@fungi.computer/braid 0.0.0-stage → 0.0.1

package/dist/ports.js

@@ -0,0 +1,256 @@
+import * as S from "effect/Schema";
+import { Validator, escapePointer, format } from "@cfworker/json-schema";
+const portSchema = S.Struct({
+    type: S.optionalKey(S.Literals([
+        "string",
+        "number",
+        "integer",
+        "boolean",
+        "array",
+        "object",
+        "null",
+    ])),
+    format: S.optionalKey(S.String.pipe(S.check(S.makeFilter((value) => Object.hasOwn(format, value) ||
+        value === "fungi:image" ||
+        value === "fungi:video" ||
+        value === "fungi:file")))),
+    title: S.optionalKey(S.String),
+    description: S.optionalKey(S.String),
+    const: S.optionalKey(S.Json),
+    default: S.optionalKey(S.Json),
+    pattern: S.optionalKey(S.String),
+    anyOf: S.optionalKey(S.mutable(S.Array(S.suspend(() => portSchema))).pipe(S.check(S.isMinLength(1)))),
+    oneOf: S.optionalKey(S.mutable(S.Array(S.suspend(() => portSchema))).pipe(S.check(S.isMinLength(1)))),
+    enum: S.optionalKey(S.mutable(S.Array(S.Json)).pipe(S.check(S.isMinLength(1)), S.check(S.makeFilter((values) => new Set(values.map((value) => JSON.stringify(value))).size ===
+        values.length)))),
+    properties: S.optionalKey(S.Record(S.String, S.suspend(() => portSchema))),
+    required: S.optionalKey(S.mutable(S.Array(S.String)).pipe(S.check(S.makeFilter((values) => new Set(values).size === values.length)))),
+    additionalProperties: S.optionalKey(S.Boolean),
+    items: S.optionalKey(S.suspend(() => portSchema)),
+    minItems: S.optionalKey(S.Number.pipe(S.check(S.isInt()), S.check(S.isGreaterThanOrEqualTo(0)))),
+    maxItems: S.optionalKey(S.Number.pipe(S.check(S.isInt()), S.check(S.isGreaterThanOrEqualTo(0)))),
+    minLength: S.optionalKey(S.Number.pipe(S.check(S.isInt()), S.check(S.isGreaterThanOrEqualTo(0)))),
+    maxLength: S.optionalKey(S.Number.pipe(S.check(S.isInt()), S.check(S.isGreaterThanOrEqualTo(0)))),
+    minimum: S.optionalKey(S.Number),
+    maximum: S.optionalKey(S.Number),
+    exclusiveMinimum: S.optionalKey(S.Number),
+    exclusiveMaximum: S.optionalKey(S.Number),
+});
+/** Effect owns the supported schema grammar; the Workers-safe validator owns instance validation. */
+export function parseProjection(value) {
+    const parsed = S.decodeUnknownSync(portSchema)(value, {
+        onExcessProperty: "error",
+    });
+    return parsed;
+}
+export function accepts(schema, value) {
+    return new Validator(schema, "7").validate(value).valid;
+}
+/** Defaults fill absent properties; explicit values still have to validate. */
+function defaultRunValue(schema, value) {
+    const items = schema.items;
+    if (S.is(S.Array(S.Json))(value) && items)
+        return value.map((item) => defaultRunValue(items, item));
+    const properties = schema.properties;
+    if (!S.is(S.JsonObject)(value) || !properties)
+        return value;
+    const entries = new Map();
+    for (const [key, item] of Object.entries(value))
+        entries.set(key, defaultRunValue(properties[key] ?? {}, item));
+    for (const [key, property] of Object.entries(properties))
+        if (!Object.hasOwn(value, key) && property.default !== undefined)
+            entries.set(key, defaultRunValue(property, property.default));
+    return S.decodeUnknownSync(S.JsonObject)(Object.fromEntries(entries));
+}
+/** Every run source uses the same supported projection and instance validator. */
+export function admitRunInput(definition, raw) {
+    const schema = parseProjection(definition.input);
+    const input = defaultRunValue(schema, raw);
+    if (!S.is(S.JsonObject)(input))
+        return {
+            kind: "invalid",
+            issues: [
+                {
+                    code: "invalid_input",
+                    path: "",
+                    message: "Run input must be an object",
+                },
+            ],
+        };
+    const result = new Validator(schema, "7").validate(input);
+    return result.valid
+        ? { kind: "accepted", input }
+        : {
+            kind: "invalid",
+            issues: result.errors.map((error) => ({
+                code: "invalid_input",
+                path: error.instanceLocation,
+                message: error.error,
+            })),
+        };
+}
+export function ports(schema) {
+    return schema.properties ?? {};
+}
+/** Only guaranteed object paths have a static type. The library owns Pointer spelling. */
+export function portProjection(schema, path = "") {
+    if (schema === undefined)
+        return undefined;
+    if (path === "")
+        return schema;
+    const branches = schema.anyOf ?? schema.oneOf;
+    if (branches) {
+        const projections = branches.map((branch) => portProjection(branch, path));
+        return projections.every((part) => part !== undefined)
+            ? { anyOf: projections }
+            : undefined;
+    }
+    const found = new Map();
+    const index = (part, at) => {
+        found.set(at, part);
+        for (const key of part.required ?? []) {
+            const child = part.properties && Object.hasOwn(part.properties, key)
+                ? part.properties[key]
+                : undefined;
+            if (child)
+                index(child, `${at}/${escapePointer(key)}`);
+        }
+    };
+    index(schema, "");
+    return found.get(path);
+}
+/** A method receives its declared value; only the graph-facing view wraps scalars and unions. */
+export function methodInputPorts(schema) {
+    return schema.type === "object" && !schema.anyOf && !schema.oneOf
+        ? schema
+        : {
+            type: "object",
+            properties: { value: schema },
+            required: ["value"],
+            additionalProperties: false,
+        };
+}
+function completionBranches(schema) {
+    const union = schema.anyOf ?? schema.oneOf;
+    // Flatten only a union without sibling assertions; keep every declared constraint.
+    return union &&
+        Object.keys(schema).every((key) => ["anyOf", "oneOf", "title", "description"].includes(key))
+        ? union.flatMap(completionBranches)
+        : [schema];
+}
+function completionOutlets(schema) {
+    if (!schema.anyOf && !schema.oneOf)
+        return undefined;
+    const branches = completionBranches(schema);
+    const refused = branches.filter((part) => part.type === "object" && part.required?.includes("error"));
+    const ok = branches.filter((part) => !refused.includes(part));
+    if (!ok.length || !refused.length)
+        return undefined;
+    const union = (parts) => parts.length === 1 ? (parts[0] ?? {}) : { anyOf: [...parts] };
+    return { ok: union(ok), refused: union(refused) };
+}
+/** Declared error-object unions expose whole completion records on mutually exclusive outlets. */
+export function methodOutputPorts(schema) {
+    return completionOutlets(schema) ?? ports(methodInputPorts(schema));
+}
+export function methodInputValue(schema, values) {
+    return methodInputPorts(schema) === schema ? values : values.value;
+}
+export function methodOutputValues(schema, value) {
+    if (!accepts(schema, value))
+        return undefined;
+    const outlets = completionOutlets(schema);
+    if (outlets)
+        return accepts(outlets.refused, value) ? { refused: value } : { ok: value };
+    if (methodInputPorts(schema) !== schema)
+        return { value };
+    if (!S.is(S.JsonObject)(value))
+        return undefined;
+    return Object.fromEntries(Object.entries(value).filter(([key]) => Object.hasOwn(ports(schema), key)));
+}
+export function portKind(schema) {
+    if (schema.format === "fungi:image" ||
+        schema.format === "fungi:video" ||
+        schema.format === "fungi:file")
+        return schema.format;
+    switch (schema.type) {
+        case "string":
+            return "text";
+        case "integer":
+        case "number":
+            return "number";
+        case "boolean":
+            return "bool";
+        case "array":
+            return { list: portKind(schema.items ?? {}) };
+        case "object":
+            return "object";
+        case "null":
+            return "null";
+        default:
+            return "any";
+    }
+}
+/** Sound subset check, not a claim to decide arbitrary JSON Schema implication. */
+export function assignable(source, target) {
+    if (source.anyOf || source.oneOf)
+        // Ignoring source siblings widens the proof obligation, never the accepted values.
+        return (source.anyOf ?? source.oneOf ?? []).every((part) => assignable(part, target));
+    if (target.format && source.format !== target.format)
+        return false;
+    if (target.type === "string" &&
+        (source.format === "fungi:image" ||
+            source.format === "fungi:video" ||
+            source.format === "fungi:file") &&
+        source.format !== target.format)
+        return false;
+    // Literal values are decided by the maintained instance validator, including ranges and patterns.
+    if (source.const !== undefined)
+        return accepts(target, source.const);
+    if (source.enum)
+        return source.enum.every((value) => accepts(target, value));
+    if (target.oneOf)
+        return JSON.stringify(source) === JSON.stringify(target);
+    if (target.anyOf) {
+        const { anyOf, ...constraints } = target;
+        return (assignable(source, constraints) &&
+            anyOf.some((part) => assignable(source, part)));
+    }
+    if (target.const !== undefined || target.enum)
+        return false;
+    if (target.pattern && source.pattern !== target.pattern)
+        return false;
+    for (const key of ["exclusiveMinimum", "exclusiveMaximum"])
+        if (target[key] !== undefined && source[key] !== target[key])
+            return false;
+    if (target.type &&
+        source.type !== target.type &&
+        !(source.type === "integer" && target.type === "number"))
+        return false;
+    for (const key of ["minimum", "minLength", "minItems"])
+        if (target[key] !== undefined &&
+            (source[key] === undefined || source[key] < target[key]))
+            return false;
+    for (const key of ["maximum", "maxLength", "maxItems"])
+        if (target[key] !== undefined &&
+            (source[key] === undefined || source[key] > target[key]))
+            return false;
+    if (target.items && !assignable(source.items ?? {}, target.items))
+        return false;
+    for (const key of target.required ?? [])
+        if (!source.required?.includes(key))
+            return false;
+    const src = ports(source);
+    for (const [key, wanted] of Object.entries(ports(target))) {
+        const supplied = src[key];
+        if (supplied
+            ? !assignable(supplied, wanted)
+            : source.additionalProperties !== false)
+            return false;
+    }
+    if (target.additionalProperties === false &&
+        (source.additionalProperties !== false ||
+            Object.keys(src).some((key) => !Object.hasOwn(ports(target), key))))
+        return false;
+    return true;
+}

package/dist/runtime/arming-authority.d.ts

@@ -0,0 +1,83 @@
+import { z } from "zod";
+import type { WorkflowRunMember } from "./run-authority.js";
+/** Host-captured provenance from the actual connector or approved-policy owner. */
+export declare const workflowArmedViaSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"connector">;
+    agentId: z.ZodString;
+    attachmentId: z.ZodString;
+    attachmentVersion: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"policy">;
+    agentId: z.ZodString;
+    policyRevision: z.ZodString;
+    grantorMemberId: z.ZodString;
+}, z.core.$strict>], "kind">;
+/** Provenance from the actual connector or approved-policy owner. */
+export type WorkflowArmedVia = z.output<typeof workflowArmedViaSchema>;
+/** The grantor stays the armer; decoding this shape alone grants no authority. */
+export declare const workflowArmingReceiptSchema: z.ZodObject<{
+    armedBy: z.ZodString;
+    armedVia: z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"connector">;
+        agentId: z.ZodString;
+        attachmentId: z.ZodString;
+        attachmentVersion: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"policy">;
+        agentId: z.ZodString;
+        policyRevision: z.ZodString;
+        grantorMemberId: z.ZodString;
+    }, z.core.$strict>], "kind">>;
+    grantorMembershipVersion: z.ZodNumber;
+}, z.core.$strict>;
+/** Captured by a host after current frame, installation and member admission. */
+export type WorkflowArmingReceipt = z.output<typeof workflowArmingReceiptSchema>;
+/** Current host-owner readback, after live grantor and approval checks. */
+export declare const workflowArmingAccessSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"connector">;
+    agentId: z.ZodString;
+    attachmentId: z.ZodString;
+    attachmentVersion: z.ZodNumber;
+    grantorMemberId: z.ZodString;
+    level: z.ZodEnum<{
+        write: "write";
+        read: "read";
+    }>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"policy">;
+    agentId: z.ZodString;
+    policyRevision: z.ZodString;
+    grantorMemberId: z.ZodString;
+    level: z.ZodEnum<{
+        write: "write";
+        read: "read";
+    }>;
+}, z.core.$strict>], "kind">;
+/** The actual source identity plus its currently approved access level. */
+export type WorkflowArmingAccess = z.output<typeof workflowArmingAccessSchema>;
+/** Lookup keys exclude captured versions, revisions and grantors. */
+export type WorkflowArmingLookup = Readonly<{
+    kind: "connector";
+    agentId: string;
+    attachmentId: string;
+}> | Readonly<{
+    kind: "policy";
+    agentId: string;
+}>;
+/** The host reader obtains approval, revision and grantor from its current owner row. */
+export type WorkflowArmingAuthorityPorts = Readonly<{
+    member(memberId: string): Promise<WorkflowRunMember | null>;
+    readAgentAccess(lookup: WorkflowArmingLookup): Promise<WorkflowArmingAccess | null>;
+}>;
+/** Trusted result produced by the authority functions, never decoded from caller JSON. */
+export type WorkflowArmingAdmission = Readonly<{
+    kind: "admitted";
+    receipt: WorkflowArmingReceipt;
+}> | Readonly<{
+    kind: "refused";
+    code: "not_granted" | "revoked";
+}>;
+/** Recheck Agent authority only; the host also admits member, Computer and installation grants. */
+export declare function recheckWorkflowArming(receipt: WorkflowArmingReceipt, ports: WorkflowArmingAuthorityPorts): Promise<WorkflowArmingAdmission>;
+/** Capture the version from the host's actual member owner, never a frame or tool argument. */
+export declare function captureWorkflowArming(source: Pick<WorkflowArmingReceipt, "armedBy" | "armedVia">, ports: WorkflowArmingAuthorityPorts): Promise<WorkflowArmingAdmission>;

package/dist/runtime/arming-authority.js

@@ -0,0 +1,90 @@
+import { z } from "zod";
+import { decodeWorkflowRunMember } from "./run-member.js";
+const identity = z.string().min(1).max(256);
+const membershipVersion = z.number().int().nonnegative();
+const connector = z.strictObject({
+    kind: z.literal("connector"),
+    agentId: identity,
+    attachmentId: identity,
+    attachmentVersion: z.number().int().positive(),
+});
+const policy = z.strictObject({
+    kind: z.literal("policy"),
+    agentId: identity,
+    // The approved policy revision is opaque, nonempty and bounded.
+    policyRevision: identity,
+    grantorMemberId: identity,
+});
+/** Host-captured provenance from the actual connector or approved-policy owner. */
+export const workflowArmedViaSchema = z.discriminatedUnion("kind", [
+    connector,
+    policy,
+]);
+/** The grantor stays the armer; decoding this shape alone grants no authority. */
+export const workflowArmingReceiptSchema = z
+    .strictObject({
+    armedBy: identity,
+    /** A human arm has an explicit null; Agent arms retain their actual live source. */
+    armedVia: workflowArmedViaSchema.nullable(),
+    grantorMembershipVersion: membershipVersion,
+})
+    .superRefine((receipt, context) => {
+    if (receipt.armedVia?.kind === "policy" &&
+        receipt.armedVia.grantorMemberId !== receipt.armedBy)
+        context.addIssue({
+            code: "custom",
+            path: ["armedVia", "grantorMemberId"],
+            message: "The approved policy grantor must be the armer",
+        });
+});
+/** Current host-owner readback, after live grantor and approval checks. */
+export const workflowArmingAccessSchema = z.discriminatedUnion("kind", [
+    connector.extend({
+        grantorMemberId: identity,
+        level: z.enum(["read", "write"]),
+    }),
+    policy.extend({ level: z.enum(["read", "write"]) }),
+]);
+/** Recheck Agent authority only; the host also admits member, Computer and installation grants. */
+export async function recheckWorkflowArming(receipt, ports) {
+    const captured = workflowArmingReceiptSchema.safeParse(receipt);
+    if (!captured.success)
+        return { kind: "refused", code: "not_granted" };
+    const before = decodeWorkflowRunMember(await ports.member(captured.data.armedBy));
+    if (before?.membershipVersion !== captured.data.grantorMembershipVersion)
+        return { kind: "refused", code: "revoked" };
+    const via = captured.data.armedVia;
+    if (via === null)
+        return { kind: "admitted", receipt: captured.data };
+    const lookup = via.kind === "connector"
+        ? {
+            kind: "connector",
+            agentId: via.agentId,
+            attachmentId: via.attachmentId,
+        }
+        : { kind: "policy", agentId: via.agentId };
+    const current = workflowArmingAccessSchema.safeParse(await ports.readAgentAccess(lookup));
+    if (!current.success ||
+        current.data.level !== "write" ||
+        current.data.agentId !== via.agentId ||
+        current.data.grantorMemberId !== captured.data.armedBy)
+        return { kind: "refused", code: "revoked" };
+    const unchanged = via.kind === "connector"
+        ? current.data.kind === "connector" &&
+            current.data.attachmentId === via.attachmentId &&
+            current.data.attachmentVersion === via.attachmentVersion
+        : current.data.kind === "policy" &&
+            current.data.policyRevision === via.policyRevision;
+    const after = decodeWorkflowRunMember(await ports.member(captured.data.armedBy));
+    return unchanged &&
+        after?.membershipVersion === captured.data.grantorMembershipVersion
+        ? { kind: "admitted", receipt: captured.data }
+        : { kind: "refused", code: "revoked" };
+}
+/** Capture the version from the host's actual member owner, never a frame or tool argument. */
+export async function captureWorkflowArming(source, ports) {
+    const current = decodeWorkflowRunMember(await ports.member(source.armedBy));
+    if (current === null)
+        return { kind: "refused", code: "not_granted" };
+    return recheckWorkflowArming({ ...source, grantorMembershipVersion: current.membershipVersion }, ports);
+}

package/dist/runtime/bindings.d.ts

@@ -0,0 +1,25 @@
+import type { Issue, WorkflowDefinition } from "../index.js";
+import type { WorkflowCatalogEntry } from "./ports.js";
+/** Declared App references that require a current human-visible installation. */
+export type WorkflowBindingRequest = Readonly<{
+    name: string;
+    appId: string;
+    reason: "missing" | "ambiguous";
+}>;
+export type WorkflowBindingsResolution = Readonly<{
+    kind: "bound";
+    bindings: Readonly<Record<string, string>>;
+}> | Readonly<{
+    kind: "needs-binding";
+    bindings: readonly WorkflowBindingRequest[];
+}> | Readonly<{
+    kind: "invalid";
+    issues: readonly Issue[];
+}>;
+export type CatalogInstallation = Pick<WorkflowCatalogEntry, "installationId" | "appId">;
+/**
+ * Resolve parsed Workflow references against the starting human's live catalog.
+ * An explicit choice must still be visible and match the declared App. Omitted
+ * choices use only a unique current match; no saved installation defaults apply.
+ */
+export declare function resolveWorkflowBindings(definition: Pick<WorkflowDefinition, "apps">, requested: Readonly<Record<string, string>> | undefined, catalog: readonly CatalogInstallation[]): WorkflowBindingsResolution;

package/dist/runtime/bindings.js

@@ -0,0 +1,41 @@
+function resolveInstallation(appId, explicit, catalog) {
+    const matches = catalog.filter((entry) => entry.appId === appId);
+    if (explicit !== undefined)
+        return matches.some((entry) => entry.installationId === explicit)
+            ? { installationId: explicit }
+            : { reason: "missing" };
+    const unique = matches.length === 1 ? matches[0] : undefined;
+    return unique !== undefined
+        ? { installationId: unique.installationId }
+        : { reason: matches.length === 0 ? "missing" : "ambiguous" };
+}
+/**
+ * Resolve parsed Workflow references against the starting human's live catalog.
+ * An explicit choice must still be visible and match the declared App. Omitted
+ * choices use only a unique current match; no saved installation defaults apply.
+ */
+export function resolveWorkflowBindings(definition, requested, catalog) {
+    for (const name of Object.keys(requested ?? {})) {
+        if (!Object.hasOwn(definition.apps, name))
+            return {
+                kind: "invalid",
+                issues: [{ code: "binding", message: `Unknown App binding: ${name}` }],
+            };
+    }
+    const selected = [];
+    const needed = [];
+    for (const [name, spec] of Object.entries(definition.apps)) {
+        const resolved = resolveInstallation(spec.appId, requested?.[name], catalog);
+        if ("installationId" in resolved)
+            selected.push([name, resolved.installationId]);
+        else
+            needed.push({
+                name,
+                appId: spec.appId,
+                reason: resolved.reason,
+            });
+    }
+    return needed.length === 0
+        ? { kind: "bound", bindings: Object.fromEntries(selected) }
+        : { kind: "needs-binding", bindings: needed };
+}

package/dist/runtime/capture.d.ts

@@ -0,0 +1,18 @@
+import type { RepositoryRef } from "@fungi.computer/agar/git";
+import type { HostActor } from "@fungi.computer/puffball/app-method-runtime";
+import { type WorkflowNodeTarget, type WorkflowNodeCeiling } from "./graph-dispatch.js";
+import { type RunCeiling } from "./run-ceiling.js";
+import type { WorkflowRunAuthorityPorts, WorkflowRunMember } from "./run-authority.js";
+/** Same Computer-bound requirements as live Workflow App admission. */
+export declare function workflowMethodRequiresComputer(requires: RunCeiling["nodes"][number]["capabilities"]): boolean;
+/** Hosts provide their existing live human admission, never the compiled catalog as a grant. */
+export type WorkflowCeilingCapturePorts = Readonly<{
+    node(actor: Extract<HostActor, {
+        kind: "member";
+    }>, member: WorkflowRunMember, target: WorkflowNodeTarget): Promise<WorkflowNodeCeiling | null>;
+    git(actor: Extract<HostActor, {
+        kind: "member";
+    }>, member: WorkflowRunMember, repository: RepositoryRef, scope: "read" | "write"): Promise<boolean>;
+}>;
+/** Assemble the start ceiling from real host admissions; minting and invocation stay outside capture. */
+export declare function createWorkflowCeilingCapture(ports: WorkflowCeilingCapturePorts): WorkflowRunAuthorityPorts["capture"];

package/dist/runtime/capture.js

@@ -0,0 +1,99 @@
+import * as S from "effect/Schema";
+import * as Option from "effect/Option";
+import { appBackendBindingOperation, scopeOperationToMethod, appBackendBindingsSchema, appCapabilityIdSchema, } from "@fungi.computer/puffball/app";
+import { gitAccessScope, resolveGitAccess } from "../git-access.js";
+import { resolveWorkflowNodeTarget, workflowNodeWithinCeiling, } from "./graph-dispatch.js";
+import { runCeilingSchema } from "./run-ceiling.js";
+/** Same Computer-bound requirements as live Workflow App admission. */
+export function workflowMethodRequiresComputer(requires) {
+    return requires.some((capability) => capability === "computer.list" ||
+        capability === "computer.readFile" ||
+        capability === "computer.writeFile" ||
+        capability === "computer.execute" ||
+        capability === "media.generation");
+}
+/** Assemble the start ceiling from real host admissions; minting and invocation stay outside capture. */
+export function createWorkflowCeilingCapture(ports) {
+    return async (preparation, actor, member) => {
+        const initiator = preparation.initiatedBy;
+        const human = initiator.kind === "member"
+            ? initiator.memberId
+            : initiator.grantorMemberId;
+        if (actor.memberId !== human)
+            return null;
+        const nodes = [];
+        const nodeGitAccess = [];
+        const captureGraph = async (graphId, graphNodes) => {
+            for (const node of graphNodes) {
+                if (node.kind !== "app")
+                    continue;
+                const binding = preparation.plan.bindings[node.app];
+                if (binding === undefined || !("installationId" in binding))
+                    return false;
+                const coordinates = graphId === undefined
+                    ? { nodeId: node.id }
+                    : { nodeId: node.id, graphId };
+                const resolved = resolveWorkflowNodeTarget(preparation, {
+                    ...coordinates,
+                    installationId: binding.installationId,
+                    method: node.method,
+                });
+                if (resolved === null)
+                    return false;
+                const requires = S.decodeUnknownOption(S.Array(appCapabilityIdSchema))(resolved.method.requires);
+                if (Option.isNone(requires))
+                    return false;
+                if (preparation.computerId === null &&
+                    (workflowMethodRequiresComputer(requires.value) ||
+                        node.gitAccess !== undefined))
+                    return false;
+                const scopedMethod = {
+                    effect: resolved.method.effect,
+                    requires: requires.value,
+                };
+                const admitted = await ports.node(actor, member, resolved.target);
+                if (admitted === null ||
+                    !workflowNodeWithinCeiling(resolved.method, admitted))
+                    return false;
+                const level = resolved.method.effect === "read" ? "read" : admitted.level;
+                const bindings = S.decodeUnknownSync(appBackendBindingsSchema)(admitted.bindings
+                    .map((binding) => ({
+                    name: binding.name,
+                    operations: binding.operations.filter((name) => {
+                        const operation = appBackendBindingOperation(binding.name, name);
+                        return (operation !== undefined &&
+                            scopeOperationToMethod(operation, scopedMethod, level));
+                    }),
+                }))
+                    .filter((binding) => binding.operations.length > 0));
+                nodes.push({
+                    ...coordinates,
+                    level,
+                    capabilities: admitted.capabilities.filter((capability) => resolved.method.requires.includes(capability)),
+                    bindings,
+                });
+                if (node.gitAccess !== undefined) {
+                    const gitAccess = resolveGitAccess(preparation.plan.bindings, node.gitAccess, "triggerRepository" in preparation
+                        ? preparation.triggerRepository
+                        : undefined);
+                    // Read access never needs more than read, whatever the node's level.
+                    const scope = gitAccess === null || gitAccessScope(gitAccess) === "read"
+                        ? "read"
+                        : level;
+                    if (gitAccess === null ||
+                        !(await ports.git(actor, member, gitAccess.repository, scope)))
+                        return false;
+                    nodeGitAccess.push({ ...coordinates, gitAccess });
+                }
+            }
+            return true;
+        };
+        if (!(await captureGraph(undefined, preparation.plan.definition.nodes)))
+            return null;
+        for (const [graphId, graph] of Object.entries(preparation.plan.definition.subgraphs ?? {}))
+            if (!(await captureGraph(graphId, graph.nodes)))
+                return null;
+        const decoded = S.decodeUnknownOption(runCeilingSchema)({ nodes, nodeGitAccess }, { onExcessProperty: "error" });
+        return Option.isSome(decoded) ? decoded.value : null;
+    };
+}