@voyantjs/workflow-runs 0.107.8 → 0.107.9

package/README.md

@@ -77,9 +77,27 @@ workflowRunnerRegistry.register({
 
 mountWorkflowRunsAdminRoutes(hono, {
   runners: workflowRunnerRegistry,
+  adminSurface: process.env.VOYANT_WORKFLOW_ADMIN_SURFACE as
+    | "tenant"
+    | "cloud"
+    | "disabled"
+    | undefined,
 })
 ```
 
+`adminSurface` controls tenant-admin workflow management actions:
+
+- `tenant` keeps local/self-host trigger, rerun, and resume routes available.
+- `cloud` keeps read routes available but rejects tenant-admin trigger, rerun,
+  and resume routes because the Voyant Cloud dashboard is the workflow control
+  plane for managed deployments.
+- `disabled` keeps read routes available and disables tenant-admin management
+  actions completely.
+
+When omitted, the package reads `VOYANT_WORKFLOW_ADMIN_SURFACE`. If that is
+unset but managed Cloud workflow env is present, the default is `cloud`;
+otherwise the default is `tenant` for local/self-host compatibility.
+
 Triggerable workflows must opt in by implementing `trigger(...)` on their registered runner. This keeps rerun/resume-only workflows closed to arbitrary admin dispatch while still allowing operators, cron jobs, queues, and API keys with `workflows:trigger` permission to call:
 
 ```http

package/dist/index.d.ts

@@ -17,7 +17,7 @@
  * separate worker process.
  */
 export { type BeginWorkflowRunInput, beginWorkflowRun, type WorkflowRunRecorder, } from "./recorder.js";
-export { mountWorkflowRunsAdminRoutes } from "./routes.js";
+export { mountWorkflowRunsAdminRoutes, resolveWorkflowAdminSurface, type WorkflowAdminSurface, } from "./routes.js";
 export { type WorkflowIdempotency, type WorkflowRerunContext, type WorkflowResumeContext, type WorkflowRunner, WorkflowRunnerRegistry, type WorkflowTriggerContext, } from "./runner.js";
 export { type NewWorkflowRun, type NewWorkflowRunStep, type WorkflowRun, type WorkflowRunErrorPayload, type WorkflowRunStep, workflowRunStatusEnum, workflowRunStepStatusEnum, workflowRunSteps, workflowRuns, } from "./schema.js";
 export { type ListWorkflowRunsQuery, type ListWorkflowRunsResult, workflowRunsService, } from "./service.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,KAAK,qBAAqB,EAC1B,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,mBAAmB,GACpB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,gBAAgB,GACjB,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,KAAK,qBAAqB,EAC1B,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,mBAAmB,GACpB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,gBAAgB,GACjB,MAAM,gBAAgB,CAAA"}

package/dist/index.js

@@ -17,7 +17,7 @@
  * separate worker process.
  */
 export { beginWorkflowRun, } from "./recorder.js";
-export { mountWorkflowRunsAdminRoutes } from "./routes.js";
+export { mountWorkflowRunsAdminRoutes, resolveWorkflowAdminSurface, } from "./routes.js";
 export { WorkflowRunnerRegistry, } from "./runner.js";
 export { workflowRunStatusEnum, workflowRunStepStatusEnum, workflowRunSteps, workflowRuns, } from "./schema.js";
 export { workflowRunsService, } from "./service.js";

package/dist/routes.d.ts

@@ -16,6 +16,8 @@
  */
 import type { Hono } from "hono";
 import type { WorkflowRunnerRegistry } from "./runner.js";
+export type WorkflowAdminSurface = "tenant" | "cloud" | "disabled";
+export declare function resolveWorkflowAdminSurface(value: string | undefined): WorkflowAdminSurface;
 export interface MountWorkflowRunsAdminRoutesOptions {
     /**
      * Registry of executable runners keyed by workflow name. Required
@@ -29,6 +31,13 @@ export interface MountWorkflowRunsAdminRoutesOptions {
      * are recorded without an actor.
      */
     resolveUserId?: (c: unknown) => string | null;
+    /**
+     * Controls whether tenant-admin workflow management actions are exposed.
+     * `tenant` preserves local/self-host behavior. `cloud` and `disabled`
+     * reject tenant-admin trigger/rerun/resume routes server-side while leaving
+     * read paths mounted for observability consumers that still need them.
+     */
+    adminSurface?: WorkflowAdminSurface;
 }
 export declare function mountWorkflowRunsAdminRoutes(hono: Hono, opts?: MountWorkflowRunsAdminRoutesOptions): void;
 //# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAGhC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AA2CzD,MAAM,WAAW,mCAAmC;IAClD;;;;OAIG;IACH,OAAO,CAAC,EAAE,sBAAsB,CAAA;IAChC;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAA;CAC9C;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,IAAI,EACV,IAAI,GAAE,mCAAwC,GAC7C,IAAI,CAsRN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAGhC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AA0BzD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAA;AAElE,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB,CAQ3F;AAmBD,MAAM,WAAW,mCAAmC;IAClD;;;;OAIG;IACH,OAAO,CAAC,EAAE,sBAAsB,CAAA;IAChC;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAA;IAC7C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAA;CACpC;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,IAAI,EACV,IAAI,GAAE,mCAAwC,GAC7C,IAAI,CAiSN"}

package/dist/routes.js

@@ -37,6 +37,14 @@ const triggerWorkflowBodySchema = z
     tags: z.array(z.string().trim().min(1).max(128)).max(50).optional(),
 })
     .strict();
+export function resolveWorkflowAdminSurface(value) {
+    if (value === "tenant" || value === "cloud" || value === "disabled")
+        return value;
+    if (value !== undefined && value.trim().length > 0) {
+        throw new Error(`Invalid workflow admin surface "${value}". Expected tenant, cloud, or disabled.`);
+    }
+    return "tenant";
+}
 function hasWorkflowTriggerScope(scopes) {
     if (!Array.isArray(scopes) || !scopes.every((scope) => typeof scope === "string")) {
         return false;
@@ -51,6 +59,7 @@ function hasWorkflowTriggerScope(scopes) {
     });
 }
 export function mountWorkflowRunsAdminRoutes(hono, opts = {}) {
+    const adminSurface = opts.adminSurface ?? defaultWorkflowAdminSurface();
     hono.get("/v1/admin/workflow-runs", async (c) => {
         const params = Object.fromEntries(new URL(c.req.url).searchParams);
         const parsed = listQuerySchema.safeParse(params);
@@ -95,6 +104,9 @@ export function mountWorkflowRunsAdminRoutes(hono, opts = {}) {
         }
     });
     hono.post("/v1/admin/workflows/:name/runs", async (c) => {
+        const blocked = rejectWorkflowAdminAction(adminSurface, c);
+        if (blocked)
+            return blocked;
         if (!opts.runners) {
             return c.json({ error: "trigger_not_configured", detail: "no WorkflowRunnerRegistry mounted" }, 501);
         }
@@ -140,6 +152,9 @@ export function mountWorkflowRunsAdminRoutes(hono, opts = {}) {
         }
     });
     hono.post("/v1/admin/workflow-runs/:id/rerun", async (c) => {
+        const blocked = rejectWorkflowAdminAction(adminSurface, c);
+        if (blocked)
+            return blocked;
         // biome-ignore lint/suspicious/noExplicitAny: Hono's c.var.db is loosely typed -- owner: workflow-runs; existing suppression is intentional pending typed cleanup.
         const db = c.var.db;
         if (!db)
@@ -200,6 +215,9 @@ export function mountWorkflowRunsAdminRoutes(hono, opts = {}) {
         }
     });
     hono.post("/v1/admin/workflow-runs/:id/resume", async (c) => {
+        const blocked = rejectWorkflowAdminAction(adminSurface, c);
+        if (blocked)
+            return blocked;
         // biome-ignore lint/suspicious/noExplicitAny: Hono's c.var.db is loosely typed -- owner: workflow-runs; existing suppression is intentional pending typed cleanup.
         const db = c.var.db;
         if (!db)
@@ -271,3 +289,23 @@ export function mountWorkflowRunsAdminRoutes(hono, opts = {}) {
         }
     });
 }
+function rejectWorkflowAdminAction(surface, c) {
+    if (surface === "tenant")
+        return undefined;
+    return c.json({
+        error: "workflow_admin_surface_restricted",
+        detail: surface === "cloud"
+            ? "Workflow management actions are owned by Voyant Cloud for this deployment."
+            : "Workflow management actions are disabled for this deployment.",
+        surface,
+    }, 403);
+}
+function defaultWorkflowAdminSurface() {
+    const env = globalThis.process?.env;
+    if (env?.VOYANT_WORKFLOW_ADMIN_SURFACE !== undefined) {
+        return resolveWorkflowAdminSurface(env.VOYANT_WORKFLOW_ADMIN_SURFACE);
+    }
+    if (env?.VOYANT_CLOUD_WORKFLOWS_URL || env?.VOYANT_CLOUD_APP_SLUG)
+        return "cloud";
+    return "tenant";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyantjs/workflow-runs",
-  "version": "0.107.8",
+  "version": "0.107.9",
   "description": "Workflow run recording, admin routes, and rerun/resume dispatch primitives for Voyant operator apps.",
   "license": "Apache-2.0",
   "type": "module",
@@ -49,13 +49,13 @@
     "@voyantjs/core": "^0.109.0",
     "@voyantjs/db": "^0.108.0",
     "@voyantjs/hono": "^0.109.1",
-    "@voyantjs/workflows": "^0.107.8"
+    "@voyantjs/workflows": "^0.107.9"
   },
   "devDependencies": {
     "typescript": "^6.0.2",
     "vitest": "^4.1.2",
-    "@voyantjs/voyant-typescript-config": "^0.1.0",
-    "@voyantjs/workflows-orchestrator": "^0.107.8"
+    "@voyantjs/workflows-orchestrator": "^0.107.9",
+    "@voyantjs/voyant-typescript-config": "^0.1.0"
   },
   "files": [
     "dist"