
+        '  for (const i of [...Array(3).keys()]) {',
+        "    await workflow.do(`poll #${i}`, 'rpcA', {})",
+        '  }',
+        '  return { ok: true }',
+      ].join('\n')
+    )
+
+    // The DSL extractor can't model a computed/counting iterable, so it must
+    // FAIL LOUDLY (INVALID_DSL_WORKFLOW), not swallow the loop and every
+    // workflow.do inside it — the silent drop is exactly what stranded
+    // checkSandboxHostCapacity out of invokedFunctions and bricked prod.
+    assert.ok(
+      diags.length > 0,
+      'a counting for-of must raise a diagnostic, not vanish silently'
+    )
+    assert.ok(
+      diags.some((d) => /for-of/i.test(d)),
+      `the diagnostic must name the offending for-of, got: ${JSON.stringify(diags)}`
+    )
+    // And it must NOT have quietly produced a fanout with zero body steps.
+    assert.ok(
+      !invoked.includes('rpcA') || diags.length > 0,
+      'if rpcA was dropped the user must be told'
+    )
+    const fanout = steps.find((s) => s.type === 'fanout')
+    assert.ok(
+      !fanout,
+      'a counting loop must not serialize as a fanout — it is not a data-array fanout'
+    )
+  })
+
+  /**
+   * The diagnostic used to blame the iterable in every case, including this one
+   * where the iterable is a perfectly good data array. That sent readers looking
+   * at `data.tagsToRemove` when the real obstacle was the `if` in the body, so
+   * the message has to distinguish the two causes.
+   */
+  test('a branch inside a fanout body hard-errors, and the diagnostic blames the branch not the iterable', async () => {
+    const { steps, diags } = await inspectWorkflow(
+      [
+        '  for (const tag of data.tags) {',
+        '    if (tag.length > 2) {',
+        "      await workflow.do('add', 'rpcA', { tag })",
+        '    }',
+        '  }',
+        '  return { ok: true }',
+      ].join('\n')
+    )
+
+    assert.ok(
+      diags.length > 0,
+      'a branch inside a fanout body must raise a diagnostic, not vanish silently'
+    )
+    assert.ok(
+      diags.some((d) => /if\/switch/.test(d)),
+      `the diagnostic must name the branch as the cause, got: ${JSON.stringify(diags)}`
+    )
+    assert.ok(
+      !diags.some((d) => /iterable must be a data array/.test(d)),
+      `data.tags IS a data array — the diagnostic must not blame it, got: ${JSON.stringify(diags)}`
+    )
+    const fanout = steps.find((s) => s.type === 'fanout')
+    assert.ok(!fanout, 'a fanout whose body was dropped must not serialize')
+  })
+
+  /**
+   * The hazard the hard error exists for is a *dropped step*. A loop that only
+   * massages locals has no step to drop, so failing the build on it is a false
+   * positive — and it fired on real workflows that were doing nothing wrong.
+   */
+  test('a for-of that calls no workflow step is not an error — there is nothing to drop', async () => {
+    const { steps, diags } = await inspectWorkflow(
+      [
+        "  const first = await workflow.do('get', 'rpcA', {})",
+        '  const merged: Record<string, string> = {}',
+        '  for (const dup of data.duplicates) {',
+        '    if (dup.phone && !first.phone) {',
+        '      merged.phone = dup.phone',
+        '    }',
+        '  }',
+        '  return { ok: true }',
+      ].join('\n')
+    )
+
+    assert.deepEqual(
+      diags,
+      [],
+      `a pure-computation loop must not fail the build, got: ${JSON.stringify(diags)}`
+    )
+    assert.ok(
+      steps.some((s) => s.type === 'rpc'),
+      'the surrounding steps must still be extracted'
+    )
+  })
+
   test('a brace-less for-of body is still extracted as a sequential fanout', async () => {
     const { invoked, steps } = await inspectWorkflow(
       [

package/src/add/add-workflow.ts

@@ -97,6 +97,10 @@ export function collectInvokedRPCs(
       if (step.options?.onError) {
         rpcs.add(step.options.onError)
       }
+    } else if (step.type === 'scenarioStep' && step.stepFunc) {
+      // Steps are bundled like RPCs — the runner calls them through
+      // runPikkuFunc — but they are deliberately never RPC-registered.
+      rpcs.add(step.stepFunc)
     } else if (step.type === 'branch') {
       for (const branch of step.branches) {
         collectInvokedRPCs(branch.steps, rpcs)
@@ -108,9 +112,9 @@ export function collectInvokedRPCs(
       }
       if (step.defaultSteps) collectInvokedRPCs(step.defaultSteps, rpcs)
     } else if (step.type === 'fanout' && step.body) {
-      collectInvokedRPCs(step.body, rpcs)
+      collectInvokedRPCs(step.body as WorkflowStepMeta[], rpcs)
     } else if (step.type === 'parallel' && step.children) {
-      collectInvokedRPCs(step.children, rpcs)
+      collectInvokedRPCs(step.children as WorkflowStepMeta[], rpcs)
     }
   }
 }
@@ -282,6 +286,7 @@ export const addWorkflow: AddWiring = (logger, node, checker, state) => {
   let description: string | undefined
   let errors: string[] | undefined
   let expose: boolean | undefined
+  let skip: string | undefined
 
   if (ts.isObjectLiteralExpression(firstArg)) {
     const metadata = getCommonWireMetaData(
@@ -299,6 +304,7 @@ export const addWorkflow: AddWiring = (logger, node, checker, state) => {
     errors = metadata.errors
 
     expose = getPropertyValue(firstArg, 'expose') as boolean | undefined
+    skip = (getPropertyValue(firstArg, 'skip') as string | null) ?? undefined
   }
 
   // Validate that we got a valid function
@@ -391,6 +397,15 @@ export const addWorkflow: AddWiring = (logger, node, checker, state) => {
         `Workflow '${workflowName}' does not conform to DSL workflow rules:\n${result.reason || 'Unknown error'}`
       )
       return
+    } else if (wrapperType === 'scenario') {
+      // The fallback below understands do/sleep but not step/given/when/then,
+      // so a scenario that lands here registers with zero steps. Silence would
+      // leave the whole scenario passing vacuously.
+      logger.critical(
+        ErrorCode.SCENARIO_NOT_EXTRACTABLE,
+        `Scenario '${workflowName}' could not be extracted, so none of its steps were recorded and it would run as an empty scenario:\n${result.reason || 'Unknown error'}`
+      )
+      return
     } else {
       // For pikkuWorkflowComplexFunc, fall back to basic extraction
       logger.debug(
@@ -432,43 +447,16 @@ export const addWorkflow: AddWiring = (logger, node, checker, state) => {
     errors,
     tags,
     expose,
+    skip,
     scenario: wrapperType === 'scenario' ? true : undefined,
     actors: actorNames.length > 0 ? actorNames : undefined,
   }
 
-  // Scenarios are pure stories of remote RPCs (same rule as client-side CLI
-  // renderers): the func may only destructure logger/config — everything else
-  // must go through actor steps so the flow runs against the TARGET
-  // environment, never local services.
-  const funcMeta = state.functions.meta[pikkuFuncId]
-  if (wrapperType === 'scenario' && funcMeta?.services) {
-    const disallowed = funcMeta.services.services.filter(
-      (svc) => svc !== 'logger' && svc !== 'config'
-    )
-    if (disallowed.length > 0) {
-      logger.critical(
-        ErrorCode.SCENARIO_HAS_SERVICES,
-        `Scenario '${workflowName}' destructures services: ${disallowed.join(', ')}. ` +
-          `Scenarios may only use 'logger'/'config' — drive everything else through ` +
-          `actor steps (workflow.do(step, rpc, data, { actor: actors.x })) so the flow ` +
-          `runs against the target environment.`
-      )
-      return
-    }
-  }
-
-  // Workflow functions require platform services that aren't visible
-  // through parameter destructuring (they're accessed via workflow.do/sleep)
-  if (funcMeta?.services) {
-    for (const svc of [
-      'workflowService',
-      'workflowRunService',
-      'schedulerService',
-      'queueService',
-    ]) {
-      if (!funcMeta.services.services.includes(svc)) {
-        funcMeta.services.services.push(svc)
-      }
-    }
-  }
+  // The scenario "logger/config only" rule (PKU673) and the implicit
+  // workflow platform-service injection both used to live here, reading
+  // state.functions.meta[pikkuFuncId]. addWorkflow runs in the visitSetup
+  // pass, which completes before addFunctions populates that meta, so both
+  // were dead. The rule now lives in validateScenarioServices (post-process),
+  // and aggregateRequiredServices already adds the platform services globally
+  // whenever any workflow exists.
 }

package/src/add/scenario-not-extractable.test.ts

@@ -0,0 +1,159 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { InspectorLogger } from '../types.js'
+
+function makeLogger(
+  criticals: Array<{ code: string; message: string }>
+): InspectorLogger {
+  return {
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: ({ code, message }: any) => {
+      criticals.push({ code, message })
+    },
+    critical: (code: any, message: string) => {
+      criticals.push({ code, message })
+    },
+    hasCriticalErrors: () => criticals.length > 0,
+  } as InspectorLogger
+}
+
+const STEPS = [
+  "import { pikkuScenarioStep } from '@pikku/core'",
+  'export const buysAnApple = pikkuScenarioStep({',
+  "  name: 'buysAnApple',",
+  "  description: 'buys an apple',",
+  '  func: async ({ logger }, data: { qty: number }) => ({ ok: data.qty > 0 }),',
+  '})',
+].join('\n')
+
+const source = (wrapper: string, body: string[]) =>
+  [
+    `import { ${wrapper} } from '@pikku/core/workflow'`,
+    'declare const actors: Record<string, any>',
+    `export const shopFlow = ${wrapper}(async (_services, _input, { scenario, workflow }: any) => {`,
+    ...body.map((line) => `  ${line}`),
+    '  return { ok: true }',
+    '})',
+  ].join('\n')
+
+async function run(wrapper: string, body: string[]) {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-scenario-extract-'))
+  const stepsFile = join(rootDir, 'shop.steps.ts')
+  const scenarioFile = join(rootDir, 'shop.scenario.ts')
+  await writeFile(stepsFile, STEPS)
+  await writeFile(scenarioFile, source(wrapper, body))
+  const criticals: Array<{ code: string; message: string }> = []
+  const state = await inspect(
+    makeLogger(criticals),
+    [stepsFile, scenarioFile],
+    {
+      rootDir,
+    }
+  )
+  return {
+    state,
+    criticals,
+    cleanup: () => rm(rootDir, { recursive: true, force: true }),
+  }
+}
+
+/**
+ * A scenario that fails DSL extraction silently registers with zero steps,
+ * because the fallback path (`getWorkflowInvocations`) understands `do`/`sleep`
+ * but not `step`/`given`/`when`/`then`. That is the PKU678 silent-drop class,
+ * and for scenarios it must be loud.
+ */
+describe('a scenario that cannot be extracted', () => {
+  test('a top-level try/catch is a PKU679 critical, not a silent zero-step scenario', async () => {
+    const { state, criticals, cleanup } = await run('pikkuScenario', [
+      'try {',
+      "  await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+      '} catch {}',
+    ])
+    try {
+      assert.equal(
+        state.workflows.meta.shopFlow,
+        undefined,
+        'an unextractable scenario must not register at all, rather than register empty'
+      )
+      assert.ok(
+        criticals.find((c) => c.code === 'PKU679'),
+        `expected a PKU679 critical for an unextractable scenario, got: ${JSON.stringify(criticals)}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('an extractable scenario raises no PKU679', async () => {
+    const { criticals, cleanup } = await run('pikkuScenario', [
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+    ])
+    try {
+      assert.equal(
+        criticals.filter((c) => c.code === 'PKU679').length,
+        0,
+        `a valid scenario must not raise PKU679, got: ${JSON.stringify(criticals)}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('a scenario that declares no input parameter is still extractable', async () => {
+    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-scenario-noinput-'))
+    const scenarioFile = join(rootDir, 'fails.scenario.ts')
+    await writeFile(
+      scenarioFile,
+      [
+        "import { pikkuScenario } from '@pikku/core/workflow'",
+        'export const alwaysFails = pikkuScenario({',
+        "  title: 'Always fails (test fixture)',",
+        "  tags: ['scenario'],",
+        "  func: async () => { throw new Error('always fails') },",
+        '})',
+      ].join('\n')
+    )
+    const criticals: Array<{ code: string; message: string }> = []
+    const state = await inspect(makeLogger(criticals), [scenarioFile], {
+      rootDir,
+    })
+    try {
+      assert.ok(
+        state.workflows.meta.alwaysFails,
+        `a scenario that ignores its input must still register, got criticals: ${JSON.stringify(criticals)}`
+      )
+      assert.equal(
+        criticals.filter((c) => c.code === 'PKU679').length,
+        0,
+        `declaring no input parameter is legitimate, got: ${JSON.stringify(criticals)}`
+      )
+    } finally {
+      await rm(rootDir, { recursive: true, force: true })
+    }
+  })
+
+  test('a complex workflow still falls back quietly — only scenarios are strict', async () => {
+    const { criticals, cleanup } = await run('pikkuWorkflowComplexFunc', [
+      'try {',
+      "  await workflow.do('buy', 'buysAnApple', { qty: 1 })",
+      '} catch {}',
+    ])
+    try {
+      assert.equal(
+        criticals.filter((c) => c.code === 'PKU679').length,
+        0,
+        `pikkuWorkflowComplexFunc legitimately falls back to basic extraction, got: ${JSON.stringify(criticals)}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+})