@usearazzo/runner 1.0.1-alpha.13 → 1.0.1-alpha.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usearazzo/runner",
-  "version": "1.0.1-alpha.13",
+  "version": "1.0.1-alpha.15",
   "description": "Runner for Arazzo Workflows.",
   "keywords": [
     "arazzo",
@@ -73,8 +73,8 @@
     "@swaggerexpert/json-pointer": "^3.0.2",
     "@swaggerexpert/jsonpath": "^4.0.5",
     "@swaggerexpert/media-types": "^1.0.1",
-    "@usearazzo/parser": "1.0.1-alpha.13",
-    "@usearazzo/resolver": "1.0.1-alpha.13",
+    "@usearazzo/parser": "1.0.1-alpha.15",
+    "@usearazzo/resolver": "1.0.1-alpha.15",
     "@xmldom/xmldom": "^0.9.12",
     "fontoxpath": "^3.34.0",
     "ramda": "^0.32.0",
@@ -94,5 +94,5 @@
   "devDependencies": {
     "swagger-client": "^3.38.4"
   },
-  "gitHead": "41c018418a867e1469de0b2393929f7ec129c447"
+  "gitHead": "0afacecfa7179fd95b07a8e4a5194a2d7d1c0687"
 }

package/src/document/ParameterIdentity.cjs

@@ -75,6 +75,14 @@ class ParameterIdentity {
     if (location === undefined || (0, _apidomDatamodel.isNullElement)(location)) return undefined;
     return (0, _apidomDatamodel.isStringElement)(location) ? (0, _apidomCore.toValue)(location) : null;
   }
+
+  /**
+   * The locations the Parameter Object defines: Arazzo 1.0.1's closed set plus
+   * 1.1.0's `querystring`. 1.0.0's field description also listed `body`, which
+   * its own summary of locations did not; 1.0.1 removed it as an erratum, so it
+   * is not a location in any version (a payload is the step's `requestBody`).
+   */
+  static LOCATIONS = ['path', 'query', 'header', 'cookie', 'querystring'];
   name;
   location;
   constructor(name, location) {
@@ -82,6 +90,14 @@ class ParameterIdentity {
     this.location = location;
   }
 
+  /**
+   * Whether the location is one the Parameter Object defines. An absent or
+   * malformed location is not.
+   */
+  get hasDefinedLocation() {
+    return ParameterIdentity.LOCATIONS.includes(this.location);
+  }
+
   /**
    * Whether this and the other identity name the same parameter. A malformed
    * location equals nothing, its own duplicate included.

package/src/document/ParameterIdentity.mjs

@@ -70,6 +70,14 @@ class ParameterIdentity {
     if (location === undefined || isNullElement(location)) return undefined;
     return isStringElement(location) ? toValue(location) : null;
   }
+
+  /**
+   * The locations the Parameter Object defines: Arazzo 1.0.1's closed set plus
+   * 1.1.0's `querystring`. 1.0.0's field description also listed `body`, which
+   * its own summary of locations did not; 1.0.1 removed it as an erratum, so it
+   * is not a location in any version (a payload is the step's `requestBody`).
+   */
+  static LOCATIONS = ['path', 'query', 'header', 'cookie', 'querystring'];
   name;
   location;
   constructor(name, location) {
@@ -77,6 +85,14 @@ class ParameterIdentity {
     this.location = location;
   }
 
+  /**
+   * Whether the location is one the Parameter Object defines. An absent or
+   * malformed location is not.
+   */
+  get hasDefinedLocation() {
+    return ParameterIdentity.LOCATIONS.includes(this.location);
+  }
+
   /**
    * Whether this and the other identity name the same parameter. A malformed
    * location equals nothing, its own duplicate included.

package/src/executor/StepExecutor.cjs

@@ -16,6 +16,7 @@ var _OutputResolver = _interopRequireDefault(require("../resolver/OutputResolver
 var _ActionResolver = _interopRequireDefault(require("../action/ActionResolver.cjs"));
 var _OpenAPIOperationLocatorNormalizer = _interopRequireDefault(require("./OpenAPIOperationLocatorNormalizer.cjs"));
 var _ExecutionError = _interopRequireDefault(require("../errors/ExecutionError.cjs"));
+var _ResolverError = _interopRequireDefault(require("../errors/ResolverError.cjs"));
 var _RuntimeExpressionError = _interopRequireDefault(require("../errors/RuntimeExpressionError.cjs"));
 var _abort = require("./abort.cjs");
 /**
@@ -136,6 +137,7 @@ class StepExecutor {
         reason: 'workflow-step'
       });
     }
+    this.assertSuccessCriteria(step);
 
     // locate which operation the step invokes — reduced to a (document, JSON
     // Pointer) locator that the operation executor extracts, normalizes,
@@ -231,9 +233,48 @@ class StepExecutor {
     });
   }
 
+  /**
+   * Throws {@link ResolverError} unless the step's `successCriteria` is absent
+   * or a list of Criterion Objects: `malformed-criteria` for one that is
+   * present but not a list, `malformed-criterion` for an entry that is not a
+   * Criterion Object. Skipping an unreadable entry would turn the author's
+   * assertion into a vacuous pass, so it is an authoring error, as an action's
+   * unreadable `criteria` is in {@link ActionResolver}.
+   *
+   * Called before the step's request is sent, so no live side effect precedes
+   * the error. Public because the workflow executor checks every step of a
+   * workflow with it before any of them runs, a step targeting a `workflowId`
+   * included. It passes `workflowId`, which the error then carries: step ids
+   * are only unique within a workflow.
+   */
+  assertSuccessCriteria(step, workflowId) {
+    const criteria = step.successCriteria;
+    if (criteria === undefined) return;
+    const scope = {
+      ...(workflowId === undefined ? {} : {
+        workflowId
+      }),
+      stepId: (0, _apidomCore.toValue)(step.stepId),
+      target: 'successCriteria'
+    };
+    if (!(0, _apidomDatamodel.isArrayElement)(criteria)) {
+      throw new _ResolverError.default("A step's `successCriteria` is present but is not a list", {
+        ...scope,
+        reason: 'malformed-criteria'
+      });
+    }
+    if (![...criteria].every(_apidomNsArazzo.isCriterionElement)) {
+      throw new _ResolverError.default("A step's `successCriteria` contains an entry that is not a Criterion Object", {
+        ...scope,
+        reason: 'malformed-criterion'
+      });
+    }
+  }
+
   /**
    * Evaluates the step's `successCriteria`; all criteria must pass. A step with
-   * no criteria succeeds on a received response.
+   * no criteria succeeds on a received response. An unreadable
+   * `successCriteria` throws, see {@link StepExecutor.assertSuccessCriteria}.
    *
    * Public for the same reason as {@link StepExecutor.selectActions}: a step
    * targeting a `workflowId` is run by the workflow executor and never reaches
@@ -241,15 +282,12 @@ class StepExecutor {
    * assertion about the step and must be evaluated somewhere.
    */
   evaluateCriteria(step, context) {
+    this.assertSuccessCriteria(step);
     const criteria = step.successCriteria;
-    // no (or non-array) successCriteria: the step succeeds on a received response.
-    if (!(0, _apidomDatamodel.isArrayElement)(criteria)) return true;
-    for (const criterion of criteria) {
-      if (!(0, _apidomNsArazzo.isCriterionElement)(criterion)) continue;
-      const met = this.#criterionEvaluator.evaluate(criterion, expression => this.#evaluate(context, expression));
-      if (!met) return false;
-    }
-    return true;
+    if (criteria === undefined) return true;
+
+    // assertSuccessCriteria above guarantees every entry is a Criterion Object
+    return [...criteria].every(criterion => this.#criterionEvaluator.evaluate(criterion, expression => this.#evaluate(context, expression)));
   }
 
   /**

package/src/executor/StepExecutor.mjs

@@ -9,6 +9,7 @@ import OutputResolver from "../resolver/OutputResolver.mjs";
 import ActionResolver from "../action/ActionResolver.mjs";
 import OpenAPIOperationLocatorNormalizer from "./OpenAPIOperationLocatorNormalizer.mjs";
 import ExecutionError from "../errors/ExecutionError.mjs";
+import ResolverError from "../errors/ResolverError.mjs";
 import RuntimeExpressionError from "../errors/RuntimeExpressionError.mjs";
 import { readAbortSignal, throwIfAborted } from "./abort.mjs";
 /**
@@ -129,6 +130,7 @@ class StepExecutor {
         reason: 'workflow-step'
       });
     }
+    this.assertSuccessCriteria(step);
 
     // locate which operation the step invokes — reduced to a (document, JSON
     // Pointer) locator that the operation executor extracts, normalizes,
@@ -224,9 +226,48 @@ class StepExecutor {
     });
   }
 
+  /**
+   * Throws {@link ResolverError} unless the step's `successCriteria` is absent
+   * or a list of Criterion Objects: `malformed-criteria` for one that is
+   * present but not a list, `malformed-criterion` for an entry that is not a
+   * Criterion Object. Skipping an unreadable entry would turn the author's
+   * assertion into a vacuous pass, so it is an authoring error, as an action's
+   * unreadable `criteria` is in {@link ActionResolver}.
+   *
+   * Called before the step's request is sent, so no live side effect precedes
+   * the error. Public because the workflow executor checks every step of a
+   * workflow with it before any of them runs, a step targeting a `workflowId`
+   * included. It passes `workflowId`, which the error then carries: step ids
+   * are only unique within a workflow.
+   */
+  assertSuccessCriteria(step, workflowId) {
+    const criteria = step.successCriteria;
+    if (criteria === undefined) return;
+    const scope = {
+      ...(workflowId === undefined ? {} : {
+        workflowId
+      }),
+      stepId: toValue(step.stepId),
+      target: 'successCriteria'
+    };
+    if (!isArrayElement(criteria)) {
+      throw new ResolverError("A step's `successCriteria` is present but is not a list", {
+        ...scope,
+        reason: 'malformed-criteria'
+      });
+    }
+    if (![...criteria].every(isCriterionElement)) {
+      throw new ResolverError("A step's `successCriteria` contains an entry that is not a Criterion Object", {
+        ...scope,
+        reason: 'malformed-criterion'
+      });
+    }
+  }
+
   /**
    * Evaluates the step's `successCriteria`; all criteria must pass. A step with
-   * no criteria succeeds on a received response.
+   * no criteria succeeds on a received response. An unreadable
+   * `successCriteria` throws, see {@link StepExecutor.assertSuccessCriteria}.
    *
    * Public for the same reason as {@link StepExecutor.selectActions}: a step
    * targeting a `workflowId` is run by the workflow executor and never reaches
@@ -234,15 +275,12 @@ class StepExecutor {
    * assertion about the step and must be evaluated somewhere.
    */
   evaluateCriteria(step, context) {
+    this.assertSuccessCriteria(step);
     const criteria = step.successCriteria;
-    // no (or non-array) successCriteria: the step succeeds on a received response.
-    if (!isArrayElement(criteria)) return true;
-    for (const criterion of criteria) {
-      if (!isCriterionElement(criterion)) continue;
-      const met = this.#criterionEvaluator.evaluate(criterion, expression => this.#evaluate(context, expression));
-      if (!met) return false;
-    }
-    return true;
+    if (criteria === undefined) return true;
+
+    // assertSuccessCriteria above guarantees every entry is a Criterion Object
+    return [...criteria].every(criterion => this.#criterionEvaluator.evaluate(criterion, expression => this.#evaluate(context, expression)));
   }
 
   /**

package/src/executor/WorkflowExecutor.cjs

@@ -297,6 +297,10 @@ class WorkflowExecutor {
     // at `#result` where it used to be resolved, means the throw lands before
     // the first request rather than after the last.
     this.#validateWorkflowOutputsShape(workflow, workflowId);
+    // and to every step's `successCriteria`, a step calling a workflow
+    // included: an unreadable assertion found at step three must not cost the
+    // run the requests of steps one and two.
+    for (const step of steps) this.#stepExecutor.assertSuccessCriteria(step, workflowId);
     const dependencies = await this.#runDependencies(workflow, invocation, scope);
     if (dependencies.some(dependency => this.#settledFailed(dependency))) {
       // a declared prerequisite did not complete, so this workflow cannot be

package/src/executor/WorkflowExecutor.mjs

@@ -283,6 +283,10 @@ class WorkflowExecutor {
     // at `#result` where it used to be resolved, means the throw lands before
     // the first request rather than after the last.
     this.#validateWorkflowOutputsShape(workflow, workflowId);
+    // and to every step's `successCriteria`, a step calling a workflow
+    // included: an unreadable assertion found at step three must not cost the
+    // run the requests of steps one and two.
+    for (const step of steps) this.#stepExecutor.assertSuccessCriteria(step, workflowId);
     const dependencies = await this.#runDependencies(workflow, invocation, scope);
     if (dependencies.some(dependency => this.#settledFailed(dependency))) {
       // a declared prerequisite did not complete, so this workflow cannot be

package/src/resolver/OpenAPIOperationParameterResolver.cjs

@@ -35,7 +35,11 @@ var _StepParameterResolver = _interopRequireDefault(require("./StepParameterReso
  * instead would let it capture *every* declared location of that name — see
  * `ParameterDelivery` for the lookup order that makes it so. A
  * non-string location throws for the same reason it deduplicates with nothing
- * in the normalizer: it names no location. And two *different* parameters the
+ * in the normalizer: it names no location. So does a location outside
+ * `path`, `query`, `header`, `cookie` and `querystring`: Arazzo 1.0.1 removed
+ * `in: body`, and forwarding one would let it still deliver a request body
+ * against an OpenAPI 2.0 operation, bypassing the step's `requestBody`, while
+ * an unknown location reaches nothing at all. And two *different* parameters the
  * map reports as colliding cannot both be delivered, so a collision throws
  * rather than silently dropping one — whether they collide on one key (the
  * scheme is not injective: a `querystring` parameter named `header.token` and
@@ -96,6 +100,13 @@ class OpenAPIOperationParameterResolver extends _StepParameterResolver.default {
           reason: 'malformed-location'
         });
       }
+      if (!identity.hasDefinedLocation) {
+        throw new _ResolverError.default(`Parameter "${name}" has location "${location}", which is not one of ` + `${_ParameterIdentity.default.LOCATIONS.join(', ')}`, {
+          ...scope,
+          target: name,
+          reason: 'invalid-location'
+        });
+      }
       const {
         key,
         outcome

package/src/resolver/OpenAPIOperationParameterResolver.mjs

@@ -28,7 +28,11 @@ import StepParameterResolver from "./StepParameterResolver.mjs";
  * instead would let it capture *every* declared location of that name — see
  * `ParameterDelivery` for the lookup order that makes it so. A
  * non-string location throws for the same reason it deduplicates with nothing
- * in the normalizer: it names no location. And two *different* parameters the
+ * in the normalizer: it names no location. So does a location outside
+ * `path`, `query`, `header`, `cookie` and `querystring`: Arazzo 1.0.1 removed
+ * `in: body`, and forwarding one would let it still deliver a request body
+ * against an OpenAPI 2.0 operation, bypassing the step's `requestBody`, while
+ * an unknown location reaches nothing at all. And two *different* parameters the
  * map reports as colliding cannot both be delivered, so a collision throws
  * rather than silently dropping one — whether they collide on one key (the
  * scheme is not injective: a `querystring` parameter named `header.token` and
@@ -89,6 +93,13 @@ class OpenAPIOperationParameterResolver extends StepParameterResolver {
           reason: 'malformed-location'
         });
       }
+      if (!identity.hasDefinedLocation) {
+        throw new ResolverError(`Parameter "${name}" has location "${location}", which is not one of ` + `${ParameterIdentity.LOCATIONS.join(', ')}`, {
+          ...scope,
+          target: name,
+          reason: 'invalid-location'
+        });
+      }
       const {
         key,
         outcome

package/types/runner.d.ts

@@ -1196,7 +1196,11 @@ export declare interface OpenAPIOperationNormalizerOptions {
  * instead would let it capture *every* declared location of that name — see
  * `ParameterDelivery` for the lookup order that makes it so. A
  * non-string location throws for the same reason it deduplicates with nothing
- * in the normalizer: it names no location. And two *different* parameters the
+ * in the normalizer: it names no location. So does a location outside
+ * `path`, `query`, `header`, `cookie` and `querystring`: Arazzo 1.0.1 removed
+ * `in: body`, and forwarding one would let it still deliver a request body
+ * against an OpenAPI 2.0 operation, bypassing the step's `requestBody`, while
+ * an unknown location reaches nothing at all. And two *different* parameters the
  * map reports as colliding cannot both be delivered, so a collision throws
  * rather than silently dropping one — whether they collide on one key (the
  * scheme is not injective: a `querystring` parameter named `header.token` and
@@ -1885,9 +1889,25 @@ export declare class StepExecutor {
      * — rather than as the withdrawal it is.
      */
     execute(step: StepElement, state: ContextSource, executeOptions?: Record<string, unknown>): Promise<StepExecutionResult>;
+    /**
+     * Throws {@link ResolverError} unless the step's `successCriteria` is absent
+     * or a list of Criterion Objects: `malformed-criteria` for one that is
+     * present but not a list, `malformed-criterion` for an entry that is not a
+     * Criterion Object. Skipping an unreadable entry would turn the author's
+     * assertion into a vacuous pass, so it is an authoring error, as an action's
+     * unreadable `criteria` is in {@link ActionResolver}.
+     *
+     * Called before the step's request is sent, so no live side effect precedes
+     * the error. Public because the workflow executor checks every step of a
+     * workflow with it before any of them runs, a step targeting a `workflowId`
+     * included. It passes `workflowId`, which the error then carries: step ids
+     * are only unique within a workflow.
+     */
+    assertSuccessCriteria(step: StepElement, workflowId?: string): void;
     /**
      * Evaluates the step's `successCriteria`; all criteria must pass. A step with
-     * no criteria succeeds on a received response.
+     * no criteria succeeds on a received response. An unreadable
+     * `successCriteria` throws, see {@link StepExecutor.assertSuccessCriteria}.
      *
      * Public for the same reason as {@link StepExecutor.selectActions}: a step
      * targeting a `workflowId` is run by the workflow executor and never reaches