pkg/

Package embed is the curated surface for embedding Flowstate as a Go library: compile a Flowfile from bytes, run it locally in-process or durably against a Temporal worker the embedding program owns, and register the program's own Go functions as tasks a workflow can call.

Package flowstatev1 holds the generated flowstate.v1 protobuf types and the hand-written engine that gives them behavior: the local interpreter (RunWithInputs), the task registry, the CEL evaluator, and the primitives pkg/flowstate/v1/engine wraps for durable execution against Temporal.

Package audit writes the record of an authorization decision to a sink that is complete rather than sampled.

Package auth establishes identity in both directions between Flowstate and the systems around it, using OpenID Connect and Workload Identity Federation.

Package authtest serves an OpenID Connect provider from inside a test, so that a trust policy can be proved without an identity provider, a network, or a credential.

Package celcomplete answers one question for every surface that asks it: given what an expression may name at this point, and the partial name someone has typed, what can they write next?

Package credentialsource turns an environment into a credential.

Package dst is the deterministic simulation tier: one workflow run under many schedules, held to the claim that the schedule is not something an author can see (issue #477, slice 0).

Package dsttest is the testing-shaped front door to the deterministic simulation tier: explore a workflow's schedule space and fail the test on the first schedule that disagrees with written order.

Package engine is the durable execution driver: it runs a compiled workflow specification as a Temporal workflow, so a run survives process crashes, deploys, and waits measured in days.

Package flowdap speaks the Debug Adapter Protocol over a paused flowdebug.Session, so an editor's step and continue buttons drive a real flowstate run.

Package flowdebug is the interactive step debugger for a local run (issue #928, slice 1).

Package flowfile compiles a Flowfile — the YAML and CEL surface authors write — into the protobuf workflow the engine executes, and writes one back out again.

Package lsp implements a Language Server Protocol server for the Flowfile DSL.

Package flowtest implements `flow test` (#155): self-testing of workflows through the local driver, with stubbed tasks and virtual time.

Package flowtesting is the testing-shaped front door to `flow test`'s harness (issue #930): it runs a `*.test.yaml` suite's cases as real Go subtests, one testing.T.Run per case, so the tooling an author already has — `go test -run`, `-v`, an IDE's per-test rerun, CI's per-test timing — addresses a Flowfile case exactly as it addresses a Go one.

Package metricschema decides which attribute keys may reach a metric instrument, and bounds what their values may be.

Package nearest is the one did-you-mean rule: how far a typed name may be from a real one and still be offered as the thing that was probably meant.

Package netpolicy governs the outbound network access a workflow task is allowed to make.

Package payloadcodec is the one seam where a run's payloads are encrypted before they are durable, and the one place both drivers are configured with the same answer.

Package toycodec is a payload codec for tests, and for nothing else.

Package plugin runs Flowstate plugins: separate processes that extend the engine, discovered on a configured path, launched and supervised by this package, and spoken to over Connect RPC on a Unix domain socket.

Command flowstate-plugin-example is a Flowstate plugin that both resolves secrets and provides a task.

Package sdk turns a manifest and a few functions into a Flowstate plugin.

Package protodoc reads the prose the schema already carries.

Package secrets resolves secret references to secret values, worker-side and as late as possible.

Package secretstest is the conformance kit a secrets.Provider author runs against their own implementation.

Package vault resolves secret references against a HashiCorp Vault or OpenBao KV version 2 secrets engine.

Package server is the control plane: FlowstateServer implements the flowstate.v1 WorkflowService over Connect RPC, turning each request to submit, observe, signal, cancel, or schedule a run into Temporal operations on the workloads the engine executes.

Package temporalclient connects Flowstate to Temporal, whether that is a development server on a laptop, a self-hosted cluster, or Temporal Cloud.