@usearazzo/runner 0.0.0-stage → 1.0.1-alpha.11

package/src/registry/providers/OpenAPIDocumentRegistryProvider.cjs

@@ -0,0 +1,122 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime-corejs3/helpers/interopRequireDefault").default;
+var _interopRequireWildcard = require("@babel/runtime-corejs3/helpers/interopRequireWildcard").default;
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.providerOptionsOverride = exports.default = void 0;
+var _parser = require("@usearazzo/parser");
+var _resolver = require("@usearazzo/resolver");
+var _apidomDatamodel = require("@speclynx/apidom-datamodel");
+var _empty = require("@speclynx/apidom-reference/configuration/empty");
+var _apidomTraverse = require("@speclynx/apidom-traverse");
+var _apidomCore = require("@speclynx/apidom-core");
+var constants = _interopRequireWildcard(require("../../constants.cjs"));
+var _OpenAPIDocument = _interopRequireDefault(require("../../document/OpenAPIDocument.cjs"));
+var _DocumentRegistryProvider = _interopRequireWildcard(require("./DocumentRegistryProvider.cjs"));
+var _OpenAPIOperationIndex = _interopRequireDefault(require("../../document/OpenAPIOperationIndex.cjs"));
+/**
+ * Options for loading an OpenAPI document.
+ * @public
+ */
+
+/**
+ * Default options for loading an OpenAPI document.
+ */
+const providerOptionsOverride = exports.providerOptionsOverride = {
+  resolve: {
+    resolverOpts: {
+      cache: {
+        maxEntries: constants.MAX_HTTP_CACHE_ENTRIES,
+        maxStaleAge: constants.MAX_HTTP_CACHE_STALE_AGE
+      }
+    }
+  },
+  dereference: {
+    immutable: false,
+    circular: 'replace',
+    circularReplacer: _DocumentRegistryProvider.circularReplacer
+  }
+};
+
+/**
+ * Provides OpenAPIDocument instances for the DocumentRegistry.
+ *
+ * Parses, dereferences, and builds an OperationIndex for OpenAPI documents.
+ * @public
+ */
+class OpenAPIDocumentRegistryProvider extends _DocumentRegistryProvider.default {
+  #options;
+  constructor(options = {}) {
+    super();
+    this.#options = (0, _empty.mergeOptions)(providerOptionsOverride, options);
+  }
+  async canProvide(uri) {
+    try {
+      const options = this.#buildParseOptions();
+      const data = await (0, _empty.readFile)(uri, options);
+      const file = new _empty.File({
+        uri,
+        data
+      });
+      const parsers = options.parse.parsers.filter(p => p.name.startsWith('openapi'));
+      for (const parser of parsers) {
+        if (await parser.canParse(file)) return true;
+      }
+    } catch (error) {
+      if (error instanceof _empty.UnmatchedResolverError) return false;
+      throw error;
+    }
+    return false;
+  }
+
+  /**
+   * Loads an OpenAPI document from a URI and produces an OpenAPIDocument.
+   */
+  async provide(uri) {
+    const parseResult = await (0, _parser.parseOpenAPI)(uri, this.#buildParseOptions());
+    const operationIndex = await this.#buildOperationIndex(parseResult);
+    return new _OpenAPIDocument.default(uri, parseResult, operationIndex);
+  }
+  async #buildOperationIndex(parseResult) {
+    const index = new _OpenAPIOperationIndex.default();
+    const dereferenceOptions = this.#buildDereferenceOptions(parseResult);
+    const apiDereferenced = await (0, _apidomTraverse.traverseAsync)(parseResult.api, {
+      async PathItemElement(path) {
+        const pathItem = path.node;
+        if (!pathItem.hasMetaProperty('path')) return path.skip();
+        if (!(0, _apidomDatamodel.isStringElement)(pathItem.$ref)) return;
+        const pathItemDereferenced = await (0, _resolver.dereferenceOpenAPIElement)(pathItem, dereferenceOptions);
+        path.replaceWith(pathItemDereferenced);
+      },
+      OperationElement(path) {
+        const operation = path.node;
+        const operationId = (0, _apidomCore.toValue)(operation.operationId);
+        if (typeof operationId !== 'string') return path.skip();
+        if (operationId === '') return path.skip();
+        index.set(operationId, path.formatPath('jsonpointer'));
+        path.skip();
+      }
+    });
+    parseResult.replaceResult(apiDereferenced);
+    return index;
+  }
+  #buildParseOptions() {
+    return (0, _empty.mergeOptions)(_parser.defaultParseOpenAPIOptions, this.#options);
+  }
+  #buildDereferenceOptions(parseResult) {
+    let options = (0, _empty.mergeOptions)(_resolver.defaultDereferenceOpenAPIOptions, this.#options);
+    if (parseResult) {
+      options = (0, _empty.mergeOptions)(options, {
+        dereference: {
+          strategyOpts: {
+            parseResult
+          }
+        }
+      });
+    }
+    return options;
+  }
+}
+var _default = exports.default = OpenAPIDocumentRegistryProvider;

package/src/registry/providers/OpenAPIDocumentRegistryProvider.mjs

@@ -0,0 +1,114 @@
+import { parseOpenAPI, defaultParseOpenAPIOptions } from '@usearazzo/parser';
+import { dereferenceOpenAPIElement, defaultDereferenceOpenAPIOptions } from '@usearazzo/resolver';
+import { isStringElement } from '@speclynx/apidom-datamodel';
+import { readFile, File, mergeOptions } from '@speclynx/apidom-reference/configuration/empty';
+import { UnmatchedResolverError } from '@speclynx/apidom-reference/configuration/empty';
+import { traverseAsync } from '@speclynx/apidom-traverse';
+import { toValue } from '@speclynx/apidom-core';
+import * as constants from "../../constants.mjs";
+import OpenAPIDocument from "../../document/OpenAPIDocument.mjs";
+import DocumentRegistryProvider, { circularReplacer } from "./DocumentRegistryProvider.mjs";
+import OpenAPIOperationIndex from "../../document/OpenAPIOperationIndex.mjs";
+/**
+ * Options for loading an OpenAPI document.
+ * @public
+ */
+/**
+ * Default options for loading an OpenAPI document.
+ */
+export const providerOptionsOverride = {
+  resolve: {
+    resolverOpts: {
+      cache: {
+        maxEntries: constants.MAX_HTTP_CACHE_ENTRIES,
+        maxStaleAge: constants.MAX_HTTP_CACHE_STALE_AGE
+      }
+    }
+  },
+  dereference: {
+    immutable: false,
+    circular: 'replace',
+    circularReplacer
+  }
+};
+
+/**
+ * Provides OpenAPIDocument instances for the DocumentRegistry.
+ *
+ * Parses, dereferences, and builds an OperationIndex for OpenAPI documents.
+ * @public
+ */
+class OpenAPIDocumentRegistryProvider extends DocumentRegistryProvider {
+  #options;
+  constructor(options = {}) {
+    super();
+    this.#options = mergeOptions(providerOptionsOverride, options);
+  }
+  async canProvide(uri) {
+    try {
+      const options = this.#buildParseOptions();
+      const data = await readFile(uri, options);
+      const file = new File({
+        uri,
+        data
+      });
+      const parsers = options.parse.parsers.filter(p => p.name.startsWith('openapi'));
+      for (const parser of parsers) {
+        if (await parser.canParse(file)) return true;
+      }
+    } catch (error) {
+      if (error instanceof UnmatchedResolverError) return false;
+      throw error;
+    }
+    return false;
+  }
+
+  /**
+   * Loads an OpenAPI document from a URI and produces an OpenAPIDocument.
+   */
+  async provide(uri) {
+    const parseResult = await parseOpenAPI(uri, this.#buildParseOptions());
+    const operationIndex = await this.#buildOperationIndex(parseResult);
+    return new OpenAPIDocument(uri, parseResult, operationIndex);
+  }
+  async #buildOperationIndex(parseResult) {
+    const index = new OpenAPIOperationIndex();
+    const dereferenceOptions = this.#buildDereferenceOptions(parseResult);
+    const apiDereferenced = await traverseAsync(parseResult.api, {
+      async PathItemElement(path) {
+        const pathItem = path.node;
+        if (!pathItem.hasMetaProperty('path')) return path.skip();
+        if (!isStringElement(pathItem.$ref)) return;
+        const pathItemDereferenced = await dereferenceOpenAPIElement(pathItem, dereferenceOptions);
+        path.replaceWith(pathItemDereferenced);
+      },
+      OperationElement(path) {
+        const operation = path.node;
+        const operationId = toValue(operation.operationId);
+        if (typeof operationId !== 'string') return path.skip();
+        if (operationId === '') return path.skip();
+        index.set(operationId, path.formatPath('jsonpointer'));
+        path.skip();
+      }
+    });
+    parseResult.replaceResult(apiDereferenced);
+    return index;
+  }
+  #buildParseOptions() {
+    return mergeOptions(defaultParseOpenAPIOptions, this.#options);
+  }
+  #buildDereferenceOptions(parseResult) {
+    let options = mergeOptions(defaultDereferenceOpenAPIOptions, this.#options);
+    if (parseResult) {
+      options = mergeOptions(options, {
+        dereference: {
+          strategyOpts: {
+            parseResult
+          }
+        }
+      });
+    }
+    return options;
+  }
+}
+export default OpenAPIDocumentRegistryProvider;

package/src/resolver/ArazzoValueResolver.cjs

@@ -0,0 +1,42 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+var _apidomCore = require("@speclynx/apidom-core");
+var _arazzoRuntimeExpression = require("@swaggerexpert/arazzo-runtime-expression");
+/**
+ * Resolves a runtime expression to its value.
+ *
+ * Bridged to a lenient runtime expression evaluator
+ * (`(expression) => runtimeExpressionEvaluator.evaluate(expression)`), so an
+ * unresolvable reference yields `undefined` rather than throwing.
+ * @public
+ */
+
+/**
+ * Base of every resolver of authored Arazzo values — the single home of the
+ * literal-vs-expression rule they all share.
+ *
+ * Per Arazzo 1.0.1, an authored value (a parameter's `value`, an `outputs`
+ * entry, a `requestBody` replacement value) is either a literal or a whole
+ * runtime expression — there is no embedded/interpolated expression. So a
+ * value that is a string is resolved as an expression only when the entire
+ * string is a valid runtime expression; every other value (a non-expression
+ * string such as `"{$inputs.x}"`, a number, boolean, object, array, or null)
+ * is a literal and is used as-is. This is deliberately not template
+ * interpolation. The one exception is a `requestBody` payload, which "can
+ * contain" runtime expressions — {@link RequestBodyResolver} walks it instead.
+ * @public
+ */
+class ArazzoValueResolver {
+  /**
+   * Resolves one authored value element by the rule above.
+   */
+  resolveValue(element, resolve) {
+    const value = (0, _apidomCore.toValue)(element);
+    return typeof value === 'string' && (0, _arazzoRuntimeExpression.test)(value) ? resolve(value) : value;
+  }
+}
+var _default = exports.default = ArazzoValueResolver;

package/src/resolver/ArazzoValueResolver.mjs

@@ -0,0 +1,37 @@
+import { toValue } from '@speclynx/apidom-core';
+import { test as isRuntimeExpression } from '@swaggerexpert/arazzo-runtime-expression';
+
+/**
+ * Resolves a runtime expression to its value.
+ *
+ * Bridged to a lenient runtime expression evaluator
+ * (`(expression) => runtimeExpressionEvaluator.evaluate(expression)`), so an
+ * unresolvable reference yields `undefined` rather than throwing.
+ * @public
+ */
+
+/**
+ * Base of every resolver of authored Arazzo values — the single home of the
+ * literal-vs-expression rule they all share.
+ *
+ * Per Arazzo 1.0.1, an authored value (a parameter's `value`, an `outputs`
+ * entry, a `requestBody` replacement value) is either a literal or a whole
+ * runtime expression — there is no embedded/interpolated expression. So a
+ * value that is a string is resolved as an expression only when the entire
+ * string is a valid runtime expression; every other value (a non-expression
+ * string such as `"{$inputs.x}"`, a number, boolean, object, array, or null)
+ * is a literal and is used as-is. This is deliberately not template
+ * interpolation. The one exception is a `requestBody` payload, which "can
+ * contain" runtime expressions — {@link RequestBodyResolver} walks it instead.
+ * @public
+ */
+class ArazzoValueResolver {
+  /**
+   * Resolves one authored value element by the rule above.
+   */
+  resolveValue(element, resolve) {
+    const value = toValue(element);
+    return typeof value === 'string' && isRuntimeExpression(value) ? resolve(value) : value;
+  }
+}
+export default ArazzoValueResolver;

package/src/resolver/OpenAPIOperationParameterResolver.cjs

@@ -0,0 +1,117 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime-corejs3/helpers/interopRequireDefault").default;
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+var _apidomDatamodel = require("@speclynx/apidom-datamodel");
+var _apidomNsArazzo = require("@speclynx/apidom-ns-arazzo-1");
+var _ParameterDelivery = _interopRequireDefault(require("../client/ParameterDelivery.cjs"));
+var _ParameterIdentity = _interopRequireDefault(require("../document/ParameterIdentity.cjs"));
+var _ResolverError = _interopRequireDefault(require("../errors/ResolverError.cjs"));
+var _StepParameterResolver = _interopRequireDefault(require("./StepParameterResolver.cjs"));
+/**
+ * Resolves the `parameters` of a step targeting an OpenAPI operation into the
+ * map the operation is executed with.
+ *
+ * Values follow the family-wide literal-vs-expression rule of
+ * {@link ArazzoValueResolver}. Keys and their first-wins claiming are
+ * `ParameterDelivery`'s: `'{in}.{name}'` for a location the client
+ * can address — a parameter is unique by `(name, in)`, so keying by name
+ * alone would collapse two parameters that differ only in their location into
+ * one entry and silently drop the other, where an operation legally declaring
+ * `token` both as a header and as a query parameter must receive both — and
+ * the bare name for Arazzo's `querystring`, which names no OpenAPI location.
+ * First-wins is the override order the specification requires: the list is
+ * ordered by precedence, most specific first, as `ArazzoWorkflowNormalizer`
+ * leaves it once a step's own parameters have been merged with the ones it
+ * inherits.
+ *
+ * What the map reports, this resolver judges. A parameter without a location
+ * throws {@link ResolverError}: a step targeting an operation requires one
+ * (the normalizer does not inherit input-shaped workflow parameters into such
+ * steps, so this is the step's own authoring error), and delivering it bare
+ * instead would let it capture *every* declared location of that name — see
+ * `ParameterDelivery` for the lookup order that makes it so. A
+ * non-string location throws for the same reason it deduplicates with nothing
+ * in the normalizer: it names no location. And two *different* parameters the
+ * map reports as colliding cannot both be delivered, so a collision throws
+ * rather than silently dropping one — whether they collide on one key (the
+ * scheme is not injective: a `querystring` parameter named `header.token` and
+ * a header parameter named `token` both produce `header.token`) or across a
+ * bare/qualified pair sharing a name (a `querystring` `token` next to a
+ * header `token`), where the client would consult the bare name first and
+ * silently capture the qualified value.
+ * @public
+ */
+class OpenAPIOperationParameterResolver extends _StepParameterResolver.default {
+  /**
+   * Resolves each parameter's `value`, returning a
+   * `ParameterDelivery`-keyed record. Returns an empty object when
+   * there are no parameters.
+   *
+   * `scope` names the step in a thrown {@link ResolverError}.
+   */
+  resolve(parameters, resolve, scope) {
+    const delivery = new _ParameterDelivery.default();
+    if (parameters === undefined) return delivery.toRecord();
+    // present but scalar: walking it would fail as a bare
+    // `TypeError: parameters is not iterable`, raised by the language rather
+    // than the runner. Reported here as the authoring error it is.
+    if (!(0, _apidomDatamodel.isArrayElement)(parameters)) {
+      throw new _ResolverError.default('`parameters` is present but is not a list', {
+        ...scope,
+        target: 'parameters',
+        reason: 'malformed-parameters'
+      });
+    }
+    for (const parameter of parameters) {
+      if (!(0, _apidomNsArazzo.isParameterElement)(parameter)) continue;
+      // a Parameter Object without an identity has a missing or non-string
+      // name — reported as loudly as a malformed location below, rather than
+      // silently dropped from the request
+      const identity = _ParameterIdentity.default.of(parameter);
+      if (identity === undefined) {
+        throw new _ResolverError.default('Parameter has a missing or non-string name', {
+          ...scope,
+          reason: 'missing-name'
+        });
+      }
+      const {
+        name,
+        location
+      } = identity;
+      if (location === undefined) {
+        throw new _ResolverError.default(`Parameter "${name}" declares no location ("in"), which a step targeting an operation requires`, {
+          ...scope,
+          target: name,
+          reason: 'missing-location'
+        });
+      }
+      if (location === null) {
+        throw new _ResolverError.default(`Parameter "${name}" has a non-string location ("in")`, {
+          ...scope,
+          target: name,
+          reason: 'malformed-location'
+        });
+      }
+      const {
+        key,
+        outcome
+      } = delivery.claim(location, name);
+      // the same parameter declared again: the earlier, more specific one won
+      if (outcome === 'duplicate') continue;
+      if (outcome === 'collision') {
+        throw new _ResolverError.default(`Parameter "${name}" (in: ${location}) collides with another parameter on the ` + `delivery key "${key}" and cannot be delivered unambiguously`, {
+          ...scope,
+          target: name,
+          reason: 'ambiguous-delivery'
+        });
+      }
+      delivery.set(key, this.resolveValue(parameter.value, resolve));
+    }
+    return delivery.toRecord();
+  }
+}
+var _default = exports.default = OpenAPIOperationParameterResolver;

package/src/resolver/OpenAPIOperationParameterResolver.mjs

@@ -0,0 +1,110 @@
+import { isArrayElement } from '@speclynx/apidom-datamodel';
+import { isParameterElement } from '@speclynx/apidom-ns-arazzo-1';
+import ParameterDelivery from "../client/ParameterDelivery.mjs";
+import ParameterIdentity from "../document/ParameterIdentity.mjs";
+import ResolverError from "../errors/ResolverError.mjs";
+import StepParameterResolver from "./StepParameterResolver.mjs";
+/**
+ * Resolves the `parameters` of a step targeting an OpenAPI operation into the
+ * map the operation is executed with.
+ *
+ * Values follow the family-wide literal-vs-expression rule of
+ * {@link ArazzoValueResolver}. Keys and their first-wins claiming are
+ * `ParameterDelivery`'s: `'{in}.{name}'` for a location the client
+ * can address — a parameter is unique by `(name, in)`, so keying by name
+ * alone would collapse two parameters that differ only in their location into
+ * one entry and silently drop the other, where an operation legally declaring
+ * `token` both as a header and as a query parameter must receive both — and
+ * the bare name for Arazzo's `querystring`, which names no OpenAPI location.
+ * First-wins is the override order the specification requires: the list is
+ * ordered by precedence, most specific first, as `ArazzoWorkflowNormalizer`
+ * leaves it once a step's own parameters have been merged with the ones it
+ * inherits.
+ *
+ * What the map reports, this resolver judges. A parameter without a location
+ * throws {@link ResolverError}: a step targeting an operation requires one
+ * (the normalizer does not inherit input-shaped workflow parameters into such
+ * steps, so this is the step's own authoring error), and delivering it bare
+ * instead would let it capture *every* declared location of that name — see
+ * `ParameterDelivery` for the lookup order that makes it so. A
+ * non-string location throws for the same reason it deduplicates with nothing
+ * in the normalizer: it names no location. And two *different* parameters the
+ * map reports as colliding cannot both be delivered, so a collision throws
+ * rather than silently dropping one — whether they collide on one key (the
+ * scheme is not injective: a `querystring` parameter named `header.token` and
+ * a header parameter named `token` both produce `header.token`) or across a
+ * bare/qualified pair sharing a name (a `querystring` `token` next to a
+ * header `token`), where the client would consult the bare name first and
+ * silently capture the qualified value.
+ * @public
+ */
+class OpenAPIOperationParameterResolver extends StepParameterResolver {
+  /**
+   * Resolves each parameter's `value`, returning a
+   * `ParameterDelivery`-keyed record. Returns an empty object when
+   * there are no parameters.
+   *
+   * `scope` names the step in a thrown {@link ResolverError}.
+   */
+  resolve(parameters, resolve, scope) {
+    const delivery = new ParameterDelivery();
+    if (parameters === undefined) return delivery.toRecord();
+    // present but scalar: walking it would fail as a bare
+    // `TypeError: parameters is not iterable`, raised by the language rather
+    // than the runner. Reported here as the authoring error it is.
+    if (!isArrayElement(parameters)) {
+      throw new ResolverError('`parameters` is present but is not a list', {
+        ...scope,
+        target: 'parameters',
+        reason: 'malformed-parameters'
+      });
+    }
+    for (const parameter of parameters) {
+      if (!isParameterElement(parameter)) continue;
+      // a Parameter Object without an identity has a missing or non-string
+      // name — reported as loudly as a malformed location below, rather than
+      // silently dropped from the request
+      const identity = ParameterIdentity.of(parameter);
+      if (identity === undefined) {
+        throw new ResolverError('Parameter has a missing or non-string name', {
+          ...scope,
+          reason: 'missing-name'
+        });
+      }
+      const {
+        name,
+        location
+      } = identity;
+      if (location === undefined) {
+        throw new ResolverError(`Parameter "${name}" declares no location ("in"), which a step targeting an operation requires`, {
+          ...scope,
+          target: name,
+          reason: 'missing-location'
+        });
+      }
+      if (location === null) {
+        throw new ResolverError(`Parameter "${name}" has a non-string location ("in")`, {
+          ...scope,
+          target: name,
+          reason: 'malformed-location'
+        });
+      }
+      const {
+        key,
+        outcome
+      } = delivery.claim(location, name);
+      // the same parameter declared again: the earlier, more specific one won
+      if (outcome === 'duplicate') continue;
+      if (outcome === 'collision') {
+        throw new ResolverError(`Parameter "${name}" (in: ${location}) collides with another parameter on the ` + `delivery key "${key}" and cannot be delivered unambiguously`, {
+          ...scope,
+          target: name,
+          reason: 'ambiguous-delivery'
+        });
+      }
+      delivery.set(key, this.resolveValue(parameter.value, resolve));
+    }
+    return delivery.toRecord();
+  }
+}
+export default OpenAPIOperationParameterResolver;

package/src/resolver/OutputResolver.cjs

@@ -0,0 +1,71 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime-corejs3/helpers/interopRequireDefault").default;
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+var _apidomCore = require("@speclynx/apidom-core");
+var _apidomDatamodel = require("@speclynx/apidom-datamodel");
+var _arazzoRuntimeExpression = require("@swaggerexpert/arazzo-runtime-expression");
+var _ResolverError = _interopRequireDefault(require("../errors/ResolverError.cjs"));
+var _ArazzoValueResolver = _interopRequireDefault(require("./ArazzoValueResolver.cjs"));
+/**
+ * Resolves a step's or workflow's `outputs` to a plain map of name → value.
+ *
+ * The spec types `outputs` as `Map[string, {expression}]`, so a whole runtime
+ * expression is the *only* authored form — unlike a parameter's `value` or a
+ * `requestBody` payload (typed `Any`), where {@link ArazzoValueResolver} lets a
+ * literal through. An output that is not a valid runtime expression is an
+ * authoring error and throws a {@link ResolverError}.
+ *
+ * The result is the map an executor stores into the workflow execution state so
+ * later steps can read `$steps.{id}.outputs.{name}` / `$outputs.{name}`.
+ * @public
+ */
+class OutputResolver extends _ArazzoValueResolver.default {
+  /**
+   * Resolves each output value, returning a `name` → value map. Returns an empty
+   * object when there are no outputs.
+   *
+   * `scope` names the step or workflow the outputs belong to, for a thrown
+   * {@link ResolverError}. An output value that is not a valid runtime
+   * expression throws with `reason: 'invalid-expression'`.
+   */
+  resolve(outputs, resolve, scope) {
+    const result = {};
+    if (outputs === undefined) return result;
+    // present but not a map: the walk below would fail as a bare
+    // `TypeError: outputs.forEach is not a function`.
+    if (!(0, _apidomDatamodel.isObjectElement)(outputs)) {
+      throw new _ResolverError.default('`outputs` is present but is not a map', {
+        ...scope,
+        target: 'outputs',
+        reason: 'malformed-outputs'
+      });
+    }
+    outputs.forEach((value, key) => {
+      const name = (0, _apidomCore.toValue)(key);
+      const expression = (0, _apidomCore.toValue)(value);
+      if (typeof expression !== 'string' || !(0, _arazzoRuntimeExpression.test)(expression)) {
+        throw new _ResolverError.default(`Output "${name}" is not a valid runtime expression`, {
+          ...scope,
+          target: 'outputs',
+          reason: 'invalid-expression'
+        });
+      }
+      // defined rather than assigned: a name like `__proto__` hits the
+      // Object.prototype accessor on bracket assignment, so no own property is
+      // ever created and the output is silently lost — and an object value
+      // additionally rewrites the record's prototype
+      Object.defineProperty(result, name, {
+        value: resolve(expression),
+        enumerable: true,
+        writable: true,
+        configurable: true
+      });
+    });
+    return result;
+  }
+}
+var _default = exports.default = OutputResolver;

package/src/resolver/OutputResolver.mjs

@@ -0,0 +1,64 @@
+import { toValue } from '@speclynx/apidom-core';
+import { isObjectElement } from '@speclynx/apidom-datamodel';
+import { test as isRuntimeExpression } from '@swaggerexpert/arazzo-runtime-expression';
+import ResolverError from "../errors/ResolverError.mjs";
+import ArazzoValueResolver from "./ArazzoValueResolver.mjs";
+/**
+ * Resolves a step's or workflow's `outputs` to a plain map of name → value.
+ *
+ * The spec types `outputs` as `Map[string, {expression}]`, so a whole runtime
+ * expression is the *only* authored form — unlike a parameter's `value` or a
+ * `requestBody` payload (typed `Any`), where {@link ArazzoValueResolver} lets a
+ * literal through. An output that is not a valid runtime expression is an
+ * authoring error and throws a {@link ResolverError}.
+ *
+ * The result is the map an executor stores into the workflow execution state so
+ * later steps can read `$steps.{id}.outputs.{name}` / `$outputs.{name}`.
+ * @public
+ */
+class OutputResolver extends ArazzoValueResolver {
+  /**
+   * Resolves each output value, returning a `name` → value map. Returns an empty
+   * object when there are no outputs.
+   *
+   * `scope` names the step or workflow the outputs belong to, for a thrown
+   * {@link ResolverError}. An output value that is not a valid runtime
+   * expression throws with `reason: 'invalid-expression'`.
+   */
+  resolve(outputs, resolve, scope) {
+    const result = {};
+    if (outputs === undefined) return result;
+    // present but not a map: the walk below would fail as a bare
+    // `TypeError: outputs.forEach is not a function`.
+    if (!isObjectElement(outputs)) {
+      throw new ResolverError('`outputs` is present but is not a map', {
+        ...scope,
+        target: 'outputs',
+        reason: 'malformed-outputs'
+      });
+    }
+    outputs.forEach((value, key) => {
+      const name = toValue(key);
+      const expression = toValue(value);
+      if (typeof expression !== 'string' || !isRuntimeExpression(expression)) {
+        throw new ResolverError(`Output "${name}" is not a valid runtime expression`, {
+          ...scope,
+          target: 'outputs',
+          reason: 'invalid-expression'
+        });
+      }
+      // defined rather than assigned: a name like `__proto__` hits the
+      // Object.prototype accessor on bracket assignment, so no own property is
+      // ever created and the output is silently lost — and an object value
+      // additionally rewrites the record's prototype
+      Object.defineProperty(result, name, {
+        value: resolve(expression),
+        enumerable: true,
+        writable: true,
+        configurable: true
+      });
+    });
+    return result;
+  }
+}
+export default OutputResolver;