@foldrun/core 9.0.0 → 9.2.0

package/dist/src/api-tools.js

@@ -17,7 +17,7 @@ import { EGRESS_ENV, viaEgress } from "./egress.js";
 import { z } from "zod";
 import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 import { previewOrKeep, RESULT_KEEP_CHARS } from "./tool-output.js";
-import { resolveSecrets, materializeSecrets } from "./secrets.js";
+import { resolveSecrets, materializeCurrent } from "./secrets.js";
 // Collected whole up to this; the model sees a preview and where the rest is
 // kept (tool-output.ts), not a cut with the rest gone.
 const MAX_BODY_CHARS = RESULT_KEEP_CHARS;
@@ -97,7 +97,7 @@ export function typedToolName(apiName, opId) {
  */
 async function performRequest(api, env, bucket, log, req, 
 /** Where a long body is kept, when the agent can read it back (tool-output.ts). */
-keepIn) {
+keepIn, scope = null) {
     const started = Date.now();
     try {
         const waited = bucket ? await bucket.take() : 0;
@@ -105,8 +105,11 @@ keepIn) {
         // Per call, not per build: an oauth2 secret's recipe becomes a
         // live access token here, so a step that runs for an hour keeps
         // getting fresh tokens (the exchange is cached until near expiry)
-        // — and a recipe can never end up inside a header.
-        const live = await materializeSecrets(env);
+        // — and a recipe can never end up inside a header. On a host, the
+        // vault's recipe as it is now, made live in the account's scope: a
+        // rotating refresh token the runner (or an earlier call) spent is never
+        // sent again (secrets.ts materializeCurrent).
+        const live = await materializeCurrent(env, scope);
         const path = req.path.startsWith("/") ? req.path : `/${req.path}`;
         const url = new URL(api.base + path);
         // Base-URL confinement: a path can't escape the declared host.
@@ -183,7 +186,7 @@ function argKeys(op) {
     }
     return out;
 }
-function typedTool(api, op, env, bucket, log, keepIn) {
+function typedTool(api, op, env, bucket, log, keepIn, scope = null) {
     const keys = argKeys(op);
     const shape = {};
     for (const [key, p] of keys)
@@ -235,10 +238,10 @@ function typedTool(api, op, env, bucket, log, keepIn) {
             query,
             headers,
             body: typeof values.body === "string" ? values.body : undefined,
-        }, keepIn);
+        }, keepIn, scope);
     });
 }
-function genericTool(api, env, bucket, log, keepIn) {
+function genericTool(api, env, bucket, log, keepIn, scope = null) {
     const typed = api.resolvedOperations?.length
         ? ` Prefer the typed ${api.name}_* tools; this one is the escape hatch for operations they do not cover.`
         : "";
@@ -258,7 +261,7 @@ function genericTool(api, env, bucket, log, keepIn) {
         query: args.query ?? {},
         headers: {},
         body: args.body,
-    }, keepIn));
+    }, keepIn, scope));
 }
 export function buildApiTools(tenant, apis, workspace, 
 // The runner container passes this: secrets were resolved before the specs
@@ -277,6 +280,8 @@ keepIn) {
             missing: resolved.missing,
         }
         : resolveSecrets(tenant, neededSecrets, workspace);
+    // Read from the vault here: made live per call in its account's scope.
+    const scope = !resolved && tenant ? { tenant, ...(workspace ? { workspace } : {}) } : null;
     const log = [];
     // eslint-disable-next-line @typescript-eslint/no-explicit-any -- the SDK types its own list this way
     const tools = [];
@@ -311,12 +316,12 @@ keepIn) {
         }
         const typedNames = [];
         for (const op of ops) {
-            tools.push(typedTool(api, op, env, bucket, log, keepIn));
+            tools.push(typedTool(api, op, env, bucket, log, keepIn, scope));
             typedNames.push(typedToolName(api.name, op.id));
             methods[`mcp__foldrun_apis__${typedToolName(api.name, op.id)}`] = String(op.method ?? "").toUpperCase();
         }
         if (withGeneric)
-            tools.push(genericTool(api, env, bucket, log, keepIn));
+            tools.push(genericTool(api, env, bucket, log, keepIn, scope));
         const names = [...typedNames, ...(withGeneric ? [`call_${api.name}`] : [])];
         for (const n of names) {
             toolNames.push(`mcp__foldrun_apis__${n}`);

package/dist/src/approvals.d.ts

@@ -127,19 +127,27 @@ export declare function decideApproval(tenant: string, workspace: string, runId:
  */
 export declare function expireStaleGate(tenant: string, workspace: string, run: RunRecord, now?: number): Promise<boolean>;
 /**
- * Release a run parked on `wait: event` with what arrived. The payload is
- * stored on the step — not as an approval note, which is a person's
- * guidance and capped as such — and the release itself is an approval
- * "by an external event", so the record reads the same way whichever door
- * a park was opened through.
+ * What a presented event token opens on a run (30 Oct 2026): `known` when
+ * it is a real token of this run — one of its parks, or the old per-run
+ * form — and `steps`, the waiting steps it releases now (none: a 409, the
+ * gate it was for is no longer waiting).
  *
- * Only steps waiting on an event are released: a run that is also asking a
- * person a question keeps asking.
+ * With `step` (the `&step=` every URL printed since carries), the token is
+ * that step's, bound to the moment it parked: the `t` of its "waiting for an
+ * external event" line. It releases that step only while that park is the
+ * step's current one — a released step is no longer waiting, and a step
+ * parked again (a loop) has a new `t` — so a URL handed out for one gate
+ * opens neither a later gate nor a later park.
  *
- * `by` names who delivered it when that is known — a signed-in person or a
- * key through the dashboard's approve route — and `step` releases one
- * waiting step rather than all of them.
+ * Without `step`, the per-run token URLs carried before then. It releases
+ * only a step still waiting under such a URL — its park line has no
+ * `step=` — so a run parked when this shipped can still be released, and
+ * nothing parked since can be released by the old form.
  */
+export declare function eventGatesFor(tenant: string, workspace: string, run: RunRecord, presented: string, step: number | null): {
+    known: boolean;
+    steps: number[];
+};
 export declare function deliverEvent(tenant: string, workspace: string, runId: string, payload: string, opts?: {
     by?: string;
     step?: number;

package/dist/src/approvals.js

@@ -12,7 +12,7 @@
 import crypto from "node:crypto";
 import { readRun, writeRun, readFlow, mayApprove } from "./store.js";
 import { platform } from "./platform.js";
-import { approveToken, installKey } from "./webhook.js";
+import { approveToken, eventToken, installKey } from "./webhook.js";
 // ----------------------------------------------------------------- links
 /** How long an emailed link decides for when the flow does not say. */
 export const APPROVE_LINK_DEFAULT_TTL_MS = 7 * 24 * 60 * 60 * 1000;
@@ -276,6 +276,56 @@ export async function expireStaleGate(tenant, workspace, run, now = Date.now())
  * key through the dashboard's approve route — and `step` releases one
  * waiting step rather than all of them.
  */
+const EVENT_WAIT_LINE = "waiting for an external event — release it with POST ";
+/**
+ * What a presented event token opens on a run (30 Oct 2026): `known` when
+ * it is a real token of this run — one of its parks, or the old per-run
+ * form — and `steps`, the waiting steps it releases now (none: a 409, the
+ * gate it was for is no longer waiting).
+ *
+ * With `step` (the `&step=` every URL printed since carries), the token is
+ * that step's, bound to the moment it parked: the `t` of its "waiting for an
+ * external event" line. It releases that step only while that park is the
+ * step's current one — a released step is no longer waiting, and a step
+ * parked again (a loop) has a new `t` — so a URL handed out for one gate
+ * opens neither a later gate nor a later park.
+ *
+ * Without `step`, the per-run token URLs carried before then. It releases
+ * only a step still waiting under such a URL — its park line has no
+ * `step=` — so a run parked when this shipped can still be released, and
+ * nothing parked since can be released by the old form.
+ */
+export function eventGatesFor(tenant, workspace, run, presented, step) {
+    const none = { known: false, steps: [] };
+    if (!presented)
+        return none;
+    const same = (want) => {
+        const a = Buffer.from(presented), b = Buffer.from(want);
+        return a.length === b.length && crypto.timingSafeEqual(a, b);
+    };
+    const parks = (i) => (run.steps[i]?.events ?? []).filter((e) => e?.text?.startsWith(EVENT_WAIT_LINE));
+    const waiting = (i) => {
+        const s = run.steps[i];
+        return !!s && s.status === "awaiting-approval" && s.waitFor === "event";
+    };
+    if (step !== null) {
+        const lines = parks(step);
+        const hit = lines.findIndex((e) => same(eventToken(tenant, workspace, run.id, { step, at: e.t })));
+        if (hit < 0)
+            return none;
+        // Only the step's latest park is open, and only while it waits.
+        return { known: true, steps: hit === lines.length - 1 && waiting(step) ? [step] : [] };
+    }
+    if (!same(eventToken(tenant, workspace, run.id)))
+        return none;
+    const legacy = [];
+    for (let i = 0; i < run.steps.length; i++) {
+        const last = parks(i).at(-1);
+        if (last && waiting(i) && !/[?&]step=\d/.test(last.text))
+            legacy.push(i);
+    }
+    return { known: true, steps: legacy };
+}
 export async function deliverEvent(tenant, workspace, runId, payload, opts = {}) {
     const run = readRun(tenant, workspace, runId);
     if (!run)

package/dist/src/browser-pod.js

@@ -173,6 +173,10 @@ export function classifyCall(tool, input, ctx = {}) {
     // colleague is said, and a re-run would say it twice.
     if (server === "foldrun_peers")
         return name === "peers_list" ? { write: false } : write("a message to a colleague");
+    // remotes: — reading where a request got to changes nothing; a send, a
+    // reply or a cancel acts on an outside agent's system.
+    if (server === "foldrun_a2a")
+        return name === "a2a_status" ? { write: false } : write(`${name.replace(/^a2a_/, "")} to an outside agent`);
     if (server === "foldrun_scripts") {
         if (name !== "web")
             return write(`script ${name}`);

package/dist/src/catalog.d.ts

@@ -45,6 +45,20 @@ export declare const CATALOG_MAX_BYTES: number;
  * there is nothing at all to fall back on.
  */
 export declare function loadCatalog(baseUrl: string): Promise<Catalog | null>;
+/** How long after an attempt a background refresh of the same gateway is
+ *  not tried again, whether it worked or not. */
+export declare const CATALOG_RETRY_MS: number;
+/**
+ * Refresh a gateway's catalogue behind the caller, at most once per
+ * CATALOG_RETRY_MS per gateway (30 Oct 2026). For the editor's completions and
+ * the flows page, which ask on every request: a stale or missing catalogue
+ * used to start a fresh outbound fetch each time — a 10 s one per keystroke
+ * against an unreachable gateway, nothing remembering that it had just
+ * failed. The attempt is noted before it starts, so callers arriving while
+ * one is in flight do not start another. True when one was started. A run's
+ * own read (loadCatalog) is untouched.
+ */
+export declare function refreshCatalogSoon(baseUrl: string, load?: (baseUrl: string) => Promise<unknown>, now?: number): boolean;
 /** A preset reference — settings live in the gateway's dashboard, opaque to
  *  us on purpose. The catalogue offers no opinion on one. */
 export declare const isPresetRef: (model: string) => boolean;

package/dist/src/catalog.js

@@ -118,6 +118,34 @@ export async function loadCatalog(baseUrl) {
         return cached; // stale beats nothing; null when there is no nothing
     }
 }
+/** How long after an attempt a background refresh of the same gateway is
+ *  not tried again, whether it worked or not. */
+export const CATALOG_RETRY_MS = 5 * 60_000;
+const lastTried = new Map();
+/**
+ * Refresh a gateway's catalogue behind the caller, at most once per
+ * CATALOG_RETRY_MS per gateway (30 Oct 2026). For the editor's completions and
+ * the flows page, which ask on every request: a stale or missing catalogue
+ * used to start a fresh outbound fetch each time — a 10 s one per keystroke
+ * against an unreachable gateway, nothing remembering that it had just
+ * failed. The attempt is noted before it starts, so callers arriving while
+ * one is in flight do not start another. True when one was started. A run's
+ * own read (loadCatalog) is untouched.
+ */
+export function refreshCatalogSoon(baseUrl, load = loadCatalog, now = Date.now()) {
+    const cached = readCatalog(baseUrl);
+    if (cached && now - Date.parse(cached.fetchedAt) < TTL_MS)
+        return false; // fresh: nothing to fetch
+    const last = lastTried.get(baseUrl);
+    if (last !== undefined && now - last < CATALOG_RETRY_MS)
+        return false;
+    lastTried.delete(baseUrl);
+    lastTried.set(baseUrl, now);
+    if (lastTried.size > 1000)
+        lastTried.delete(lastTried.keys().next().value);
+    void load(baseUrl).catch(() => null);
+    return true;
+}
 /** A preset reference — settings live in the gateway's dashboard, opaque to
  *  us on purpose. The catalogue offers no opinion on one. */
 export const isPresetRef = (model) => model.startsWith("@preset/");

package/dist/src/completions.js

@@ -331,9 +331,9 @@ export function completionsAt(path, text, cursor, vocab) {
         // that field's files and nothing else. `[[search]]` in tools: is how a
         // tool named after a runtime group gets granted; offering the group
         // here would defeat the point of the brackets.
-        const inlineOwner = line.match(/^\s*([a-zA-Z_]+):\s*(?:\[.*)?\[\[[^\]]*$/)?.[1];
+        const inlineOwner = line.match(/^\s*([a-zA-Z_][a-zA-Z0-9_]*):\s*(?:\[.*)?\[\[[^\]]*$/)?.[1];
         const blockOwner = /^\s+-\s*\[\[/.test(line)
-            ? before.slice(0, lineStart).split("\n").reverse().find((l) => /^\s*[a-zA-Z_]+:\s*$/.test(l))?.trim().replace(":", "")
+            ? before.slice(0, lineStart).split("\n").reverse().find((l) => /^\s*[a-zA-Z_][a-zA-Z0-9_]*:\s*$/.test(l))?.trim().replace(":", "")
             : undefined;
         const owner = inlineOwner ?? blockOwner;
         const byField = {
@@ -391,7 +391,7 @@ export function completionsAt(path, text, cursor, vocab) {
     //    been chosen yet, one at a time. Fixed combinations were the wrong
     //    model: nobody wants a menu of every permutation, they want to add the
     //    next verb.
-    const inlineList = line.match(/^(\s*)([a-zA-Z_]+):\s*\[([^\]]*)$/);
+    const inlineList = line.match(/^(\s*)([a-zA-Z_][a-zA-Z0-9_]*):\s*\[([^\]]*)$/);
     if (inlineList) {
         const [, , key, inside] = inlineList;
         // The inline and block forms of a list are the same field — `tools: [a, b]`
@@ -435,7 +435,7 @@ export function completionsAt(path, text, cursor, vocab) {
         }
     }
     // 4. `key: value` — the value side of a known field.
-    const kv = line.match(/^(\s*)([a-zA-Z_]+):\s*(\S*)$/);
+    const kv = line.match(/^(\s*)([a-zA-Z_][a-zA-Z0-9_]*):\s*(\S*)$/);
     if (kv) {
         const [, , key, partial] = kv;
         const from = cursor - partial.length;
@@ -517,7 +517,7 @@ export function completionsAt(path, text, cursor, vocab) {
         const partial = listItem[2];
         const from = cursor - partial.length;
         const priorLines = before.slice(0, lineStart).split("\n").reverse();
-        const owner = priorLines.find((l) => /^\s*[a-zA-Z_]+:\s*$/.test(l))?.trim().replace(":", "");
+        const owner = priorLines.find((l) => /^\s*[a-zA-Z_][a-zA-Z0-9_]*:\s*$/.test(l))?.trim().replace(":", "");
         const byOwner = {
             // One list now: built-ins and your own tools are granted the same way.
             // Groups first (they cover most needs), then your own tools — the ones
@@ -558,7 +558,7 @@ export function completionsAt(path, text, cursor, vocab) {
         const partial = mapping[2] ?? "";
         const priorLines = before.slice(0, lineStart).split("\n").reverse();
         const owner = priorLines
-            .find((l) => /^\s*[a-zA-Z_]+:\s*$/.test(l))
+            .find((l) => /^\s*[a-zA-Z_][a-zA-Z0-9_]*:\s*$/.test(l))
             ?.trim()
             .replace(":", "");
         const byOwner = {
@@ -593,7 +593,7 @@ export function completionsAt(path, text, cursor, vocab) {
     //     kind of file — the block takes nothing else.
     const fmClose = text.indexOf("\n---", text.indexOf("---") + 3);
     const insideFrontmatter = text.startsWith("---") && (fmClose === -1 || cursor <= fmClose);
-    const nested = line.match(/^(\s+)([a-zA-Z_]*)$/);
+    const nested = line.match(/^(\s+)([a-zA-Z_][a-zA-Z0-9_]*|)$/);
     if (insideFrontmatter && nested) {
         const header = before.slice(0, lineStart).split("\n").reverse().find((l) => /^\S/.test(l));
         const job = JOBS.find((j) => new RegExp(`^${j.name}\\s*:\\s*$`).test(header ?? ""));
@@ -624,7 +624,7 @@ export function completionsAt(path, text, cursor, vocab) {
     //    this kind of file. This is where you learn the format by writing it.
     const fmEnd = text.indexOf("\n---", text.indexOf("---") + 3);
     const inFrontmatter = text.startsWith("---") && (fmEnd === -1 || cursor <= fmEnd);
-    if (inFrontmatter && /^[a-zA-Z_][a-zA-Z_-]*$|^$/.test(line)) {
+    if (inFrontmatter && /^[a-zA-Z_][a-zA-Z0-9_-]*$|^$/.test(line)) {
         const from = cursor - line.length;
         return { from, query: line, items: filter(fieldsFor(path, kind), line), title: `${kind} fields` };
     }

package/dist/src/cron.d.ts

@@ -15,3 +15,12 @@ export interface Cron {
 export declare function parseCron(expr: string): Cron | null;
 /** Why `schedule:` is not a cron the scheduler can run, or null when it is. */
 export declare function cronProblem(expr: unknown): string | null;
+/**
+ * Whether the calendar has any day this cron names (30 Oct 2026). `0 0 30 2 *`
+ * parses — every field is in range — yet no February has a 30th, so a search
+ * for its next fire walked the whole window every time it was asked (the
+ * schedule page did, 57,600 minutes per flow per request). Answered from the
+ * fields alone: only a day of the month with no weekday beside it can miss,
+ * since with a weekday either may match and every month has every weekday.
+ */
+export declare function cronCanFire(cron: Cron): boolean;

package/dist/src/cron.js

@@ -105,3 +105,23 @@ export function cronProblem(expr) {
         ? `schedule: "${expr}" has ${fields} field${fields === 1 ? "" : "s"}; cron has five — minute hour day-of-month month day-of-week ("0 9 * * MON"), or @hourly, @daily, @weekly, @monthly. As written the flow never fires`
         : `schedule: "${expr}" is not a cron the scheduler can read — a field is out of range or not a number (minute 0-59, hour 0-23, day 1-31, month 1-12, weekday 0-7 or sun-sat). As written the flow never fires`;
 }
+/** Days in each month, February at its leap-year 29: a cron naming the 29th
+ *  of February does fire, every fourth year. */
+const MONTH_DAYS = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+/**
+ * Whether the calendar has any day this cron names (30 Oct 2026). `0 0 30 2 *`
+ * parses — every field is in range — yet no February has a 30th, so a search
+ * for its next fire walked the whole window every time it was asked (the
+ * schedule page did, 57,600 minutes per flow per request). Answered from the
+ * fields alone: only a day of the month with no weekday beside it can miss,
+ * since with a weekday either may match and every month has every weekday.
+ */
+export function cronCanFire(cron) {
+    if (!cron.domRestricted || cron.dowRestricted)
+        return true;
+    const firstDay = Math.min(...cron.dom);
+    for (const m of cron.month)
+        if (firstDay <= MONTH_DAYS[m - 1])
+            return true;
+    return false;
+}

package/dist/src/frontmatter-fields.js

@@ -43,6 +43,7 @@ const AGENT = [
     { key: "scripts", type: "list", help: "programs in scripts/, each a tool" },
     { key: "apis", type: "list", help: "an HTTP API as a tool" },
     { key: "mcpServers", type: "object", help: "MCP servers, name → {command | url, args, env, headers}" },
+    { key: "remotes", type: "list", help: "outside A2A agents it may call — [{name, card: the https URL of its agent card, secret?: a vault NAME sent as a bearer token, description?}]" },
     { key: "agents", type: ["list", "string"], help: "colleagues it may consult" },
     { key: "subagents", type: ["list", "string"], help: "colleagues it may delegate to" },
     { key: "sandbox", type: "string", values: ["own", "parent"], help: "when delegated to as a sub-agent: own = its own sandbox, tools, secrets and network; parent (default) = inside the delegating step's" },
@@ -109,7 +110,7 @@ const FLOW = [
     { key: "catchup", type: "string", validated: true, help: "last | none" },
     { key: "on", type: "string", validated: true, help: "trigger: flow — completed | failed | blocked | any" },
     { key: "signature", type: "string", validated: true, help: "github | stripe | slack | hmac" },
-    { key: "signing_secret", type: "string", help: "the secret a webhook's signature is checked with" },
+    { key: "signing_secret", type: "string", help: "the NAME of the vault secret a webhook's signature is checked with — never the value" },
     { key: "after", type: ["string", "list"], help: "trigger: flow — the flow this one follows" },
     { key: "at", type: "string", help: "trigger: once — when" },
     { key: "url", type: "string", help: "trigger: watch — the page watched" },
@@ -127,6 +128,7 @@ const FLOW = [
     { key: "budget", type: ["number", "string"], help: "USD per run" },
     { key: "compute", type: "object", help: "{vcpu, memory, disk} one run's steps may hold together at once — only narrows the workspace's and account's" },
     { key: "live", type: "boolean", help: "true: steps may act for real in a test run" },
+    { key: "a2a", type: "object", help: "serve this flow to outside agents over A2A 1.0 — {publish: true, name?, description?, examples?, public_card?, input?}; changing it needs workspace:manage" },
 ];
 const TOOL = [
     { key: "name", type: "string", help: "defaults to the file or folder name" },

package/dist/src/frontmatter-schema.d.ts

@@ -2,7 +2,7 @@ import { type SchemaKind } from "./frontmatter-fields.ts";
 export { FRONTMATTER, schemaKindOf, type FieldSpec, type FieldType, type SchemaKind } from "./frontmatter-fields.ts";
 export interface FieldProblem {
     key: string;
-    rule: "config/unknown-field" | "config/wrong-type" | "config/invalid-value" | "config/missing-field" | "config/conflict" | "config/misplaced";
+    rule: "config/unknown-field" | "config/wrong-type" | "config/invalid-value" | "config/missing-field" | "config/conflict" | "config/misplaced" | "config/cron-never-fires" | "secret/signing-secret-value";
     level: "error" | "warn" | "info";
     message: string;
 }
@@ -13,3 +13,7 @@ export interface FieldProblem {
  * `near` is the typo matcher; scan.ts passes its own.
  */
 export declare function frontmatterProblems(kind: SchemaKind, data: Record<string, unknown>, near: (key: string, known: readonly string[]) => string | null): FieldProblem[];
+/** Why a `signing_secret:` value is not a vault secret's name, or null. The
+ *  runtime reads `NAME` and `${NAME}` alike (notify.ts, store.ts). Never
+ *  says what the value is: it may be the secret itself. */
+export declare function signingSecretProblem(v: unknown): string | null;

package/dist/src/frontmatter-schema.js

@@ -5,9 +5,12 @@ import { FRONTMATTER, JOBS } from "./frontmatter-fields.js";
 import { jobFold } from "./matter.js";
 import { resolveEffort, parseDuration, parseInstant, parseRate, STEP_OPTION_KEYS } from "./store.js";
 import { budgetProblem } from "./budget.js";
-import { cronProblem } from "./cron.js";
+import { cronProblem, parseCron, cronCanFire } from "./cron.js";
+import { SECRET_NAME } from "./secrets.js";
 import { modelSecretCollision } from "./model-credential.js";
 import { resourcesProblem, computeProblem } from "./resources.js";
+import { remotesProblem } from "./a2a-remotes.js";
+import { a2aPublishProblem } from "./a2a-publish.js";
 export { FRONTMATTER, schemaKindOf } from "./frontmatter-fields.js";
 /** A value for a message: a scalar as written, anything else by its shape.
  *  Never String() of a map — its `toString` is whatever the YAML says. */
@@ -30,6 +33,7 @@ const CHECKS = {
     "agent": {
         effort: (v) => (resolveEffort(v) ? null : `"${String(v)}" is not an effort — low, medium, high, xhigh or max; the step runs at the model's default`),
         apis: apisProblem,
+        remotes: remotesProblem,
         budget: (v) => budgetProblem(v, ["run"]),
         ask: (v) => askProblem(v),
         resources: resourcesProblem,
@@ -54,6 +58,7 @@ const CHECKS = {
         pause_when: (v) => (String(v).length <= 60 ? null : "is longer than 60 characters"),
         budget: (v) => budgetProblem(v, ["run"]),
         compute: computeProblem,
+        a2a: a2aPublishProblem,
     },
     "tool": {
         transport: (v) => (["http", "script", "mcp"].includes(String(v).toLowerCase()) ? null : `"${String(v)}" is not a transport — http, script or mcp`),
@@ -163,11 +168,49 @@ export function frontmatterProblems(kind, data, near) {
         if (why)
             out.push({ key, rule: "config/invalid-value", level: "warn", message: `\`${key}:\` ${why.replace(/^\w+: /, "")}` });
     }
+    // A cron every field of which is in range, on a day no month has —
+    // `0 0 30 2 *`. The scheduler's own cronCanFire decides (30 Oct 2026), so
+    // check and the scheduler say the same about it: it never fires.
+    if (kind === "flow" && typeof data.schedule === "string") {
+        const cron = parseCron(data.schedule);
+        if (cron && !cronCanFire(cron)) {
+            out.push({ key: "schedule", rule: "config/cron-never-fires", level: "warn", message: `\`schedule: "${data.schedule}"\` names a day no month it allows has — the flow never fires. Pick a day every named month has, or add a weekday` });
+        }
+    }
+    // A signing secret is the NAME of a vault entry (30 Oct 2026): a flow's
+    // `signing_secret:` and notify's `signing_secret:` are looked up with
+    // getSecret, so a literal value there is a secret written into a
+    // versioned, deployed file — and never matches anything in the vault.
+    // The message never repeats the value.
+    if (kind === "flow" && data.signing_secret !== undefined) {
+        const why = signingSecretProblem(data.signing_secret);
+        if (why)
+            out.push({ key: "signing_secret", rule: "secret/signing-secret-value", level: "warn", message: `\`signing_secret:\` ${why}` });
+    }
+    if (kind === "agents-md" && data.notify && typeof data.notify === "object" && !Array.isArray(data.notify)) {
+        const raw = data.notify.signing_secret;
+        const why = raw === undefined ? null : signingSecretProblem(raw);
+        if (why)
+            out.push({ key: "notify", rule: "secret/signing-secret-value", level: "warn", message: `\`notify: signing_secret:\` ${why}` });
+    }
     if (kind === "skill" && !(typeof data.description === "string" && data.description.trim())) {
         out.push({ key: "description", rule: "config/missing-field", level: "warn", message: "no `description:` — a skill without one is never loaded; the model chooses a skill by it" });
     }
     return out;
 }
+/** Why a `signing_secret:` value is not a vault secret's name, or null. The
+ *  runtime reads `NAME` and `${NAME}` alike (notify.ts, store.ts). Never
+ *  says what the value is: it may be the secret itself. */
+export function signingSecretProblem(v) {
+    if (typeof v !== "string")
+        return null; // config/wrong-type says so
+    const name = v.trim().replace(/^\$\{|\}$/g, "");
+    if (!name)
+        return null;
+    return SECRET_NAME.test(name)
+        ? null
+        : "holds something that is not a secret's name (UPPER_SNAKE_CASE, like WEBHOOK_SIGNING_KEY) — it is looked up in the vault by name, so a value written here is never found, and is deployed and versioned in plain text. Put the value in the vault (`foldrun secrets set NAME`), write the name here, and rotate it";
+}
 function askProblem(v) {
     const t = v?.timeout;
     return t === undefined ? null : DURATION(30, 86400, "30s to 24h")(t);

package/dist/src/limits.js

@@ -5,6 +5,8 @@
 //     web.search: 40      # one action of the web tool
 //     web: 150            # every web action together
 //     crm: 20             # an API, script or MCP tool, by the name it is granted as
+//     a2a: 10             # messages to outside agents (a2a_send and a2a_reply)
+//     a2a.status: 30      # polls of them, apart from the sends
 //     calls: 300          # every tool call in the step, whatever the tool
 //     repeat: 5           # the same call — one tool, the same input — at most this often
 //
@@ -21,6 +23,7 @@
 import crypto from "node:crypto";
 import { WEB_ACTIONS } from "./providers.js";
 import { DELEGATE_TOOLS } from "./subagents.js";
+import { A2A_SERVER, A2A_LIMIT_KEY, A2A_LIMIT_ACTIONS } from "./a2a-remotes.js";
 /** The key that caps every call in the step. */
 export const TOTAL_KEY = "calls";
 /** The key that caps one identical call: a model asking the same tool the
@@ -96,8 +99,11 @@ export function readLimits(raw, where = "limits") {
         }
         if (k.includes(".")) {
             const [head, action] = k.split(".");
-            if (head !== "web" || !WEB_ACTIONS.includes(action)) {
-                problems.push(`${where}: "${k}" is not a key — the dotted keys are web.<action>: ${WEB_ACTIONS.map((a) => `web.${a}`).join(", ")}.`);
+            const web = head === "web" && WEB_ACTIONS.includes(action);
+            const a2a = head === A2A_LIMIT_KEY && A2A_LIMIT_ACTIONS.includes(action);
+            if (!web && !a2a) {
+                problems.push(`${where}: "${k}" is not a key — the dotted keys are web.<action>: ${WEB_ACTIONS.map((a) => `web.${a}`).join(", ")}, ` +
+                    `and ${A2A_LIMIT_ACTIONS.map((a) => `${A2A_LIMIT_KEY}.${a}`).join(", ")}.`);
                 continue;
             }
         }
@@ -166,6 +172,16 @@ export function limitKeysFor(toolName, input, owners = {}) {
     }
     if (DELEGATE_TOOLS.includes(toolName))
         return keys;
+    // remotes: — a message to an outside agent (a2a_send, a2a_reply) counts
+    // under `a2a`; every tool also under its own `a2a.<action>`, so polling
+    // (`a2a.status`) is capped apart from sending.
+    const a2a = new RegExp(`^mcp__${A2A_SERVER}__a2a_([a-z]+)$`).exec(toolName);
+    if (a2a) {
+        if (a2a[1] === "send" || a2a[1] === "reply")
+            keys.push(A2A_LIMIT_KEY);
+        keys.push(`${A2A_LIMIT_KEY}.${a2a[1]}`);
+        return keys;
+    }
     const owner = owners[toolName];
     const mcp = /^mcp__(.+?)__(.+)$/.exec(toolName);
     const name = owner
@@ -263,7 +279,7 @@ export class CallCounter {
  */
 export function limitKeyProblems(limits, ctx) {
     const out = [];
-    const builtinKeys = ["read", "write", "code", ...Object.keys(BUILTIN_GROUP), "TodoWrite", "search", "history", "desks", "ask", "web"];
+    const builtinKeys = ["read", "write", "code", ...Object.keys(BUILTIN_GROUP), "TodoWrite", "search", "history", "desks", "ask", "web", A2A_LIMIT_KEY];
     const known = new Set([...builtinKeys, ...ctx.known].map(normKey));
     const granted = new Set([...ctx.granted].flatMap((g) => {
         const n = normKey(g);
@@ -281,10 +297,12 @@ export function limitKeyProblems(limits, ctx) {
     for (const key of Object.keys(limits)) {
         if (key === TOTAL_KEY || key === REPEAT_KEY)
             continue;
-        const base = key.startsWith("web.") ? "web" : key;
+        const base = key.startsWith("web.") ? "web" : key.startsWith(`${A2A_LIMIT_KEY}.`) ? A2A_LIMIT_KEY : key;
         const n = normKey(base);
         if (!known.has(n)) {
             const valid = [TOTAL_KEY, "web", ...WEB_ACTIONS.map((a) => `web.${a}`), ...[...new Set([...ctx.granted].map(String))].filter((g) => g !== "web")];
+            if ([...ctx.granted].map(String).includes(A2A_LIMIT_KEY))
+                valid.push(...A2A_LIMIT_ACTIONS.map((a) => `${A2A_LIMIT_KEY}.${a}`));
             out.push({ level: "error", message: `limits: ${key} — not a tool this agent could call. The keys: ${[...new Set(valid)].join(", ")}.` });
         }
         else if (!granted.has(n)) {

package/dist/src/notify.d.ts

@@ -15,8 +15,11 @@ export declare function platformMail(tenant: string): {
     key: string;
     from: string;
 } | null;
-/** The account's own Resend key and sender, or null when it has none. */
-export declare function accountMail(tenant: string): {
+/** The account's own Resend key and sender, or null when it has none.
+ *  With a workspace — mail a workspace's run causes — an account key or
+ *  sender limited to other workspaces is not used (30 Oct 2026); the
+ *  account's own mail (resets, invites) names none and is not limited. */
+export declare function accountMail(tenant: string, workspace?: string): {
     key: string;
     from: string;
 } | null;
@@ -30,7 +33,7 @@ export declare function accountMail(tenant: string): {
  * owner's bin. The platform's key is the fallback for an account that set
  * none, so `notify:` works before anyone has configured mail at all.
  */
-export declare function notifyMail(tenant: string): {
+export declare function notifyMail(tenant: string, workspace?: string): {
     key: string;
     from: string;
 } | null;