@pikku/inspector 0.12.52 → 0.12.55

package/src/add/add-personas.test.ts

@@ -4,7 +4,7 @@ import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { inspect } from '../inspector.js'
-import type { ErrorCode } from '../error-codes.js'
+import { ErrorCode } from '../error-codes.js'
 import type { InspectorLogger } from '../types.js'
 
 const makeLogger = (criticals: Array<{ code: ErrorCode; message: string }>) =>
@@ -35,6 +35,25 @@ const inspectSource = async (source: string) => {
   }
 }
 
+/** Inspects several files at once, keyed by basename. */
+const inspectSources = async (sources: Record<string, string>) => {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-personas-multi-'))
+  const files: Record<string, string> = {}
+  for (const [name, source] of Object.entries(sources)) {
+    files[name] = join(rootDir, name)
+    await writeFile(files[name]!, source)
+  }
+  const criticals: Array<{ code: ErrorCode; message: string }> = []
+  try {
+    const state = await inspect(makeLogger(criticals), Object.values(files), {
+      rootDir,
+    })
+    return { state, criticals, files }
+  } finally {
+    await rm(rootDir, { recursive: true, force: true })
+  }
+}
+
 /** The declared world every persona below is checked against. */
 const withRoles = (...lines: string[]) =>
   [
@@ -89,6 +108,30 @@ describe('addPersonas inspector', () => {
     assert.equal(susan.runnable, true)
   })
 
+  test('extracts a declared avatar', async () => {
+    const { state } = await inspectSource(
+      withRoles(
+        'definePersonas({',
+        '  susan: {',
+        "    name: 'Susan',",
+        "    avatarUrl: '/avatars/susan.png',",
+        '  },',
+        '})'
+      )
+    )
+    assert.equal(state.personas.definitions[0]!.avatarUrl, '/avatars/susan.png')
+  })
+
+  // The console draws a colour-and-icon avatar from the persona's id when none
+  // is declared, so an absent field has to stay absent rather than become an
+  // empty string the renderer would treat as a broken image.
+  test('leaves the avatar absent when none is declared', async () => {
+    const { state } = await inspectSource(
+      withRoles('definePersonas({', "  susan: { name: 'Susan' },", '})')
+    )
+    assert.equal(state.personas.definitions[0]!.avatarUrl, undefined)
+  })
+
   test('extracts the environments a persona declares', async () => {
     const { state } = await inspectSource(
       withRoles(
@@ -216,6 +259,77 @@ describe('addPersonas inspector', () => {
     assert.equal(state.personas.definitions[0]!.runnable, false)
   })
 
+  // One call site per codebase, so there is one place to read the cast from
+  // and one place to add to. The keyed form above is how you declare more.
+  test('a second definePersonas in the same file is refused', async () => {
+    const { state, criticals } = await inspectSource(
+      withRoles(
+        "definePersonas({ susan: { name: 'Susan' } })",
+        "definePersonas({ dave: { name: 'Dave' } })"
+      )
+    )
+
+    const hit = criticals.find(
+      (c) => c.code === ErrorCode.DUPLICATE_PERSONAS_DEFINITION
+    )
+    assert.ok(
+      hit,
+      `expected DUPLICATE_PERSONAS_DEFINITION, got ${JSON.stringify(criticals)}`
+    )
+    assert.deepEqual(
+      state.personas.definitions.map((p) => p.id),
+      ['susan']
+    )
+  })
+
+  test('a second definePersonas in another file is refused', async () => {
+    const { criticals, files } = await inspectSources({
+      'personas.ts': withRoles("definePersonas({ susan: { name: 'Susan' } })"),
+      'more-personas.ts': [
+        "import { definePersonas } from '@pikku/core/persona'",
+        "definePersonas({ dave: { name: 'Dave' } })",
+      ].join('\n'),
+    })
+
+    const hit = criticals.find(
+      (c) => c.code === ErrorCode.DUPLICATE_PERSONAS_DEFINITION
+    )
+    assert.ok(
+      hit,
+      `expected DUPLICATE_PERSONAS_DEFINITION, got ${JSON.stringify(criticals)}`
+    )
+    assert.ok(
+      hit!.message.includes(files['personas.ts']!) &&
+        hit!.message.includes(files['more-personas.ts']!),
+      `expected both files named, got ${hit!.message}`
+    )
+  })
+
+  // The CLI scaffolds personas of its own, and nobody adds a persona to a file
+  // the next codegen run overwrites — so a generated declaration neither takes
+  // the single slot nor collides with the app's own.
+  test('a generated declaration neither claims the slot nor conflicts', async () => {
+    const { state, criticals } = await inspectSources({
+      'pikku-personas.gen.ts': [
+        "import { definePersonas } from '@pikku/core/persona'",
+        "definePersonas({ dave: { name: 'Dave' } })",
+      ].join('\n'),
+      'personas.ts': withRoles("definePersonas({ susan: { name: 'Susan' } })"),
+    })
+
+    assert.deepEqual(
+      criticals.filter(
+        (c) => c.code === ErrorCode.DUPLICATE_PERSONAS_DEFINITION
+      ),
+      [],
+      `expected no duplicate critical, got ${JSON.stringify(criticals)}`
+    )
+    assert.deepEqual(state.personas.definitions.map((d) => d.id).sort(), [
+      'dave',
+      'susan',
+    ])
+  })
+
   // A half-read roles array typechecks, runs, and grants less than the source
   // says — so an unreadable one reads as absent.
   test('a computed roles array is not half-extracted', async () => {

package/src/add/add-personas.ts

@@ -1,11 +1,9 @@
 import * as ts from 'typescript'
 import { DISPOSITIONS } from '@pikku/core/virtual-user'
 import { isRunnablePersona } from '@pikku/core/persona'
-import type {
-  PersonaAccountMeta,
-  PersonaMeta,
-} from '@pikku/core/persona'
+import type { PersonaAccountMeta, PersonaMeta } from '@pikku/core/persona'
 import { ErrorCode } from '../error-codes.js'
+import { claimSingleDeclaration } from '../utils/single-declaration.js'
 import type { AddWiring, InspectorLogger } from '../types.js'
 import {
   booleanProperty,
@@ -172,6 +170,19 @@ export const addPersonas: AddWiring = (logger, node, _checker, state) => {
   }
 
   const sourceFile = node.getSourceFile().fileName
+
+  if (
+    !claimSingleDeclaration(
+      logger,
+      state.personas.files,
+      ErrorCode.DUPLICATE_PERSONAS_DEFINITION,
+      'definePersonas',
+      sourceFile
+    )
+  ) {
+    return
+  }
+
   const known = Object.keys(DISPOSITIONS)
 
   for (const prop of unwrapped.properties) {
@@ -222,10 +233,7 @@ export const addPersonas: AddWiring = (logger, node, _checker, state) => {
     let tuningFailed = false
     const tuning = tuningProperty(config, (message) => {
       tuningFailed = true
-      logger.critical(
-        ErrorCode.INVALID_VALUE,
-        `Persona '${id}': ${message}`
-      )
+      logger.critical(ErrorCode.INVALID_VALUE, `Persona '${id}': ${message}`)
     })
     if (tuningFailed) {
       continue
@@ -253,6 +261,8 @@ export const addPersonas: AddWiring = (logger, node, _checker, state) => {
     if (jobTitle !== undefined) persona.jobTitle = jobTitle
     const description = stringProperty(config, 'description')
     if (description !== undefined) persona.description = description
+    const avatarUrl = stringProperty(config, 'avatarUrl')
+    if (avatarUrl !== undefined) persona.avatarUrl = avatarUrl
     const personality = stringProperty(config, 'personality')
     if (personality !== undefined) persona.personality = personality
     if (disposition !== undefined) {
@@ -270,7 +280,6 @@ export const addPersonas: AddWiring = (logger, node, _checker, state) => {
     const linkedAccounts = linkedAccountsProperty(config, id, logger)
     if (linkedAccounts !== undefined) persona.linkedAccounts = linkedAccounts
 
-    state.personas.files.add(sourceFile)
     state.personas.definitions.push(persona)
   }
 }

package/src/add/add-scenario-step.test.ts

@@ -144,7 +144,7 @@ describe('pikkuScenarioStep', () => {
 
   test('the step target is bundled, so the step function is wired', async () => {
     const { state, cleanup } = await run([
-      "await scenario.step('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
     ])
     try {
       assert.ok(
@@ -183,7 +183,7 @@ describe('pikkuScenarioStep', () => {
   test('a non-literal step target is a PKU678 critical', async () => {
     const { criticals, cleanup } = await run([
       'const target = Math.random() > 0.5 ? "buysAnApple" : "seesAReceipt"',
-      "await scenario.step('buys something', target as any, {}, { actor: actors.shopper })",
+      "await scenario.when('buys something', target as any, {}, { actor: actors.shopper })",
     ])
     try {
       assert.ok(
@@ -224,6 +224,42 @@ describe('pikkuScenarioStep', () => {
     }
   })
 
+  test('a scenario whose witness is an expectation helper is not flagged', async () => {
+    // `expectService` is an inline step and carries no phase, so it reaches
+    // PKU680 as nothing at all — but a recorded service call is a witness, and
+    // a flow that has one is not the assertion-free flow the rule is for.
+    const { criticals, cleanup } = await run([
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+      "await scenario.expectService('the receipt was emailed', 'emailService.send', { actor: actors.shopper })",
+    ])
+    try {
+      assert.equal(
+        criticals.filter((c) => c.code === 'PKU680').length,
+        0,
+        `got: ${JSON.stringify(criticals)}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
+  test('an expectation parked in an uncalled helper is still no assertion', async () => {
+    const { criticals, cleanup } = await run([
+      'const neverCalled = async () => {',
+      "  await scenario.expectService('the receipt was emailed', 'emailService.send')",
+      '}',
+      "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",
+    ])
+    try {
+      assert.ok(
+        criticals.find((c) => c.code === 'PKU680'),
+        `expected PKU680 — the helper never runs, so nothing is asserted; got: ${JSON.stringify(criticals)}`
+      )
+    } finally {
+      await cleanup()
+    }
+  })
+
   test('a scenario with an assertion is not flagged', async () => {
     const { criticals, cleanup } = await run([
       "await scenario.given('buys an apple', 'buysAnApple', { qty: 1 }, { actor: actors.shopper })",

package/src/add/add-scope.test.ts

@@ -35,6 +35,25 @@ const inspectSource = async (source: string) => {
   }
 }
 
+/** Inspects several files at once, keyed by basename. */
+const inspectSources = async (sources: Record<string, string>) => {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-scope-multi-'))
+  const files: Record<string, string> = {}
+  for (const [name, source] of Object.entries(sources)) {
+    files[name] = join(rootDir, name)
+    await writeFile(files[name]!, source)
+  }
+  const criticals: Array<{ code: ErrorCode; message: string }> = []
+  try {
+    const state = await inspect(makeLogger(criticals), Object.values(files), {
+      rootDir,
+    })
+    return { state, criticals, files }
+  } finally {
+    await rm(rootDir, { recursive: true, force: true })
+  }
+}
+
 describe('addScope inspector', () => {
   test('extracts a flat scope', async () => {
     const { state, criticals } = await inspectSource(
@@ -162,6 +181,60 @@ describe('addScope inspector', () => {
     )
   })
 
+  // The CLI generates a `defineScope` of its own — `user-admin.gen.ts` ships
+  // the whole `admin` tree, and `@pikku/addon-console` spells it out again — so
+  // a project that scaffolds user-admin declares scopes in more than one file
+  // and every one of them has to survive.
+  test('declarations in separate files all survive', async () => {
+    const { state, criticals } = await inspectSources({
+      'user-admin.gen.ts': [
+        "import { defineScope } from '@pikku/core/scope'",
+        'defineScope({ admin: {} })',
+      ].join('\n'),
+      'scopes.ts': [
+        "import { defineScope } from '@pikku/core/scope'",
+        'defineScope({ billing: {} })',
+      ].join('\n'),
+    })
+
+    assert.deepEqual(
+      criticals.filter((c) => /Only one defineScope/.test(c.message)),
+      [],
+      `expected no duplicate critical, got ${JSON.stringify(criticals)}`
+    )
+    assert.deepEqual(
+      state.scopes.definitions.map((d) => d.name).sort(),
+      ['admin', 'billing']
+    )
+  })
+
+  // The CLI scaffolds a scope tree of its own — `user-admin.gen.ts` declares the
+  // whole `admin` tree — so a generated declaration cannot be made to compete
+  // with the app's own for the single slot.
+  test('a generated declaration neither claims the slot nor conflicts', async () => {
+    const { state, criticals } = await inspectSources({
+      'user-admin.gen.ts': [
+        "import { defineScope } from '@pikku/core/scope'",
+        'defineScope({ admin: {} })',
+      ].join('\n'),
+      'scopes.ts': [
+        "import { defineScope } from '@pikku/core/scope'",
+        'defineScope({ billing: {} })',
+      ].join('\n'),
+    })
+
+    assert.deepEqual(
+      criticals.filter((c) => c.code === ErrorCode.DUPLICATE_SCOPE_DEFINITION),
+      [],
+      `expected no duplicate critical, got ${JSON.stringify(criticals)}`
+    )
+    assert.deepEqual(
+      state.scopes.definitions.map((d) => d.name).sort(),
+      ['admin', 'billing'],
+      "both the generated tree and the app's own must survive"
+    )
+  })
+
   test('is critical when a root embeds the separator', async () => {
     const { criticals } = await inspectSource(
       [

package/src/add/add-system-role.test.ts

@@ -35,6 +35,25 @@ const inspectSource = async (source: string) => {
   }
 }
 
+/** Inspects several files at once, keyed by basename. */
+const inspectSources = async (sources: Record<string, string>) => {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-role-multi-'))
+  const files: Record<string, string> = {}
+  for (const [name, source] of Object.entries(sources)) {
+    files[name] = join(rootDir, name)
+    await writeFile(files[name]!, source)
+  }
+  const criticals: Array<{ code: ErrorCode; message: string }> = []
+  try {
+    const state = await inspect(makeLogger(criticals), Object.values(files), {
+      rootDir,
+    })
+    return { state, criticals, files }
+  } finally {
+    await rm(rootDir, { recursive: true, force: true })
+  }
+}
+
 const IMPORTS = [
   "import { defineScope } from '@pikku/core/scope'",
   "import { defineSystemRole } from '@pikku/core/role'",
@@ -91,6 +110,70 @@ describe('addSystemRole inspector', () => {
     )
   })
 
+  test('extracts roles from several calls in one file', async () => {
+    const { state } = await inspectSource(
+      withScopes(
+        "defineSystemRole({ buyer: { scopes: ['catalogue:read'] } })",
+        "defineSystemRole({ admin: { scopes: ['admin'] } })"
+      )
+    )
+
+    assert.deepEqual(
+      state.systemRoles.definitions.map((r) => r.name).sort(),
+      ['admin', 'buyer']
+    )
+  })
+
+  // Roles follow scopes: a project scaffolding user-admin has a generated
+  // declaration beside its own, so every file's roles have to survive.
+  test('declarations in separate files all survive', async () => {
+    const { state, criticals } = await inspectSources({
+      'roles.ts': withScopes(
+        "defineSystemRole({ buyer: { scopes: ['catalogue:read'] } })"
+      ),
+      'more-roles.ts': [
+        "import { defineSystemRole } from '@pikku/core/role'",
+        "defineSystemRole({ admin: { scopes: ['admin'] } })",
+      ].join('\n'),
+    })
+
+    assert.deepEqual(
+      criticals.filter((c) => /Only one defineSystemRole/.test(c.message)),
+      [],
+      `expected no duplicate critical, got ${JSON.stringify(criticals)}`
+    )
+    assert.deepEqual(
+      state.systemRoles.definitions.map((r) => r.name).sort(),
+      ['admin', 'buyer']
+    )
+  })
+
+  // A generated file is not the one place a person adds a role to, so it neither
+  // takes the single slot nor collides with the app's own declaration.
+  test('a generated declaration neither claims the slot nor conflicts', async () => {
+    const { state, criticals } = await inspectSources({
+      'roles.gen.ts': [
+        "import { defineSystemRole } from '@pikku/core/role'",
+        'defineSystemRole({ admin: { scopes: [] } })',
+      ].join('\n'),
+      'roles.ts': withScopes(
+        "defineSystemRole({ buyer: { scopes: ['catalogue:read'] } })"
+      ),
+    })
+
+    assert.deepEqual(
+      criticals.filter(
+        (c) => c.code === ErrorCode.DUPLICATE_SYSTEM_ROLE_DEFINITION
+      ),
+      [],
+      `expected no duplicate critical, got ${JSON.stringify(criticals)}`
+    )
+    assert.deepEqual(state.systemRoles.definitions.map((r) => r.name).sort(), [
+      'admin',
+      'buyer',
+    ])
+  })
+
   test('a role granting nothing is legitimate, said explicitly', async () => {
     const { state, criticals } = await inspectSource(
       withScopes('defineSystemRole({', '  guest: { scopes: [] },', '})')

package/src/add/add-workflow.ts

@@ -229,7 +229,13 @@ function getWorkflowInvocations(
  * Inspector for pikkuWorkflowFunc(), pikkuWorkflowComplexFunc() and
  * pikkuScenario() calls. Detects workflow registration and extracts metadata.
  */
-export const addWorkflow: AddWiring = (logger, node, checker, state) => {
+export const addWorkflow: AddWiring = (
+  logger,
+  node,
+  checker,
+  state,
+  options
+) => {
   if (!ts.isCallExpression(node)) {
     return
   }
@@ -246,6 +252,17 @@ export const addWorkflow: AddWiring = (logger, node, checker, state) => {
   if (expression.text === 'pikkuWorkflowFunc') {
     wrapperType = 'dsl'
   } else if (expression.text === 'pikkuWorkflowComplexFunc') {
+    if (!options.allow?.complexWorkflows) {
+      logger.critical(
+        ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED,
+        `'${expression.text}' is used here, but this project has not enabled complex workflows. ` +
+          `Their inline steps cannot be serialized, so they are absent from the workflow graph and ` +
+          `cannot be replayed or migrated across a definition change. Express the workflow with ` +
+          `pikkuWorkflowFunc and the step DSL, or set \`allow: { complexWorkflows: true }\` in ` +
+          `pikku.config.json if the project accepts that trade.`
+      )
+      return
+    }
     wrapperType = 'complex'
   } else if (expression.text === 'pikkuScenario') {
     // A scenario is a complex workflow whose steps run as actors over the
@@ -351,6 +368,7 @@ export const addWorkflow: AddWiring = (logger, node, checker, state) => {
   let steps: WorkflowStepMeta[] = []
   let context: WorkflowContext | undefined = undefined
   let dsl: boolean | undefined = undefined
+  let asserts: boolean | undefined = undefined
 
   // Try DSL workflow extraction first
   // Pass the whole CallExpression node so findWorkflowFunction can find the arrow function
@@ -362,6 +380,7 @@ export const addWorkflow: AddWiring = (logger, node, checker, state) => {
     // Extraction succeeded
     steps = result.steps
     context = result.context
+    asserts = result.asserts
 
     // Check if workflow contains inline steps (non-serializable)
     if (hasInlineSteps(steps)) {
@@ -449,6 +468,7 @@ export const addWorkflow: AddWiring = (logger, node, checker, state) => {
     expose,
     skip,
     scenario: wrapperType === 'scenario' ? true : undefined,
+    asserts,
     actors: actorNames.length > 0 ? actorNames : undefined,
   }
 

package/src/add/allow-escape-hatches.test.ts

@@ -0,0 +1,144 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import { ErrorCode } from '../error-codes.js'
+import type { InspectorLogger, InspectorOptions } from '../types.js'
+
+function makeLogger(
+  criticals: Array<{ code: string; message: string }>
+): InspectorLogger {
+  return {
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: ({ code, message }: any) => criticals.push({ code, message }),
+    critical: (code: any, message: string) => criticals.push({ code, message }),
+    hasCriticalErrors: () => criticals.length > 0,
+  } as InspectorLogger
+}
+
+async function run(source: string, allow: InspectorOptions['allow'] = {}) {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-allow-'))
+  const file = join(rootDir, 'subject.ts')
+  await writeFile(file, source)
+  const criticals: Array<{ code: string; message: string }> = []
+  const state = await inspect(makeLogger(criticals), [file], {
+    rootDir,
+    allow,
+  })
+  await rm(rootDir, { recursive: true, force: true })
+  return { state, criticals }
+}
+
+const has = (criticals: Array<{ code: string }>, code: ErrorCode) =>
+  criticals.some((c) => c.code === code)
+
+const PERMISSIONS_IN_BODY = [
+  "import { pikkuSessionlessFunc } from '@pikku/core'",
+  'export const stripeWebhook = pikkuSessionlessFunc({',
+  '  expose: true,',
+  '  permissionsInBody: true,',
+  '  func: async () => ({ ok: true }),',
+  '})',
+].join('\n')
+
+const COMPLEX_WORKFLOW = [
+  "import { pikkuWorkflowComplexFunc } from '@pikku/core/workflow'",
+  'export const cleanup = pikkuWorkflowComplexFunc(',
+  '  async (_services, _input, { workflow }: any) => {',
+  '    for (const id of [1, 2, 3]) {',
+  "      await workflow.step('touch', { id })",
+  '    }',
+  '    return { ok: true }',
+  '  }',
+  ')',
+].join('\n')
+
+describe('allow: escape hatches are refused unless opted into', () => {
+  test('permissionsInBody is a critical when not allowed', async () => {
+    const { criticals } = await run(PERMISSIONS_IN_BODY)
+    assert.ok(
+      has(criticals, ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED),
+      `expected PKU576, got ${JSON.stringify(criticals)}`
+    )
+  })
+
+  test('the message names the flag that would permit it', async () => {
+    const { criticals } = await run(PERMISSIONS_IN_BODY)
+    const found = criticals.find(
+      (c) => c.code === ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED
+    )
+    assert.match(found!.message, /allow: \{ permissionsInBody: true \}/)
+    assert.match(found!.message, /stripeWebhook/)
+  })
+
+  test('permissionsInBody is accepted once allowed', async () => {
+    const { criticals, state } = await run(PERMISSIONS_IN_BODY, {
+      permissionsInBody: true,
+    })
+    assert.equal(
+      has(criticals, ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED),
+      false
+    )
+    const meta = Object.values(state.functions.meta) as any[]
+    assert.equal(
+      meta.find((m) => m.name === 'stripeWebhook')?.permissionsInBody,
+      true
+    )
+  })
+
+  test('a refused function is not registered at all', async () => {
+    const { state } = await run(PERMISSIONS_IN_BODY)
+    const meta = Object.values(state.functions.meta) as any[]
+    assert.equal(
+      meta.some((m) => m.name === 'stripeWebhook'),
+      false,
+      'a refused function must not reach the meta, or the build would emit it anyway'
+    )
+  })
+
+  test('complexWorkflows is a critical when not allowed', async () => {
+    const { criticals } = await run(COMPLEX_WORKFLOW)
+    assert.ok(
+      has(criticals, ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED),
+      `expected PKU643, got ${JSON.stringify(criticals)}`
+    )
+  })
+
+  test('the complex-workflow message points at the DSL', async () => {
+    const { criticals } = await run(COMPLEX_WORKFLOW)
+    const found = criticals.find(
+      (c) => c.code === ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED
+    )
+    assert.match(found!.message, /pikkuWorkflowFunc/)
+    assert.match(found!.message, /allow: \{ complexWorkflows: true \}/)
+  })
+
+  test('complexWorkflows is accepted once allowed', async () => {
+    const { criticals } = await run(COMPLEX_WORKFLOW, {
+      complexWorkflows: true,
+    })
+    assert.equal(has(criticals, ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED), false)
+  })
+
+  test('an ordinary function and DSL workflow are unaffected', async () => {
+    const { criticals } = await run(
+      [
+        "import { pikkuFunc } from '@pikku/core'",
+        'export const ordinary = pikkuFunc({',
+        '  expose: true,',
+        '  func: async () => ({ ok: true }),',
+        '})',
+      ].join('\n')
+    )
+    assert.equal(
+      has(criticals, ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED),
+      false
+    )
+    assert.equal(has(criticals, ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED), false)
+  })
+})