@usearazzo/runner 1.0.1-alpha.13 → 1.0.1-alpha.15

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.0.1-alpha.15](https://github.com/usearazzo/arazzo-toolkit/compare/v1.0.1-alpha.14...v1.0.1-alpha.15) (2026-10-28)
+
+### Bug Fixes
+
+- **runner:** reject an unreadable successCriteria before any request ([#284](https://github.com/usearazzo/arazzo-toolkit/issues/284)) ([11662f5](https://github.com/usearazzo/arazzo-toolkit/commit/11662f5e603909e356e95f0daa85a7e245667920)), closes [#127](https://github.com/usearazzo/arazzo-toolkit/issues/127)
+
+## [1.0.1-alpha.14](https://github.com/usearazzo/arazzo-toolkit/compare/v1.0.1-alpha.13...v1.0.1-alpha.14) (2026-10-27)
+
+### Bug Fixes
+
+- **runner:** reject a parameter location outside the defined set ([#283](https://github.com/usearazzo/arazzo-toolkit/issues/283)) ([250f6bf](https://github.com/usearazzo/arazzo-toolkit/commit/250f6bf6a23bbb8b2f305480dc3d728d419e3017)), closes [#126](https://github.com/usearazzo/arazzo-toolkit/issues/126)
+
 ## [1.0.1-alpha.13](https://github.com/usearazzo/arazzo-toolkit/compare/v1.0.1-alpha.12...v1.0.1-alpha.13) (2026-10-27)
 
 ### Bug Fixes

package/dist/arazzo-runner.browser.js

@@ -10805,6 +10805,14 @@ class ParameterIdentity {
     if (location === undefined || (0,_speclynx_apidom_datamodel__WEBPACK_IMPORTED_MODULE_1__.isNullElement)(location)) return undefined;
     return (0,_speclynx_apidom_datamodel__WEBPACK_IMPORTED_MODULE_1__.isStringElement)(location) ? (0,_speclynx_apidom_core__WEBPACK_IMPORTED_MODULE_0__["default"])(location) : null;
   }
+
+  /**
+   * The locations the Parameter Object defines: Arazzo 1.0.1's closed set plus
+   * 1.1.0's `querystring`. 1.0.0's field description also listed `body`, which
+   * its own summary of locations did not; 1.0.1 removed it as an erratum, so it
+   * is not a location in any version (a payload is the step's `requestBody`).
+   */
+  static LOCATIONS = ['path', 'query', 'header', 'cookie', 'querystring'];
   name;
   location;
   constructor(name, location) {
@@ -10812,6 +10820,14 @@ class ParameterIdentity {
     this.location = location;
   }
 
+  /**
+   * Whether the location is one the Parameter Object defines. An absent or
+   * malformed location is not.
+   */
+  get hasDefinedLocation() {
+    return ParameterIdentity.LOCATIONS.includes(this.location);
+  }
+
   /**
    * Whether this and the other identity name the same parameter. A malformed
    * location equals nothing, its own duplicate included.
@@ -12081,8 +12097,10 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var _action_ActionResolver_ts__WEBPACK_IMPORTED_MODULE_8__ = __webpack_require__(51097);
 /* harmony import */ var _OpenAPIOperationLocatorNormalizer_ts__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__(7308);
 /* harmony import */ var _errors_ExecutionError_ts__WEBPACK_IMPORTED_MODULE_10__ = __webpack_require__(17658);
-/* harmony import */ var _errors_RuntimeExpressionError_ts__WEBPACK_IMPORTED_MODULE_11__ = __webpack_require__(48770);
-/* harmony import */ var _abort_ts__WEBPACK_IMPORTED_MODULE_12__ = __webpack_require__(99628);
+/* harmony import */ var _errors_ResolverError_ts__WEBPACK_IMPORTED_MODULE_11__ = __webpack_require__(8696);
+/* harmony import */ var _errors_RuntimeExpressionError_ts__WEBPACK_IMPORTED_MODULE_12__ = __webpack_require__(48770);
+/* harmony import */ var _abort_ts__WEBPACK_IMPORTED_MODULE_13__ = __webpack_require__(99628);
+
 
 
 
@@ -12215,6 +12233,7 @@ class StepExecutor {
         reason: 'workflow-step'
       });
     }
+    this.assertSuccessCriteria(step);
 
     // locate which operation the step invokes — reduced to a (document, JSON
     // Pointer) locator that the operation executor extracts, normalizes,
@@ -12236,8 +12255,8 @@ class StepExecutor {
     // still reach this line — and this is the last moment before the step has a
     // live side effect. The signal stays in the bag, so a request already in
     // flight is aborted by the transport as before.
-    const signal = (0,_abort_ts__WEBPACK_IMPORTED_MODULE_12__.readAbortSignal)(executeOptions);
-    (0,_abort_ts__WEBPACK_IMPORTED_MODULE_12__.throwIfAborted)(signal, {
+    const signal = (0,_abort_ts__WEBPACK_IMPORTED_MODULE_13__.readAbortSignal)(executeOptions);
+    (0,_abort_ts__WEBPACK_IMPORTED_MODULE_13__.throwIfAborted)(signal, {
       stepId
     });
 
@@ -12258,7 +12277,7 @@ class StepExecutor {
       // cancelled, it did not: reporting it as the abort keeps one error shape
       // whether the run was withdrawn between two steps or mid-flight, and keeps
       // the whole feature from reading differently per transport.
-      ;(0,_abort_ts__WEBPACK_IMPORTED_MODULE_12__.throwIfAborted)(signal, {
+      ;(0,_abort_ts__WEBPACK_IMPORTED_MODULE_13__.throwIfAborted)(signal, {
         stepId
       });
       throw error;
@@ -12310,9 +12329,48 @@ class StepExecutor {
     });
   }
 
+  /**
+   * Throws {@link ResolverError} unless the step's `successCriteria` is absent
+   * or a list of Criterion Objects: `malformed-criteria` for one that is
+   * present but not a list, `malformed-criterion` for an entry that is not a
+   * Criterion Object. Skipping an unreadable entry would turn the author's
+   * assertion into a vacuous pass, so it is an authoring error, as an action's
+   * unreadable `criteria` is in {@link ActionResolver}.
+   *
+   * Called before the step's request is sent, so no live side effect precedes
+   * the error. Public because the workflow executor checks every step of a
+   * workflow with it before any of them runs, a step targeting a `workflowId`
+   * included. It passes `workflowId`, which the error then carries: step ids
+   * are only unique within a workflow.
+   */
+  assertSuccessCriteria(step, workflowId) {
+    const criteria = step.successCriteria;
+    if (criteria === undefined) return;
+    const scope = {
+      ...(workflowId === undefined ? {} : {
+        workflowId
+      }),
+      stepId: (0,_speclynx_apidom_core__WEBPACK_IMPORTED_MODULE_0__["default"])(step.stepId),
+      target: 'successCriteria'
+    };
+    if (!(0,_speclynx_apidom_datamodel__WEBPACK_IMPORTED_MODULE_1__.isArrayElement)(criteria)) {
+      throw new _errors_ResolverError_ts__WEBPACK_IMPORTED_MODULE_11__["default"]("A step's `successCriteria` is present but is not a list", {
+        ...scope,
+        reason: 'malformed-criteria'
+      });
+    }
+    if (![...criteria].every(_speclynx_apidom_ns_arazzo_1__WEBPACK_IMPORTED_MODULE_2__.isCriterionElement)) {
+      throw new _errors_ResolverError_ts__WEBPACK_IMPORTED_MODULE_11__["default"]("A step's `successCriteria` contains an entry that is not a Criterion Object", {
+        ...scope,
+        reason: 'malformed-criterion'
+      });
+    }
+  }
+
   /**
    * Evaluates the step's `successCriteria`; all criteria must pass. A step with
-   * no criteria succeeds on a received response.
+   * no criteria succeeds on a received response. An unreadable
+   * `successCriteria` throws, see {@link StepExecutor.assertSuccessCriteria}.
    *
    * Public for the same reason as {@link StepExecutor.selectActions}: a step
    * targeting a `workflowId` is run by the workflow executor and never reaches
@@ -12320,15 +12378,12 @@ class StepExecutor {
    * assertion about the step and must be evaluated somewhere.
    */
   evaluateCriteria(step, context) {
+    this.assertSuccessCriteria(step);
     const criteria = step.successCriteria;
-    // no (or non-array) successCriteria: the step succeeds on a received response.
-    if (!(0,_speclynx_apidom_datamodel__WEBPACK_IMPORTED_MODULE_1__.isArrayElement)(criteria)) return true;
-    for (const criterion of criteria) {
-      if (!(0,_speclynx_apidom_ns_arazzo_1__WEBPACK_IMPORTED_MODULE_2__.isCriterionElement)(criterion)) continue;
-      const met = this.#criterionEvaluator.evaluate(criterion, expression => this.#evaluate(context, expression));
-      if (!met) return false;
-    }
-    return true;
+    if (criteria === undefined) return true;
+
+    // assertSuccessCriteria above guarantees every entry is a Criterion Object
+    return [...criteria].every(criterion => this.#criterionEvaluator.evaluate(criterion, expression => this.#evaluate(context, expression)));
   }
 
   /**
@@ -12361,7 +12416,7 @@ class StepExecutor {
         // components. A condition on an HTTP exchange cannot apply to a step
         // that calls a workflow, so the action does not match; the run does not
         // abort over a default written for the operation steps.
-        if (error instanceof _errors_RuntimeExpressionError_ts__WEBPACK_IMPORTED_MODULE_11__["default"] && error.reason === 'unavailable-expression') {
+        if (error instanceof _errors_RuntimeExpressionError_ts__WEBPACK_IMPORTED_MODULE_12__["default"] && error.reason === 'unavailable-expression') {
           return false;
         }
         throw error;
@@ -13263,6 +13318,10 @@ class WorkflowExecutor {
     // at `#result` where it used to be resolved, means the throw lands before
     // the first request rather than after the last.
     this.#validateWorkflowOutputsShape(workflow, workflowId);
+    // and to every step's `successCriteria`, a step calling a workflow
+    // included: an unreadable assertion found at step three must not cost the
+    // run the requests of steps one and two.
+    for (const step of steps) this.#stepExecutor.assertSuccessCriteria(step, workflowId);
     const dependencies = await this.#runDependencies(workflow, invocation, scope);
     if (dependencies.some(dependency => this.#settledFailed(dependency))) {
       // a declared prerequisite did not complete, so this workflow cannot be
@@ -16097,7 +16156,11 @@ __webpack_require__.r(__webpack_exports__);
  * instead would let it capture *every* declared location of that name — see
  * `ParameterDelivery` for the lookup order that makes it so. A
  * non-string location throws for the same reason it deduplicates with nothing
- * in the normalizer: it names no location. And two *different* parameters the
+ * in the normalizer: it names no location. So does a location outside
+ * `path`, `query`, `header`, `cookie` and `querystring`: Arazzo 1.0.1 removed
+ * `in: body`, and forwarding one would let it still deliver a request body
+ * against an OpenAPI 2.0 operation, bypassing the step's `requestBody`, while
+ * an unknown location reaches nothing at all. And two *different* parameters the
  * map reports as colliding cannot both be delivered, so a collision throws
  * rather than silently dropping one — whether they collide on one key (the
  * scheme is not injective: a `querystring` parameter named `header.token` and
@@ -16158,6 +16221,13 @@ class OpenAPIOperationParameterResolver extends _StepParameterResolver_ts__WEBPA
           reason: 'malformed-location'
         });
       }
+      if (!identity.hasDefinedLocation) {
+        throw new _errors_ResolverError_ts__WEBPACK_IMPORTED_MODULE_4__["default"](`Parameter "${name}" has location "${location}", which is not one of ` + `${_document_ParameterIdentity_ts__WEBPACK_IMPORTED_MODULE_3__["default"].LOCATIONS.join(', ')}`, {
+          ...scope,
+          target: name,
+          reason: 'invalid-location'
+        });
+      }
       const {
         key,
         outcome