@xemahq/dsl 0.1.1

package/src/workflow/lib/compiler/variable-requirements.ts

@@ -0,0 +1,208 @@
+import {
+  WorkflowErrorCode,
+  type WalletContents,
+  type WorkflowVariableRequirement,
+} from '@xemahq/kernel-contracts/workflow';
+import { WorkflowDslError } from '../errors';
+import {
+  compileExpression,
+  ExpressionNodeKind,
+  extractInterpolations,
+  type ExpressionNode,
+} from '../expression';
+import { ExpressionRoot } from '../expression/ast';
+import { stripInterpolation } from '../expression/interpolation';
+import type { WorkflowDocument } from '../types';
+
+/**
+ * Compile-time handling of `requires.wallets` and the `vars.*` /
+ * `secrets.*` expression namespaces.
+ *
+ * The compiler trusts the engine to pre-fetch the contents of every
+ * wallet listed in `workflow.requires.wallets` (plus any additional
+ * wallets the dispatch caller asked for) and pass them as the
+ * `resolvedWallets` map. Two responsibilities here, both fail-fast:
+ *
+ *   1. `WORKFLOW_WALLET_NOT_FOUND` — every wallet name declared under
+ *      `requires.wallets` must have an entry in `resolvedWallets`.
+ *      Missing entry = the engine couldn't find the wallet for the
+ *      workflow's project/org scope.
+ *
+ *   2. `DSL_EXPRESSION_INVALID` — every `${{ vars.X }}` / `${{ secrets.X }}`
+ *      member access must resolve to a key in the union of the resolved
+ *      wallets' contents (modulo the YAML-static `vars:` block which can
+ *      also satisfy a `vars.X` lookup). Catches typos / stale references
+ *      at compile time instead of a runtime evaluator failure.
+ *
+ * The function returns the canonical flat list emitted into
+ * `CompiledRun.requiredVariables` — the union of every wallet's
+ * `(key, isSecret)` entries with duplicates collapsed (last writer wins
+ * for `isSecret` if two wallets disagree; the engine surfaces the
+ * conflict at fetch time with a different code).
+ */
+export function resolveWalletRequirements(
+  doc: WorkflowDocument,
+  resolvedWallets: Readonly<Record<string, WalletContents>> | undefined,
+): readonly WorkflowVariableRequirement[] {
+  const declaredWallets = doc.requires?.wallets ?? [];
+
+  if (resolvedWallets === undefined) {
+    // Engine opted out (preview-raw / tests). Skip both checks and
+    // emit an empty requirements list — `${{ vars.X }}` / `${{ secrets.X }}`
+    // references that don't satisfy the YAML-static fallback will still
+    // surface at runtime, which is the documented contract for opt-out.
+    return Object.freeze([]);
+  }
+
+  const missingWallets: string[] = [];
+  for (const name of declaredWallets) {
+    if (!Object.hasOwn(resolvedWallets, name)) {
+      missingWallets.push(name);
+    }
+  }
+  if (missingWallets.length > 0) {
+    throw new WorkflowDslError(
+      WorkflowErrorCode.WORKFLOW_WALLET_NOT_FOUND,
+      `Wallet(s) declared in requires.wallets are not available for this project/org scope: ${missingWallets.join(', ')}`,
+      { missing: missingWallets },
+    );
+  }
+
+  const merged = new Map<string, WorkflowVariableRequirement>();
+  for (const name of declaredWallets) {
+    const wallet = resolvedWallets[name];
+    if (!wallet) {
+      // `declaredWallets` is derived from the same `resolvedWallets`
+      // map upstream, so a missing entry here would be an internal
+      // invariant violation — surface it instead of silently producing
+      // an empty merge.
+      throw new Error(
+        `Internal: declaredWallets references unresolved wallet '${name}'.`,
+      );
+    }
+    for (const entry of wallet.entries) {
+      merged.set(entry.key, {
+        name: entry.key,
+        secret: entry.isSecret,
+        optional: false,
+      });
+    }
+  }
+  return Object.freeze([...merged.values()]);
+}
+
+/**
+ * Walk every `${{ ... }}` expression body in the workflow and, for each
+ * `vars.<NAME>` / `secrets.<NAME>` member access, verify the referenced
+ * name is satisfiable from the resolved wallets (or, for `vars.*` only,
+ * from the YAML-static `vars:` block).
+ */
+export function validateVariableReferences(
+  doc: WorkflowDocument,
+  requiredVariables: readonly WorkflowVariableRequirement[],
+  resolvedWallets: Readonly<Record<string, WalletContents>> | undefined,
+): void {
+  if (resolvedWallets === undefined) {
+    return;
+  }
+  const staticVarNames = new Set(Object.keys(doc.vars ?? {}));
+  const allowedVars = new Set<string>(staticVarNames);
+  const allowedSecrets = new Set<string>();
+  for (const r of requiredVariables) {
+    if (r.secret) {
+      allowedSecrets.add(r.name);
+    } else {
+      allowedVars.add(r.name);
+    }
+  }
+
+  for (const { source, pathLabel } of collectAllExpressions(doc)) {
+    const ast = compileExpression(source);
+    walkVariableAccesses(ast, (root, name) => {
+      if (root === ExpressionRoot.VARS && !allowedVars.has(name)) {
+        throw new WorkflowDslError(
+          WorkflowErrorCode.DSL_EXPRESSION_INVALID,
+          `Expression at ${pathLabel} reads vars.${name}, but '${name}' is not provided by workflow.vars or any wallet in requires.wallets.`,
+          { pathLabel, root, name, source },
+        );
+      }
+      if (root === ExpressionRoot.SECRETS && !allowedSecrets.has(name)) {
+        throw new WorkflowDslError(
+          WorkflowErrorCode.DSL_EXPRESSION_INVALID,
+          `Expression at ${pathLabel} reads secrets.${name}, but '${name}' is not provided by any wallet in requires.wallets (or the wallet entry is not marked secret).`,
+          { pathLabel, root, name, source },
+        );
+      }
+    });
+  }
+}
+
+interface CollectedExpression {
+  readonly source: string;
+  readonly pathLabel: string;
+}
+
+function collectAllExpressions(doc: WorkflowDocument): CollectedExpression[] {
+  const out: CollectedExpression[] = [];
+  for (const [jobKey, job] of Object.entries(doc.jobs)) {
+    for (const expr of extractInterpolations(job.with, ['jobs', jobKey, 'with'])) {
+      out.push({ source: expr.source, pathLabel: expr.path.join('.') });
+    }
+    for (const expr of extractInterpolations(job.outputs, ['jobs', jobKey, 'outputs'])) {
+      out.push({ source: expr.source, pathLabel: expr.path.join('.') });
+    }
+    if (typeof job.if === 'string' && job.if.length > 0) {
+      out.push({ source: stripInterpolation(job.if), pathLabel: `jobs.${jobKey}.if` });
+    }
+  }
+  return out;
+}
+
+/**
+ * Visits every `<root>.<name>` member access in the AST and invokes
+ * `onAccess(root, name)`. Other access shapes are ignored — the caller
+ * validates only the first hop, which is sufficient because both
+ * `vars.*` and `secrets.*` are string-keyed flat maps.
+ */
+function walkVariableAccesses(
+  node: ExpressionNode,
+  onAccess: (root: ExpressionRoot, name: string) => void,
+): void {
+  switch (node.kind) {
+    case ExpressionNodeKind.MEMBER: {
+      const target = node.target;
+      if (
+        target.kind === ExpressionNodeKind.IDENTIFIER &&
+        (target.name === ExpressionRoot.VARS ||
+          target.name === ExpressionRoot.SECRETS)
+      ) {
+        onAccess(target.name as ExpressionRoot, node.property);
+        return;
+      }
+      walkVariableAccesses(target, onAccess);
+      return;
+    }
+    case ExpressionNodeKind.INDEX:
+      walkVariableAccesses(node.target, onAccess);
+      walkVariableAccesses(node.index, onAccess);
+      return;
+    case ExpressionNodeKind.CALL:
+      for (const arg of node.args) {
+        walkVariableAccesses(arg, onAccess);
+      }
+      return;
+    case ExpressionNodeKind.UNARY_NOT:
+      walkVariableAccesses(node.operand, onAccess);
+      return;
+    case ExpressionNodeKind.BINARY_EQ:
+    case ExpressionNodeKind.BINARY_NEQ:
+    case ExpressionNodeKind.BINARY_AND:
+    case ExpressionNodeKind.BINARY_OR:
+      walkVariableAccesses(node.left, onAccess);
+      walkVariableAccesses(node.right, onAccess);
+      return;
+    case ExpressionNodeKind.IDENTIFIER:
+    case ExpressionNodeKind.LITERAL:
+      return;
+  }
+}

package/src/workflow/lib/deliverable-spec-keys.ts

@@ -0,0 +1,109 @@
+/**
+ * Static introspection of deliverable-spec content to recover the
+ * top-level keys an agent's output object MUST expose. The compiler uses
+ * these keys to validate workflow expressions of shape
+ * `${{ job.outputs.deliverable.content.value.<field> }}` against the
+ * spec the producing job declared via `with.deliverableSpecRef` —
+ * catching "the YAML reads `.changeUnits` but the spec has
+ * `.handoffPackage`" at compile time, not at runtime when projection
+ * blows up.
+ *
+ * Two extractors:
+ *   - `extractZodTopLevelObjectKeys`: parses a `z.object({ ... })`
+ *     literal out of TypeScript Zod source. Same regex-based brace walker
+ *     the deliverable-specs-api ZodSchemaHandler uses for harvest-time
+ *     validation; single source of truth lives here so the DSL compiler
+ *     and the harvester agree.
+ *   - `extractJsonSchemaTopLevelKeys`: pulls keys from the `properties`
+ *     object of a JSON Schema document.
+ *
+ * Both return `null` when introspection fails so callers can skip the
+ * field check (preview / specs without introspectable shape).
+ */
+
+/**
+ * Parse the FIRST `z.object({ ... })` literal in the source and return
+ * the top-level field identifiers. Returns `null` when the literal is
+ * absent or its braces are unbalanced — the spec layer fails fast on
+ * such specs at content-validation time, but here in the compiler we
+ * gracefully degrade so a malformed spec doesn't block unrelated
+ * expression checks elsewhere.
+ */
+export function extractZodTopLevelObjectKeys(source: string): readonly string[] | null {
+  if (!source || source.trim().length === 0) return null;
+  const body = sliceTopLevelObjectBody(source);
+  if (body === null) return null;
+  return Object.freeze(parseObjectKeysAtTopLevel(body));
+}
+
+/**
+ * Pull the top-level field names from a JSON Schema document. Accepts
+ * either a parsed object or a raw JSON string. Honors `properties` —
+ * the conventional shape — and ignores `patternProperties` /
+ * `additionalProperties` / Draft 2020 `unevaluatedProperties` because
+ * those don't enumerate concrete keys an author can reference by name.
+ *
+ * Returns `null` when the schema is unparseable or has no `properties`
+ * map.
+ */
+export function extractJsonSchemaTopLevelKeys(
+  source: string | object,
+): readonly string[] | null {
+  let parsed: unknown;
+  if (typeof source === 'string') {
+    if (source.trim().length === 0) return null;
+    try {
+      parsed = JSON.parse(source);
+    } catch {
+      return null;
+    }
+  } else {
+    parsed = source;
+  }
+  if (!isPlainObject(parsed)) return null;
+  const properties = (parsed as Record<string, unknown>)['properties'];
+  if (!isPlainObject(properties)) return null;
+  const keys = Object.keys(properties);
+  return Object.freeze(keys);
+}
+
+function isPlainObject(v: unknown): v is Record<string, unknown> {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+
+/** Substring between matching braces of the first `z.object({ ... })`, or null. */
+function sliceTopLevelObjectBody(source: string): string | null {
+  const match = /z\.object\s*\(\s*\{/.exec(source);
+  if (!match) return null;
+  const start = match.index + match[0].length;
+  let depth = 1;
+  for (let i = start; i < source.length; i += 1) {
+    const ch = source[i];
+    if (ch === '{') depth += 1;
+    else if (ch === '}' && --depth === 0) return source.slice(start, i);
+  }
+  return null;
+}
+
+/** Walk the body once, recording identifiers at brace+paren depth 0. */
+function parseObjectKeysAtTopLevel(body: string): string[] {
+  const keys: string[] = [];
+  const depth = { brace: 0, paren: 0 };
+  for (let i = 0; i < body.length; i += 1) {
+    if (updateDepth(depth, body[i])) continue;
+    if (depth.brace !== 0 || depth.paren !== 0) continue;
+    if (i !== 0 && body[i] !== '\n' && body[i] !== ',') continue;
+    const rest = body.slice(i === 0 ? 0 : i + 1);
+    const keyMatch = /^\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*:/.exec(rest);
+    if (keyMatch?.[1]) keys.push(keyMatch[1]);
+  }
+  return keys;
+}
+
+function updateDepth(depth: { brace: number; paren: number }, ch: string | undefined): boolean {
+  if (ch === '{') { depth.brace += 1; return true; }
+  if (ch === '}') { depth.brace = Math.max(0, depth.brace - 1); return true; }
+  if (ch === '(') { depth.paren += 1; return true; }
+  if (ch === ')') { depth.paren = Math.max(0, depth.paren - 1); return true; }
+  return false;
+}

package/src/workflow/lib/dispatch-inputs/index.ts

@@ -0,0 +1,160 @@
+// ═══════════════════════════════════════════════════════════════════════════
+// ── Dispatch-input descriptor extraction ──
+//
+// Shared, tree-shakable module that projects a parsed workflow
+// document's `on.workflow_dispatch.inputs` declaration into a
+// normalized `DispatchInputDescriptor[]` the frontend renders as a
+// dispatch form and the engine consumes for endpoint-returned schema
+// metadata.
+//
+// Single source of truth: the engine and the web frontend both call
+// this function. Keeping the extraction + field-type enumeration in
+// one place removes the "two validation authorities" anti-pattern
+// (per CLAUDE.md fail-fast rule). The pure extraction logic here is
+// NOT validation — the engine's DSL validator (in `lib/validate.ts`)
+// remains the sole validator at compile + dispatch time.
+//
+// No Ajv, no js-yaml — this module is deliberately self-contained so
+// the frontend bundle can import it without pulling heavy
+// transitive deps through tree-shaking.
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Closed set of field types surfaced to the dispatch form. Mirrors
+ * `WorkflowInputDeclaration.type` but narrows to the subset the form
+ * renderer knows how to render. Unknown type values in the parsed
+ * document cause the field to be skipped (fail-fast — no silent
+ * downgrade to a string input).
+ */
+export enum DispatchInputFieldType {
+  String = 'string',
+  Number = 'number',
+  Integer = 'integer',
+  Boolean = 'boolean',
+  Object = 'object',
+  Array = 'array',
+}
+
+/**
+ * Normalized descriptor the dispatch form consumes. Flat + closed
+ * shape so renderer code doesn't have to probe optional fields.
+ */
+export interface DispatchInputDescriptor {
+  readonly name: string;
+  readonly type: DispatchInputFieldType;
+  readonly required: boolean;
+  readonly description: string | null;
+  /** String values only — non-string enum members are dropped. */
+  readonly enumValues: readonly string[] | null;
+  /** For `type: string`, a hint for multiline rendering. Closed set. */
+  readonly format: DispatchInputStringFormat | null;
+  /** For `type: array`, the item type (only `string[]` is form-rendered; other item types fall to raw JSON). */
+  readonly itemType: DispatchInputFieldType | null;
+  readonly defaultValue: unknown;
+}
+
+export enum DispatchInputStringFormat {
+  Multiline = 'multiline',
+}
+
+/**
+ * Extracts descriptors from a parsed workflow document. Returns an
+ * empty array when the document declares no dispatch inputs (reusable
+ * workflows or schedule/webhook-only workflows). Never throws — a
+ * malformed inputs bag (unknown `type`, non-object entries) drops the
+ * offending field rather than failing the whole extraction, so the
+ * dispatch UI stays renderable even if one input declaration is
+ * stale. The engine's compile path remains authoritative for
+ * validation.
+ */
+export function extractDispatchInputDescriptors(
+  parsedDocument: unknown,
+): readonly DispatchInputDescriptor[] {
+  const inputs = readDispatchInputsBag(parsedDocument);
+  if (!inputs) return [];
+  const descriptors: DispatchInputDescriptor[] = [];
+  for (const [name, raw] of Object.entries(inputs)) {
+    const descriptor = toDescriptor(name, raw);
+    if (descriptor !== null) descriptors.push(descriptor);
+  }
+  return descriptors;
+}
+
+function readDispatchInputsBag(
+  parsedDocument: unknown,
+): Record<string, unknown> | null {
+  if (!parsedDocument || typeof parsedDocument !== 'object') return null;
+  const doc = parsedDocument as Record<string, unknown>;
+  const on = doc['on'];
+  if (!on || typeof on !== 'object') return null;
+  const wfDispatch = (on as Record<string, unknown>)['workflow_dispatch'];
+  if (!wfDispatch || typeof wfDispatch !== 'object') return null;
+  const inputs = (wfDispatch as Record<string, unknown>)['inputs'];
+  if (!inputs || typeof inputs !== 'object' || Array.isArray(inputs)) {
+    return null;
+  }
+  return inputs as Record<string, unknown>;
+}
+
+function toDescriptor(
+  name: string,
+  raw: unknown,
+): DispatchInputDescriptor | null {
+  if (!raw || typeof raw !== 'object') return null;
+  const field = raw as Record<string, unknown>;
+  const type = parseFieldType(field['type']);
+  if (type === null) return null;
+  const required = field['required'] === true;
+  const description =
+    typeof field['description'] === 'string' ? field['description'] : null;
+  const enumValues = parseEnumValues(field['enum']);
+  const format = parseStringFormat(field['format']);
+  const itemType = parseItemType(field['items']);
+  return {
+    name,
+    type,
+    required,
+    description,
+    enumValues,
+    format,
+    itemType,
+    defaultValue: field['default'] ?? undefined,
+  };
+}
+
+function parseFieldType(value: unknown): DispatchInputFieldType | null {
+  if (typeof value !== 'string') return null;
+  switch (value) {
+    case 'string':
+      return DispatchInputFieldType.String;
+    case 'number':
+      return DispatchInputFieldType.Number;
+    case 'integer':
+      return DispatchInputFieldType.Integer;
+    case 'boolean':
+      return DispatchInputFieldType.Boolean;
+    case 'object':
+      return DispatchInputFieldType.Object;
+    case 'array':
+      return DispatchInputFieldType.Array;
+    default:
+      return null;
+  }
+}
+
+function parseEnumValues(value: unknown): readonly string[] | null {
+  if (!Array.isArray(value) || value.length === 0) return null;
+  const strings = value.filter((v): v is string => typeof v === 'string');
+  return strings.length === value.length ? strings : null;
+}
+
+function parseStringFormat(value: unknown): DispatchInputStringFormat | null {
+  if (value === 'multiline') return DispatchInputStringFormat.Multiline;
+  return null;
+}
+
+function parseItemType(value: unknown): DispatchInputFieldType | null {
+  if (!value || typeof value !== 'object') return null;
+  const items = value as Record<string, unknown>;
+  return parseFieldType(items['type']);
+}

package/src/workflow/lib/dispatch-inputs/to-json-schema.ts

@@ -0,0 +1,60 @@
+import {
+  DispatchInputFieldType,
+  DispatchInputStringFormat,
+  type DispatchInputDescriptor,
+} from './index';
+
+/**
+ * Project a flat `DispatchInputDescriptor[]` into a JSON Schema
+ * Draft 2020-12 object the MCP gateway uses as `inputSchema` on
+ * workflow-tool projections (and the frontend dispatch dialog uses
+ * for form rendering parity).
+ *
+ * Single source of truth for the descriptor → JSON Schema mapping so
+ * the gateway, the engine, and the frontend agree on the shape an
+ * agent sees vs the shape a human sees in the dispatch dialog.
+ *
+ * Closed-set conservatively: unknown enum values are dropped (the
+ * extractor already filters), unknown type combinations fall back to
+ * `{ type: 'object' }` to keep the schema valid rather than throwing.
+ */
+export function dispatchInputsToJsonSchema(
+  descriptors: readonly DispatchInputDescriptor[],
+): Readonly<Record<string, unknown>> {
+  const properties: Record<string, Record<string, unknown>> = {};
+  const required: string[] = [];
+  for (const d of descriptors) {
+    properties[d.name] = descriptorToProperty(d);
+    if (d.required) required.push(d.name);
+  }
+  const schema: Record<string, unknown> = {
+    $schema: 'https://json-schema.org/draft/2020-12/schema',
+    type: 'object',
+    properties,
+    additionalProperties: false,
+  };
+  if (required.length > 0) {
+    schema['required'] = required;
+  }
+  return Object.freeze(schema);
+}
+
+function descriptorToProperty(d: DispatchInputDescriptor): Record<string, unknown> {
+  const prop: Record<string, unknown> = { type: d.type };
+  if (d.description) {
+    prop['description'] = d.description;
+  }
+  if (d.enumValues && d.enumValues.length > 0) {
+    prop['enum'] = [...d.enumValues];
+  }
+  if (d.format === DispatchInputStringFormat.Multiline) {
+    prop['x-widget'] = 'multiline';
+  }
+  if (d.type === DispatchInputFieldType.Array && d.itemType) {
+    prop['items'] = { type: d.itemType };
+  }
+  if (d.defaultValue !== undefined) {
+    prop['default'] = d.defaultValue;
+  }
+  return prop;
+}

package/src/workflow/lib/duration.ts

@@ -0,0 +1,48 @@
+import { WorkflowErrorCode } from '@xemahq/kernel-contracts/workflow';
+import { WorkflowDslError } from './errors';
+
+/**
+ * Duration literal parser. Accepts `<int><unit>` where unit is `s`, `m`, or
+ * `h`. Deterministic; rejects malformed input with a typed error. There is
+ * no silent zero fallback — callers must pass a value that matches the
+ * schema pattern (already enforced by Ajv upstream).
+ *
+ * Cap: hours limited to 8760 (= 365 days). The cap is a sanity guard
+ * against typos (`100000h` ≈ 11 years), not a policy bound — real
+ * human-driven flows (compliance reviews, multi-stakeholder approvals,
+ * SCM PRs that go a quarter without merging) routinely take months.
+ *
+ * For redraft loops (`xema/review@v3`), the workflow `continueAsNew`s
+ * every 25 iterations, which resets the runtime clock — the practical
+ * ceiling on a single review is unbounded. This cap applies only to a
+ * single iteration window of the child workflow.
+ */
+const MAX_HOURS = 8760;
+
+export function parseDurationMs(literal: string): number {
+  const match = /^([1-9][0-9]*)(s|m|h)$/.exec(literal);
+  if (!match) {
+    throw new WorkflowDslError(
+      WorkflowErrorCode.DSL_SCHEMA_INVALID,
+      `Duration literal does not match pattern <int><s|m|h>: ${literal}`,
+      { literal },
+    );
+  }
+  const value = Number.parseInt(match[1]!, 10);
+  const unit = match[2] as 's' | 'm' | 'h';
+  if (unit === 'h' && value > MAX_HOURS) {
+    throw new WorkflowDslError(
+      WorkflowErrorCode.DSL_SCHEMA_INVALID,
+      `Duration exceeds cap of ${MAX_HOURS}h: ${literal}`,
+      { literal, maxHours: MAX_HOURS },
+    );
+  }
+  switch (unit) {
+    case 's':
+      return value * 1_000;
+    case 'm':
+      return value * 60_000;
+    case 'h':
+      return value * 3_600_000;
+  }
+}

package/src/workflow/lib/errors.ts

@@ -0,0 +1,37 @@
+import { WorkflowErrorCode } from '@xemahq/kernel-contracts/workflow';
+
+/**
+ * Structured error produced by every DSL entry point (validate, parseYaml,
+ * evaluateExpression, compile). Callers MUST branch on `.code` — free-form
+ * message matching is forbidden so error handling stays exhaustive.
+ */
+export class WorkflowDslError extends Error {
+  readonly code: WorkflowErrorCode;
+  readonly details: Readonly<Record<string, unknown>>;
+
+  constructor(
+    code: WorkflowErrorCode,
+    message: string,
+    details: Readonly<Record<string, unknown>> = {},
+  ) {
+    super(message);
+    this.name = 'WorkflowDslError';
+    this.code = code;
+    this.details = details;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+
+  toJSON(): Readonly<Record<string, unknown>> {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      details: this.details,
+    };
+  }
+}
+
+/** Narrowing helper. */
+export function isWorkflowDslError(err: unknown): err is WorkflowDslError {
+  return err instanceof WorkflowDslError;
+}