@stigmer/runner 3.0.1

package/dist/workflow-engine/types.js

@@ -0,0 +1,47 @@
+/**
+ * Core type definitions for the workflow execution engine.
+ *
+ * These types represent the serializable, plain-object form of a
+ * CNCF Serverless Workflow DSL 1.0.0 document. The loader converts
+ * CNCF SDK class instances into these types; the engine operates
+ * exclusively on them. No SDK class instances cross the serialization
+ * boundary into the Temporal workflow sandbox.
+ *
+ * The type system follows the CNCF spec structure but uses a
+ * discriminated union (`kind` field) for task types to enable
+ * exhaustive type checking in TypeScript.
+ */
+export const FLOW_CONTINUE = "continue";
+export const FLOW_END = "end";
+export const FLOW_EXIT = "exit";
+export function isTermination(directive) {
+    return directive === FLOW_END || directive === FLOW_EXIT;
+}
+export function isExplicitTarget(directive) {
+    return (directive !== FLOW_CONTINUE &&
+        directive !== FLOW_END &&
+        directive !== FLOW_EXIT);
+}
+// ─────────────────────────────────────────────────────────────────────
+// Error types
+// ─────────────────────────────────────────────────────────────────────
+/**
+ * Typed error for agent call failures that preserves the child
+ * AgentExecution ID across the error propagation chain.
+ *
+ * The orchestrator throws this when the CallAgent activity fails,
+ * carrying the child execution ID that was captured via the
+ * `child_execution_started` signal. Downstream consumers
+ * (CallAgentTaskBuilder, do-executor) extract the ID to:
+ *   - Emit `agent_call_completed` events with the correct child ref
+ *   - Set task metadata so the execution inspector can link to it
+ */
+export class AgentCallError extends Error {
+    childExecutionId;
+    constructor(message, childExecutionId) {
+        super(message);
+        this.name = "AgentCallError";
+        this.childExecutionId = childExecutionId;
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/workflow-engine/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/workflow-engine/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA6LH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AACxC,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAC9B,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEhC,MAAM,UAAU,aAAa,CAAC,SAAwB;IACpD,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAwB;IACvD,OAAO,CACL,SAAS,KAAK,aAAa;QAC3B,SAAS,KAAK,QAAQ;QACtB,SAAS,KAAK,SAAS,CACxB,CAAC;AACJ,CAAC;AAsnBD,wEAAwE;AACxE,cAAc;AACd,wEAAwE;AAExE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,gBAAgB,CAAS;IAElC,YAAY,OAAe,EAAE,gBAAwB;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF"}

package/dist/workflows/call-agent-orchestrator.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Workflow-side orchestrator for call:agent tasks.
+ *
+ * Runs inside the Temporal deterministic workflow sandbox. Manages:
+ * 1. Starting the CallAgent activity (async completion)
+ * 2. Listening for `child_execution_started` to get early child execution ID
+ * 3. Listening for `child_approval_required` signals from child agents
+ * 4. Updating workflow approval status via local activities
+ * 5. Returning the agent result when the activity completes
+ *
+ * The kernel's CallAgentTaskBuilder calls `ctx.callAgent()`, which
+ * is wired to `orchestrateAgentCall()` in execute-serverless-workflow.ts.
+ *
+ * SANDBOX RULES: Only @temporalio/workflow imports, type-only imports,
+ * and pure logic. No Node.js built-ins.
+ */
+import type { AgentCallConfig, AgentCallResult } from "../workflow-engine/types.js";
+import type { ChildApprovalNotification } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
+export declare const childApprovalRequired: import("@temporalio/workflow").SignalDefinition<[ChildApprovalNotification], string>;
+/** Sent by the platform immediately after the child AgentExecution starts. */
+export declare const childExecutionStarted: import("@temporalio/workflow").SignalDefinition<[{
+    executionId: string;
+}], string>;
+export interface AgentCallOrchestrationInput {
+    config: AgentCallConfig;
+    runtimeEnv: Record<string, unknown>;
+    parentWorkflowId: string;
+    taskName: string;
+    workflowExecutionId: string;
+}
+export declare function orchestrateAgentCall(input: AgentCallOrchestrationInput): Promise<AgentCallResult>;

package/dist/workflows/call-agent-orchestrator.js

@@ -0,0 +1,214 @@
+/**
+ * Workflow-side orchestrator for call:agent tasks.
+ *
+ * Runs inside the Temporal deterministic workflow sandbox. Manages:
+ * 1. Starting the CallAgent activity (async completion)
+ * 2. Listening for `child_execution_started` to get early child execution ID
+ * 3. Listening for `child_approval_required` signals from child agents
+ * 4. Updating workflow approval status via local activities
+ * 5. Returning the agent result when the activity completes
+ *
+ * The kernel's CallAgentTaskBuilder calls `ctx.callAgent()`, which
+ * is wired to `orchestrateAgentCall()` in execute-serverless-workflow.ts.
+ *
+ * SANDBOX RULES: Only @temporalio/workflow imports, type-only imports,
+ * and pure logic. No Node.js built-ins.
+ */
+import { defineSignal, setHandler, condition, proxyActivities, proxyLocalActivities, log, isCancellation, } from "@temporalio/workflow";
+import { AgentCallError } from "../workflow-engine/types.js";
+// ─────────────────────────────────────────────────────────────────────
+// Signal Definitions
+// ─────────────────────────────────────────────────────────────────────
+export const childApprovalRequired = defineSignal("child_approval_required");
+/** Sent by the platform immediately after the child AgentExecution starts. */
+export const childExecutionStarted = defineSignal("child_execution_started");
+const agentProxy = proxyActivities({
+    startToCloseTimeout: "1h",
+    retry: {
+        maximumAttempts: 1,
+    },
+});
+const statusProxy = proxyLocalActivities({
+    startToCloseTimeout: "30s",
+    retry: {
+        maximumAttempts: 3,
+        initialInterval: "2s",
+        backoffCoefficient: 2,
+    },
+});
+const eventProxy = proxyLocalActivities({
+    startToCloseTimeout: "10s",
+    retry: {
+        maximumAttempts: 2,
+        initialInterval: "500ms",
+    },
+});
+/**
+ * Orchestrates a call:agent task from the workflow function.
+ *
+ * Starts the CallAgent activity (async completion), sets up a signal
+ * handler for HITL approval notifications, and waits for the activity
+ * to complete. Returns the agent's result.
+ */
+const PROGRESS_POLL_INTERVAL = "15s";
+export async function orchestrateAgentCall(input) {
+    let activityDone = false;
+    let activityResult = {};
+    let activityError = undefined;
+    let pendingNotification;
+    let childExecId;
+    let initialProgressEmitted = false;
+    setHandler(childApprovalRequired, (notification) => {
+        pendingNotification = notification;
+        if (!childExecId && notification.executionId) {
+            childExecId = notification.executionId;
+        }
+    });
+    setHandler(childExecutionStarted, (payload) => {
+        // The Go server sends { executionId: "aex_xxx" } (struct with json tag).
+        // The Java server sends "aex_xxx" (bare string via parentStub.signal(name, id)).
+        // Handle both shapes for cross-implementation resilience.
+        if (typeof payload === "string") {
+            childExecId = payload;
+        }
+        else if (payload && typeof payload === "object" && "executionId" in payload) {
+            childExecId = payload.executionId;
+        }
+    });
+    const enrichedConfig = {
+        ...input.config,
+        __taskName: input.taskName,
+        __wfExecId: input.workflowExecutionId,
+    };
+    log.info("[CallAgent orchestrator] sending to activity", {
+        taskName: input.taskName,
+        hasOutput: enrichedConfig.output !== undefined,
+        hasOutputSchema: enrichedConfig.output?.schema !== undefined,
+        configKeys: Object.keys(enrichedConfig).join(","),
+        hasTaskName: !!enrichedConfig.__taskName,
+    });
+    const activityPromise = agentProxy
+        .CallAgent(enrichedConfig, input.runtimeEnv, input.parentWorkflowId)
+        .then((result) => {
+        if (typeof result === "string") {
+            try {
+                activityResult = JSON.parse(result);
+            }
+            catch {
+                activityResult = {};
+            }
+        }
+        else {
+            activityResult = (result ?? {});
+        }
+        log.info("[CallAgent callback] activity result received", {
+            taskName: input.taskName,
+            hasStructured: activityResult.structured !== undefined,
+            resultKeys: Object.keys(activityResult).join(","),
+        });
+        activityDone = true;
+    })
+        .catch((err) => {
+        if (isCancellation(err)) {
+            activityDone = true;
+            return;
+        }
+        activityError = err;
+        activityDone = true;
+    });
+    while (!activityDone) {
+        // Wait for a signal, activity completion, or periodic timeout for progress polling.
+        // condition() returns false on timeout, true when the predicate became true.
+        const conditionMet = await condition(() => activityDone || pendingNotification !== undefined || (!!childExecId && !initialProgressEmitted), PROGRESS_POLL_INTERVAL);
+        if (activityDone)
+            break;
+        // Emit initial progress with childExecutionId as soon as it's known
+        if (childExecId && !initialProgressEmitted) {
+            initialProgressEmitted = true;
+            await emitProgress(input, childExecId, null);
+        }
+        // Periodic progress: on timeout, poll the child execution for live data
+        if (!conditionMet && childExecId) {
+            let progress = null;
+            try {
+                progress = await statusProxy.GetAgentExecutionProgress(childExecId);
+            }
+            catch (err) {
+                log.warn("Failed to fetch agent progress (non-fatal)", {
+                    error: String(err),
+                    taskName: input.taskName,
+                });
+            }
+            if (progress) {
+                await emitProgress(input, childExecId, progress);
+            }
+        }
+        // Handle HITL approval notification
+        if (pendingNotification) {
+            const notification = pendingNotification;
+            pendingNotification = undefined;
+            try {
+                await statusProxy.UpdateWorkflowTaskApprovalStatus(input.workflowExecutionId, input.taskName, notification);
+            }
+            catch (statusErr) {
+                log.warn("Failed to update workflow approval status (non-fatal)", {
+                    error: String(statusErr),
+                    taskName: input.taskName,
+                });
+            }
+        }
+    }
+    // Emit a final progress event if the child ID arrived but was never emitted.
+    // This handles the fast-completion race: the activity finishes before the
+    // orchestrator loop has a chance to process the child_execution_started signal.
+    if (childExecId && !initialProgressEmitted) {
+        await emitProgress(input, childExecId, null);
+    }
+    try {
+        await statusProxy.ClearWorkflowApprovalStatus(input.workflowExecutionId);
+    }
+    catch (clearErr) {
+        log.warn("Failed to clear workflow approval status (non-fatal)", {
+            error: String(clearErr),
+        });
+    }
+    if (activityError) {
+        if (childExecId) {
+            const msg = activityError instanceof Error
+                ? activityError.message
+                : String(activityError);
+            throw new AgentCallError(msg, childExecId);
+        }
+        throw activityError;
+    }
+    // Ensure the child execution ID is available on the result for the
+    // agent_call_completed event emitted by CallAgentTaskBuilder.
+    if (childExecId && !activityResult.agent_execution_id) {
+        activityResult = { ...activityResult, agent_execution_id: childExecId };
+    }
+    return activityResult;
+}
+async function emitProgress(input, childExecId, progress) {
+    try {
+        const progressEvent = {
+            type: "agent_call_progress",
+            taskName: input.taskName,
+            occurredAt: new Date().toISOString(),
+            childExecutionId: childExecId,
+            agentSlug: input.config.agent ?? "",
+            agentPhase: progress?.agentPhase ?? 0,
+            currentToolName: progress?.currentToolName ?? "",
+            tokensConsumed: progress?.tokensConsumed ?? 0,
+            messagesCount: progress?.messagesCount ?? 0,
+            toolCallsCount: progress?.toolCallsCount ?? 0,
+        };
+        await eventProxy.EmitWorkflowEvents(input.workflowExecutionId, [progressEvent], []);
+    }
+    catch (emitErr) {
+        log.warn("Failed to emit agent_call_progress (non-fatal)", {
+            error: String(emitErr),
+            taskName: input.taskName,
+        });
+    }
+}
+//# sourceMappingURL=call-agent-orchestrator.js.map

package/dist/workflows/call-agent-orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-agent-orchestrator.js","sourceRoot":"","sources":["../../src/workflows/call-agent-orchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,eAAe,EACf,oBAAoB,EACpB,GAAG,EAEH,cAAc,GACf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAG7D,wEAAwE;AACxE,qBAAqB;AACrB,wEAAwE;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAC/C,yBAAyB,CAC1B,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAC/C,yBAAyB,CAC1B,CAAC;AAUF,MAAM,UAAU,GAAG,eAAe,CAAkB;IAClD,mBAAmB,EAAE,IAAI;IACzB,KAAK,EAAE;QACL,eAAe,EAAE,CAAC;KACnB;CACF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,oBAAoB,CAAmB;IACzD,mBAAmB,EAAE,KAAK;IAC1B,KAAK,EAAE;QACL,eAAe,EAAE,CAAC;QAClB,eAAe,EAAE,IAAI;QACrB,kBAAkB,EAAE,CAAC;KACtB;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,oBAAoB,CAAkB;IACvD,mBAAmB,EAAE,KAAK;IAC1B,KAAK,EAAE;QACL,eAAe,EAAE,CAAC;QAClB,eAAe,EAAE,OAAO;KACzB;CACF,CAAC,CAAC;AAcH;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAkC;IAElC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,cAAc,GAAoB,EAAE,CAAC;IACzC,IAAI,aAAa,GAAY,SAAS,CAAC;IACvC,IAAI,mBAA0D,CAAC;IAC/D,IAAI,WAA+B,CAAC;IACpC,IAAI,sBAAsB,GAAG,KAAK,CAAC;IAEnC,UAAU,CAAC,qBAAqB,EAAE,CAAC,YAAuC,EAAE,EAAE;QAC5E,mBAAmB,GAAG,YAAY,CAAC;QACnC,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;YAC7C,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,qBAAqB,EAAE,CAAC,OAAyC,EAAE,EAAE;QAC9E,yEAAyE;QACzE,iFAAiF;QACjF,0DAA0D;QAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC;aAAM,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,aAAa,IAAI,OAAO,EAAE,CAAC;YAC9E,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG;QACrB,GAAG,KAAK,CAAC,MAAM;QACf,UAAU,EAAE,KAAK,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAAK,CAAC,mBAAmB;KACtC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE;QACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,cAAc,CAAC,MAAM,KAAK,SAAS;QAC9C,eAAe,EAAE,cAAc,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS;QAC5D,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC,UAAU;KACzC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,UAAU;SAC/B,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC;SACnE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAoB,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc,GAAG,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,CAAC,MAAM,IAAI,EAAE,CAAoB,CAAC;QACrD,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,cAAc,CAAC,UAAU,KAAK,SAAS;YACtD,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SAClD,CAAC,CAAC;QACH,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,YAAY,GAAG,IAAI,CAAC;YACpB,OAAO;QACT,CAAC;QACD,aAAa,GAAG,GAAG,CAAC;QACpB,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,YAAY,EAAE,CAAC;QACrB,oFAAoF;QACpF,6EAA6E;QAC7E,MAAM,YAAY,GAAG,MAAM,SAAS,CAClC,GAAG,EAAE,CAAC,YAAY,IAAI,mBAAmB,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,sBAAsB,CAAC,EACrG,sBAAsB,CACvB,CAAC;QAEF,IAAI,YAAY;YAAE,MAAM;QAExB,oEAAoE;QACpE,IAAI,WAAW,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC3C,sBAAsB,GAAG,IAAI,CAAC;YAC9B,MAAM,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QAED,wEAAwE;QACxE,IAAI,CAAC,YAAY,IAAI,WAAW,EAAE,CAAC;YACjC,IAAI,QAAQ,GAAgC,IAAI,CAAC;YACjD,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,WAAW,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE;oBACrD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,mBAAmB,CAAC;YACzC,mBAAmB,GAAG,SAAS,CAAC;YAEhC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,gCAAgC,CAChD,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,QAAQ,EACd,YAAY,CACb,CAAC;YACJ,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE;oBAChE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC;oBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,gFAAgF;IAChF,IAAI,WAAW,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC3C,MAAM,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,2BAA2B,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,sDAAsD,EAAE;YAC/D,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,aAAa,YAAY,KAAK;gBACxC,CAAC,CAAC,aAAa,CAAC,OAAO;gBACvB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC1B,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,aAAa,CAAC;IACtB,CAAC;IAED,mEAAmE;IACnE,8DAA8D;IAC9D,IAAI,WAAW,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;QACtD,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAkC,EAClC,WAAmB,EACnB,QAAqC;IAErC,IAAI,CAAC;QACH,MAAM,aAAa,GAA4B;YAC7C,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,gBAAgB,EAAE,WAAW;YAC7B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YACnC,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,CAAC;YACrC,eAAe,EAAE,QAAQ,EAAE,eAAe,IAAI,EAAE;YAChD,cAAc,EAAE,QAAQ,EAAE,cAAc,IAAI,CAAC;YAC7C,aAAa,EAAE,QAAQ,EAAE,aAAa,IAAI,CAAC;YAC3C,cAAc,EAAE,QAAQ,EAAE,cAAc,IAAI,CAAC;SAC9C,CAAC;QACF,MAAM,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,gDAAgD,EAAE;YACzD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/workflows/connect-mcp-server.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Temporal workflows for the MCP server connect flow.
+ *
+ * ConnectMcpServerWorkflow ("stigmer/mcp-server/connect"):
+ *   Two-stage pipeline — discover tools, then classify approval policies.
+ *   Short-circuits classification when the tools fingerprint is unchanged
+ *   and previous approvals exist.
+ *
+ * DiscoverMcpServerWorkflow ("stigmer/mcp-server/discover"):
+ *   Legacy single-stage wrapper retained for in-flight backward
+ *   compatibility during deployment transitions.
+ *
+ * SANDBOX RULES: This file runs inside the Temporal deterministic V8
+ * isolate. No Node.js built-ins (crypto, fs, net), no non-deterministic
+ * operations, no side-effecting imports. Only @temporalio/workflow APIs,
+ * type-only imports, and pure JS/TS logic.
+ */
+import type { ConnectMcpServerWorkflowInput, ConnectMcpServerWorkflowOutput, DiscoverMcpServerWorkflowOutput } from "./types.js";
+export declare function connectMcpServer(input: ConnectMcpServerWorkflowInput): Promise<ConnectMcpServerWorkflowOutput>;
+export declare function discoverMcpServerLegacy(input: ConnectMcpServerWorkflowInput): Promise<DiscoverMcpServerWorkflowOutput>;

package/dist/workflows/connect-mcp-server.js

@@ -0,0 +1,113 @@
+/**
+ * Temporal workflows for the MCP server connect flow.
+ *
+ * ConnectMcpServerWorkflow ("stigmer/mcp-server/connect"):
+ *   Two-stage pipeline — discover tools, then classify approval policies.
+ *   Short-circuits classification when the tools fingerprint is unchanged
+ *   and previous approvals exist.
+ *
+ * DiscoverMcpServerWorkflow ("stigmer/mcp-server/discover"):
+ *   Legacy single-stage wrapper retained for in-flight backward
+ *   compatibility during deployment transitions.
+ *
+ * SANDBOX RULES: This file runs inside the Temporal deterministic V8
+ * isolate. No Node.js built-ins (crypto, fs, net), no non-deterministic
+ * operations, no side-effecting imports. Only @temporalio/workflow APIs,
+ * type-only imports, and pure JS/TS logic.
+ */
+import { proxyActivities, log } from "@temporalio/workflow";
+const discover = proxyActivities({
+    startToCloseTimeout: "600s",
+    heartbeatTimeout: "60s",
+    retry: { maximumAttempts: 1 },
+});
+function classifyWithTimeout(numTools) {
+    const timeoutSec = Math.max(120, (Math.floor(numTools / 40) + 1) * 60);
+    return proxyActivities({
+        startToCloseTimeout: `${timeoutSec}s`,
+        retry: { maximumAttempts: 2 },
+    });
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// ConnectMcpServerWorkflow — primary connect flow
+// ─────────────────────────────────────────────────────────────────────────────
+export async function connectMcpServer(input) {
+    const discovery = await discover.DiscoverMcpServerCapabilities({
+        mcpServerId: input.mcp_server_id,
+        executionContextId: input.execution_context_id ?? null,
+        invokerIdentityAccountId: input.invoker_identity_account_id ?? null,
+    });
+    const canReusePreviousApprovals = discovery.newToolsFingerprint !== "" &&
+        discovery.newToolsFingerprint === discovery.previousToolsFingerprint &&
+        discovery.previousToolApprovals.length > 0;
+    let toolApprovals;
+    if (canReusePreviousApprovals) {
+        log.info(`Tools unchanged for '${input.mcp_server_id}' ` +
+            `(fingerprint ${discovery.newToolsFingerprint.slice(0, 12)}) — ` +
+            `reusing ${discovery.previousToolApprovals.length} previous approval(s)`);
+        toolApprovals = discovery.previousToolApprovals.map((a) => ({
+            tool_name: a.toolName,
+            requires_approval: a.requiresApproval,
+            message: a.message,
+        }));
+    }
+    else {
+        const classifyInput = {
+            tools: discovery.tools.map((t) => ({
+                name: t.name,
+                description: t.description,
+                input_schema: t.inputSchema ?? null,
+            })),
+            serverName: input.mcp_server_id,
+            serverDescription: "",
+            mcpServerId: input.mcp_server_id,
+        };
+        const classify = classifyWithTimeout(discovery.tools.length);
+        toolApprovals = await classify.ClassifyToolApprovals(classifyInput);
+    }
+    return {
+        tools: discovery.tools.map((t) => ({
+            name: t.name,
+            description: t.description,
+            input_schema: t.inputSchema ?? null,
+        })),
+        resource_templates: discovery.resourceTemplates.map((rt) => ({
+            uri_template: rt.uriTemplate,
+            name: rt.name,
+            description: rt.description,
+            mime_type: rt.mimeType,
+        })),
+        tool_approvals: toolApprovals,
+    };
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// DiscoverMcpServerWorkflow — legacy backward-compatible wrapper
+// ─────────────────────────────────────────────────────────────────────────────
+export async function discoverMcpServerLegacy(input) {
+    const discovery = await discover.DiscoverMcpServerCapabilities({
+        mcpServerId: input.mcp_server_id,
+        executionContextId: input.execution_context_id ?? null,
+        invokerIdentityAccountId: input.invoker_identity_account_id ?? null,
+    });
+    return {
+        tools: discovery.tools.map((t) => ({
+            name: t.name,
+            description: t.description,
+            input_schema: t.inputSchema ?? null,
+        })),
+        resource_templates: discovery.resourceTemplates.map((rt) => ({
+            uri_template: rt.uriTemplate,
+            name: rt.name,
+            description: rt.description,
+            mime_type: rt.mimeType,
+        })),
+        previous_tools_fingerprint: discovery.previousToolsFingerprint,
+        previous_tool_approvals: discovery.previousToolApprovals.map((a) => ({
+            tool_name: a.toolName,
+            requires_approval: a.requiresApproval,
+            message: a.message,
+        })),
+        new_tools_fingerprint: discovery.newToolsFingerprint,
+    };
+}
+//# sourceMappingURL=connect-mcp-server.js.map

package/dist/workflows/connect-mcp-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-mcp-server.js","sourceRoot":"","sources":["../../src/workflows/connect-mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAkB5D,MAAM,QAAQ,GAAG,eAAe,CAAqB;IACnD,mBAAmB,EAAE,MAAM;IAC3B,gBAAgB,EAAE,KAAK;IACvB,KAAK,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;CAC9B,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACvE,OAAO,eAAe,CAAqB;QACzC,mBAAmB,EAAE,GAAG,UAAU,GAAG;QACrC,KAAK,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,kDAAkD;AAClD,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAoC;IAEpC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,6BAA6B,CAAC;QAC7D,WAAW,EAAE,KAAK,CAAC,aAAa;QAChC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;QACtD,wBAAwB,EAAE,KAAK,CAAC,2BAA2B,IAAI,IAAI;KACpE,CAAC,CAAC;IAEH,MAAM,yBAAyB,GAC7B,SAAS,CAAC,mBAAmB,KAAK,EAAE;QACpC,SAAS,CAAC,mBAAmB,KAAK,SAAS,CAAC,wBAAwB;QACpE,SAAS,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,CAAC;IAE7C,IAAI,aAIF,CAAC;IAEH,IAAI,yBAAyB,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CACN,wBAAwB,KAAK,CAAC,aAAa,IAAI;YAC7C,gBAAgB,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM;YAChE,WAAW,SAAS,CAAC,qBAAqB,CAAC,MAAM,uBAAuB,CAC3E,CAAC;QAEF,aAAa,GAAG,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,SAAS,EAAE,CAAC,CAAC,QAAQ;YACrB,iBAAiB,EAAE,CAAC,CAAC,gBAAgB;YACrC,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG;YACpB,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;aACpC,CAAC,CAAC;YACH,UAAU,EAAE,KAAK,CAAC,aAAa;YAC/B,iBAAiB,EAAE,EAAE;YACrB,WAAW,EAAE,KAAK,CAAC,aAAa;SACjC,CAAC;QAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7D,aAAa,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SACpC,CAAC,CAAC;QACH,kBAAkB,EAAE,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,YAAY,EAAE,EAAE,CAAC,WAAW;YAC5B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,SAAS,EAAE,EAAE,CAAC,QAAQ;SACvB,CAAC,CAAC;QACH,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAoC;IAEpC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,6BAA6B,CAAC;QAC7D,WAAW,EAAE,KAAK,CAAC,aAAa;QAChC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;QACtD,wBAAwB,EAAE,KAAK,CAAC,2BAA2B,IAAI,IAAI;KACpE,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SACpC,CAAC,CAAC;QACH,kBAAkB,EAAE,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,YAAY,EAAE,EAAE,CAAC,WAAW;YAC5B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,SAAS,EAAE,EAAE,CAAC,QAAQ;SACvB,CAAC,CAAC;QACH,0BAA0B,EAAE,SAAS,CAAC,wBAAwB;QAC9D,uBAAuB,EAAE,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,SAAS,EAAE,CAAC,CAAC,QAAQ;YACrB,iBAAiB,EAAE,CAAC,CAAC,gBAAgB;YACrC,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;QACH,qBAAqB,EAAE,SAAS,CAAC,mBAAmB;KACrD,CAAC;AACJ,CAAC"}

package/dist/workflows/engine-core.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Shared workflow engine core — runs CNCF Serverless Workflow DSL
+ * tasks inside the Temporal deterministic sandbox.
+ *
+ * Extracted from execute-serverless-workflow.ts so that both the
+ * direct workflow ("stigmer/workflow/execute") and the hydration
+ * wrapper ("stigmer/workflow/execute-from-execution") can share the
+ * engine without code duplication.
+ *
+ * SANDBOX RULES: This file runs inside the Temporal deterministic V8
+ * isolate. No Node.js built-ins (crypto, fs, net), no non-deterministic
+ * operations, no side-effecting imports. Only @temporalio/workflow APIs,
+ * type-only imports, and pure JS/TS logic.
+ */
+import type { ExecuteServerlessWorkflowInput } from "./execute-serverless-workflow.js";
+export interface RunWorkflowEngineOptions {
+    readonly checkPause?: () => Promise<void>;
+    readonly recoveryMode?: boolean;
+}
+/**
+ * Run the CNCF Serverless Workflow engine with a fully materialized input.
+ *
+ * Sets up activity proxies, builds the TaskExecutionContext, initializes
+ * state with env and workflow_input, resolves input/output transforms,
+ * executes all tasks via {@link executeDoTasks}, and returns the final
+ * output.
+ *
+ * Called by both:
+ * - `executeServerlessWorkflow` (direct invocation with pre-materialized input)
+ * - `executeFromExecution` (wrapper that hydrates from slim IDs first)
+ *
+ * @param options.checkPause Optional pause yield point callback. When
+ *   provided, the engine calls this between tasks and allows the
+ *   workflow to block on a Temporal condition when paused.
+ */
+export declare function runWorkflowEngine(input: ExecuteServerlessWorkflowInput, options?: RunWorkflowEngineOptions): Promise<unknown>;