@foldrun/core 2.14.2 → 2.14.3

package/dist/src/frontmatter-fields.js

@@ -116,7 +116,7 @@ const FLOW = [
     { key: "every", type: ["string", "number"], help: "trigger: watch — how often" },
     { key: "path", type: "string", help: "trigger: storage — the prefix under storage/" },
     { key: "filter", type: "object", validated: true, help: "webhook, email, flow or storage trigger: the fields a delivery must have to start a run — e.g. {action: [opened], sender: {type: {not_in: [Bot]}}}" },
-    { key: "idempotency", type: "string", help: "a header name, or body:<field>, that marks a repeat delivery" },
+    { key: "idempotency", type: ["string", "boolean"], help: "a header name, or body:<field>, that marks a repeat delivery; none (or false) to turn off (signature: github defaults to x-github-delivery)" },
     { key: "debounce", type: ["string", "number"], help: "wait for a burst to end" },
     { key: "throttle", type: ["string", "number"], help: "at most one run per window" },
     { key: "sla", type: ["string", "number"], help: "tell someone when a run outlives it" },

package/dist/src/store.js

@@ -1658,7 +1658,7 @@ export function parseFlow(file, raw) {
         // A header name is case-insensitive on the wire; a JSON field is not.
         // `body:eventId` lower-cased to `body:eventid` matched nothing, and a
         // dedupe that matches nothing admits everything.
-        idempotency: typeof data.idempotency === "string" ? idempotencyName(data.idempotency) : null,
+        idempotency: idempotencyOf(data.idempotency, data.trigger, data.signature),
         debounce: durationOf(data.debounce),
         throttle: durationOf(data.throttle),
         catchup: data.catchup === "none" || data.catchup === "last" ? data.catchup : null,
@@ -1695,6 +1695,20 @@ export function parseSchemaText(text) {
     }
     return { schema: value };
 }
+/**
+ * The flow's `idempotency:`, or its default. A GitHub-signed webhook dedupes
+ * on `x-github-delivery` unless it says otherwise: GitHub's signature has no
+ * timestamp, so a delivery captured once could be replayed for ever, and
+ * every GitHub delivery carries that id (FOL-94). Any `idempotency:` the
+ * file sets wins; `none` (or `false`, `off`) turns dedupe off.
+ */
+function idempotencyOf(raw, trigger, signature) {
+    if (raw === false || (typeof raw === "string" && /^(none|off|false)$/i.test(raw.trim())))
+        return null;
+    if (typeof raw === "string")
+        return idempotencyName(raw);
+    return trigger === "webhook" && String(signature) === "github" ? "x-github-delivery" : null;
+}
 function idempotencyName(raw) {
     const v = raw.trim();
     if (!v)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "2.14.2",
+  "version": "2.14.3",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "FSL-1.1-ALv2",
   "type": "module",

package/src/frontmatter-fields.ts

@@ -163,7 +163,7 @@ const FLOW: FieldSpec[] = [
   { key: "every", type: ["string", "number"], help: "trigger: watch — how often" },
   { key: "path", type: "string", help: "trigger: storage — the prefix under storage/" },
   { key: "filter", type: "object", validated: true, help: "webhook, email, flow or storage trigger: the fields a delivery must have to start a run — e.g. {action: [opened], sender: {type: {not_in: [Bot]}}}" },
-  { key: "idempotency", type: "string", help: "a header name, or body:<field>, that marks a repeat delivery" },
+  { key: "idempotency", type: ["string", "boolean"], help: "a header name, or body:<field>, that marks a repeat delivery; none (or false) to turn off (signature: github defaults to x-github-delivery)" },
   { key: "debounce", type: ["string", "number"], help: "wait for a burst to end" },
   { key: "throttle", type: ["string", "number"], help: "at most one run per window" },
   { key: "sla", type: ["string", "number"], help: "tell someone when a run outlives it" },

package/src/store.ts

@@ -2107,7 +2107,7 @@ export function parseFlow(file: string, raw: string): FlowInfo {
     // A header name is case-insensitive on the wire; a JSON field is not.
     // `body:eventId` lower-cased to `body:eventid` matched nothing, and a
     // dedupe that matches nothing admits everything.
-    idempotency: typeof data.idempotency === "string" ? idempotencyName(data.idempotency) : null,
+    idempotency: idempotencyOf(data.idempotency, data.trigger, data.signature),
     debounce: durationOf(data.debounce),
     throttle: durationOf(data.throttle),
     catchup: data.catchup === "none" || data.catchup === "last" ? data.catchup : null,
@@ -2144,6 +2144,19 @@ export function parseSchemaText(text: string): { schema: Record<string, unknown>
   return { schema: value as Record<string, unknown> };
 }
 
+/**
+ * The flow's `idempotency:`, or its default. A GitHub-signed webhook dedupes
+ * on `x-github-delivery` unless it says otherwise: GitHub's signature has no
+ * timestamp, so a delivery captured once could be replayed for ever, and
+ * every GitHub delivery carries that id (FOL-94). Any `idempotency:` the
+ * file sets wins; `none` (or `false`, `off`) turns dedupe off.
+ */
+function idempotencyOf(raw: unknown, trigger: unknown, signature: unknown): string | null {
+  if (raw === false || (typeof raw === "string" && /^(none|off|false)$/i.test(raw.trim()))) return null;
+  if (typeof raw === "string") return idempotencyName(raw);
+  return trigger === "webhook" && String(signature) === "github" ? "x-github-delivery" : null;
+}
+
 function idempotencyName(raw: string): string | null {
   const v = raw.trim();
   if (!v) return null;