@fungi.computer/braid 0.0.0-stage → 0.1.0

package/dist/runtime/run-owner.js

@@ -0,0 +1,513 @@
+import * as S from "effect/Schema";
+import * as Struct from "effect/Struct";
+import { nodeEventSchema, } from "../execution.js";
+import { z } from "zod";
+import { bindingsSelectionSchema, workflowBindingSchema, } from "../git-access.js";
+import { canonicalJson, contentDigest } from "../index.js";
+import { createTriggerPlans } from "./trigger-plans.js";
+import { preparationFromRun, } from "./run-authority.js";
+import { createTriggerRunReservations } from "./trigger-run-reservations.js";
+import { createGraphWorkflowRuns } from "./graph-run-store.js";
+import { graphRunSchema, graphTriggerProvenanceSchema, workflowRunContextSchema, } from "./graph-contract.js";
+import { resolveWorkflowNode, } from "./graph-dispatch.js";
+import { compileForMember, graphStartRequestSchema, memberRunIdentity, } from "./graph-start.js";
+/** The member can supply a plan, never stored authority or a captured ceiling. */
+export const memberCompiledGraphStartSchema = graphRunSchema.mapFields(Struct.omit([
+    "teamId",
+    "actorId",
+    "trigger",
+    "publication",
+    "ceiling",
+    "libraryInstallationId",
+    "source",
+    "initiatedBy",
+]));
+const publisherGranted = (entries, installationId) => entries.some((entry) => entry.installationId === installationId &&
+    entry.workflowPublishGranted === true &&
+    entry.capabilities?.includes("workflow.publish") === true);
+const workflowNodeTargetSchema = z.lazy(() => z.strictObject({
+    installationId: z.string().min(1).max(256),
+    method: z.string().min(1).max(256),
+}));
+/**
+ * The one Workflow run owner: graph runs, their captured authority, trigger
+ * reservations and revocation. Every run, Storyboard included, is a graph run.
+ */
+export function createTeamWorkflowRuns(options) {
+    const { sql } = options;
+    const graph = createGraphWorkflowRuns(options);
+    const triggerReservations = createTriggerRunReservations(options);
+    sql.exec(`CREATE TABLE IF NOT EXISTS hub_workflow_run_cleanups (
+    run_id TEXT PRIMARY KEY REFERENCES hub_graph_runs(run_id), computer_id TEXT NOT NULL,
+    acknowledged INTEGER NOT NULL DEFAULT 0 CHECK(acknowledged IN (0,1))
+  ) STRICT`);
+    const triggerPlans = createTriggerPlans(sql);
+    const admitGraphMember = async (memberId, computerId, delivery) => {
+        if (options.admission() !== "active")
+            throw options.errors.suspended();
+        await options.member(memberId);
+        if (computerId !== null &&
+            !(await options.memberComputer(memberId, computerId)))
+            throw options.errors.app("denied");
+        if (delivery !== undefined &&
+            !(await options.admitDelivery(memberId, delivery)))
+            throw options.errors.app("denied");
+    };
+    /** A report names its Workflows library, so only a library run may declare one. */
+    const requireDeliveryLibrary = (delivery, libraryInstallationId) => {
+        if (delivery !== undefined && libraryInstallationId === undefined)
+            throw options.errors.app("invalid");
+    };
+    const captureGraph = async (preparation) => {
+        if (options.admission() !== "active")
+            throw options.errors.suspended();
+        const admitted = await options.authority.resolve(preparation);
+        const memberId = preparation.initiatedBy.kind === "member"
+            ? preparation.initiatedBy.memberId
+            : preparation.initiatedBy.grantorMemberId;
+        if (admitted.kind !== "admitted" || admitted.actor.memberId !== memberId)
+            throw options.errors.app("denied");
+        if (options.admission() !== "active")
+            throw options.errors.suspended();
+        return admitted.ceiling;
+    };
+    const startCompiled = (preparation, request, identity, ceiling, trigger, publication, libraryInstallationId) => {
+        const memberId = preparation.initiatedBy.kind === "member"
+            ? preparation.initiatedBy.memberId
+            : preparation.initiatedBy.grantorMemberId;
+        let run = {
+            teamId: options.teamId(),
+            actorId: memberId,
+            runId: identity.runId,
+            requestId: identity.requestId,
+            computerId: preparation.computerId,
+            plan: preparation.plan,
+            input: request.input,
+            ceiling,
+            source: preparation.source,
+            initiatedBy: preparation.initiatedBy,
+        };
+        if (trigger !== undefined) {
+            const provenance = S.decodeUnknownSync(graphTriggerProvenanceSchema)(trigger, { onExcessProperty: "error" });
+            if (provenance.armedBy !== memberId)
+                throw options.errors.app("denied");
+            run = { ...run, trigger: provenance };
+        }
+        if (publication !== undefined)
+            run = { ...run, publication };
+        if (libraryInstallationId !== undefined)
+            run = { ...run, libraryInstallationId };
+        if (request.delivery !== undefined)
+            run = { ...run, delivery: request.delivery };
+        const result = graph.startCompiled(run);
+        return {
+            kind: result,
+            runId: identity.runId,
+            planDigest: preparation.plan.planDigest,
+        };
+    };
+    const terminalTriggerRun = (rawRunId, outcome = "terminal") => {
+        const runId = z.string().min(1).max(256).parse(rawRunId);
+        options.transactionSync(() => {
+            const run = graph.read(runId);
+            if (run === null)
+                return;
+            graph.markTerminal(runId, outcome);
+            triggerReservations.terminalTriggerRun(runId);
+            if (run.computerId !== null)
+                sql.exec("INSERT OR IGNORE INTO hub_workflow_run_cleanups(run_id,computer_id) VALUES(?,?)", runId, run.computerId);
+        });
+    };
+    /** Every Installation a stored run acts through: plan bindings and its library. */
+    const runInstallations = (run) => new Set([
+        ...Object.values(run.plan.bindings).map((binding) => "installationId" in binding ? binding.installationId : undefined),
+        run.libraryInstallationId,
+        run.publication?.installationId,
+        run.trigger?.libraryInstallationId,
+    ].filter((id) => id !== undefined));
+    /**
+     * Cancel matching active runs in one transaction: reviews close, trigger
+     * reservations settle and Computer cleanup is queued. Every later node
+     * admission, review answer and Git pass for the run then refuses.
+     */
+    const revoke = (matches) => {
+        const revoked = options.transactionSync(() => {
+            const runs = graph.active().filter(matches);
+            for (const run of runs)
+                terminalTriggerRun(run.runId, "cancelled");
+            return runs.length;
+        });
+        if (revoked > 0)
+            options.wake();
+    };
+    const workflowRunOutcome = (rawRunId) => graph.outcome(z.string().min(1).max(256).parse(rawRunId));
+    const admitWorkflowNode = (rawContext, rawTarget) => {
+        const context = S.decodeUnknownSync(workflowRunContextSchema)(rawContext, {
+            onExcessProperty: "error",
+        });
+        const target = workflowNodeTargetSchema.parse(rawTarget);
+        const run = graph.read(context.runId);
+        if (options.admission() !== "active" ||
+            run?.teamId !== options.teamId() ||
+            workflowRunOutcome(context.runId) !== "active")
+            return null;
+        const resolved = resolveWorkflowNode(run, { ...context, ...target });
+        if (resolved === null || !("workflowId" in resolved))
+            return null;
+        const { installationId, appId, method, methodDigest, computerId } = resolved;
+        // Host-only call metadata, including the captured ceiling, is not invocation context.
+        const storedContext = S.decodeUnknownSync(workflowRunContextSchema)(resolved);
+        if (canonicalJson(context) !== canonicalJson(storedContext))
+            return null;
+        const execution = graph
+            .events(run.runId)
+            .slice()
+            .reverse()
+            .find((event) => event.graphId === context.graphId &&
+            event.nodeId === context.nodeId &&
+            event.iteration === context.iteration);
+        if (execution?.state !== "running" || execution.poll !== context.poll)
+            return null;
+        return {
+            teamId: run.teamId,
+            memberId: run.actorId,
+            computerId,
+            installationId,
+            appId,
+            method,
+            methodDigest,
+            context: storedContext,
+        };
+    };
+    const cancellations = new Map();
+    return {
+        graph,
+        /** Every node kind rechecks the stored run; completion cleanup stays with the root engine. */
+        async recheckGraphNode(raw) {
+            const event = S.decodeUnknownSync(nodeEventSchema)(raw, {
+                onExcessProperty: "error",
+            });
+            const run = graph.read(event.runId);
+            if (run?.teamId !== options.teamId() ||
+                options.admission() !== "active" ||
+                graph.outcome(event.runId) !== "active")
+                return { kind: "refused", code: "revoked" };
+            const definition = event.graphId === undefined
+                ? run.plan.definition
+                : run.plan.definition.subgraphs?.[event.graphId];
+            if (event.state !== "running" ||
+                !definition?.nodes.some((node) => node.id === event.nodeId))
+                return { kind: "refused", code: "unknown_method" };
+            const libraryInstallationId = run.publication?.installationId ??
+                run.libraryInstallationId ??
+                run.trigger?.libraryInstallationId;
+            const preparation = preparationFromRun(run, libraryInstallationId);
+            const decision = await options.authority.recheckRun(preparation);
+            if (decision.kind === "refused")
+                graph.recordEvent({
+                    ...event,
+                    state: "failed",
+                    refusal: decision.code,
+                    errorMessage: decision.code.replaceAll("_", " "),
+                });
+            return decision;
+        },
+        /** Recompile the member plan against live catalog, then capture before storage. */
+        async startMemberGraph(memberId, raw, libraryInstallationId) {
+            const request = S.decodeUnknownSync(memberCompiledGraphStartSchema)(raw, {
+                onExcessProperty: "error",
+            });
+            requireDeliveryLibrary(request.delivery, libraryInstallationId);
+            await admitGraphMember(memberId, request.computerId, request.delivery);
+            const entries = await options.catalog(memberId);
+            const bindings = Object.fromEntries(Object.entries(request.plan.bindings).map(([name, binding]) => [
+                name,
+                "installationId" in binding ? binding.installationId : binding,
+            ]));
+            const compiled = await compileForMember(entries, {
+                requestId: request.requestId,
+                definition: request.plan.definition,
+                bindings,
+                input: request.input,
+            });
+            if (compiled.kind !== "compiled" ||
+                canonicalJson(compiled.plan) !== canonicalJson(request.plan))
+                throw options.errors.app("denied");
+            let preparation = {
+                initiatedBy: { kind: "member", memberId },
+                source: "manual",
+                plan: compiled.plan,
+                computerId: request.computerId,
+            };
+            if (libraryInstallationId !== undefined)
+                preparation = { ...preparation, libraryInstallationId };
+            const ceiling = await captureGraph(preparation);
+            let run = {
+                ...request,
+                plan: compiled.plan,
+                teamId: options.teamId(),
+                actorId: memberId,
+                ceiling,
+                source: preparation.source,
+                initiatedBy: preparation.initiatedBy,
+            };
+            if (libraryInstallationId !== undefined)
+                run = { ...run, libraryInstallationId };
+            return graph.startCompiled(run);
+        },
+        ...triggerReservations,
+        workflowRunOutcome,
+        admitWorkflowNode,
+        /** Up to 50 runs of one installation, newest first; `actorId` narrows to one viewer. */
+        listRuns(installationId, actorId, workflowId) {
+            let filter = { installationId };
+            if (actorId !== undefined)
+                filter = { ...filter, actorId };
+            if (workflowId !== undefined)
+                filter = { ...filter, workflowId };
+            return graph.list(filter);
+        },
+        bindTriggerRun(reservationId, rawRunId) {
+            const runId = z.string().min(1).max(256).parse(rawRunId);
+            if (graph.read(runId) === null)
+                return "conflict";
+            return options.transactionSync(() => {
+                const result = triggerReservations.bindTriggerRun(reservationId, runId);
+                if (result !== "conflict" && graph.outcome(runId) !== "active")
+                    triggerReservations.terminalTriggerRun(runId);
+                return result;
+            });
+        },
+        terminalTriggerRun,
+        async cancel(memberId, rawRunId) {
+            const runId = z.string().min(1).max(256).parse(rawRunId);
+            await options.member(memberId);
+            const run = graph.read(runId);
+            if (run === null ||
+                (run.actorId !== memberId &&
+                    !(await options.reviewer(memberId)).isOwner))
+                return { kind: "refused", reason: "denied" };
+            const prior = graph.outcome(runId);
+            if (prior === "terminal" || prior === "cancelled")
+                return { kind: prior };
+            const pending = cancellations.get(runId);
+            if (pending !== undefined)
+                return pending;
+            const cancellation = (async () => {
+                const outcome = await options.terminateGraphRun(runId);
+                terminalTriggerRun(runId, outcome);
+                return {
+                    kind: graph.outcome(runId) === "cancelled"
+                        ? "cancelled"
+                        : "terminal",
+                };
+            })();
+            cancellations.set(runId, cancellation);
+            try {
+                return await cancellation;
+            }
+            finally {
+                cancellations.delete(runId);
+            }
+        },
+        pendingWorkflowRunCleanups() {
+            return sql
+                .exec("SELECT run_id,computer_id FROM hub_workflow_run_cleanups WHERE acknowledged=0 ORDER BY run_id LIMIT 100")
+                .toArray()
+                .map((raw) => {
+                const row = z
+                    .object({ run_id: z.string(), computer_id: z.string() })
+                    .parse(raw);
+                return {
+                    teamId: options.teamId(),
+                    runId: row.run_id,
+                    computerId: row.computer_id,
+                };
+            });
+        },
+        /** Delivery consumer calls this only after durable Computer revocation resolves. */
+        acknowledgeWorkflowRunCleanup(rawRunId) {
+            const runId = z.string().min(1).max(256).parse(rawRunId);
+            options.transactionSync(() => {
+                sql.exec("UPDATE hub_workflow_run_cleanups SET acknowledged=1 WHERE run_id=?", runId);
+            });
+        },
+        triggerPlans,
+        /** Member-started generic graphs only; trigger starts use startCachedGraph instead. */
+        async startGraph(memberId, raw, computerId, libraryInstallationId) {
+            const request = S.decodeUnknownSync(graphStartRequestSchema)(raw, {
+                onExcessProperty: "error",
+            });
+            requireDeliveryLibrary(request.delivery, libraryInstallationId);
+            await admitGraphMember(memberId, computerId, request.delivery);
+            const entries = await options.catalog(memberId);
+            let publication;
+            if (request.published !== undefined) {
+                if (libraryInstallationId === undefined ||
+                    !publisherGranted(entries, libraryInstallationId))
+                    throw options.errors.app("denied");
+                // The admitted publisher supplies its original immutable row, not a compiled plan.
+                publication = {
+                    installationId: libraryInstallationId,
+                    workflowId: request.published.workflowId,
+                    commit: request.published.commit,
+                    digest: request.published.digest,
+                    armedBy: { kind: "member", memberId },
+                };
+                if (publication.digest !==
+                    (await contentDigest(S.decodeUnknownSync(S.Json)(request.definition))))
+                    return {
+                        kind: "invalid",
+                        issues: [
+                            {
+                                code: "schema",
+                                message: "Published definition digest does not match",
+                            },
+                        ],
+                    };
+            }
+            const compiled = await compileForMember(entries, request);
+            if (compiled.kind === "invalid")
+                return compiled;
+            const identity = await memberRunIdentity(options.teamId(), memberId, request.requestId);
+            let preparation = {
+                initiatedBy: { kind: "member", memberId },
+                source: "manual",
+                computerId,
+                plan: compiled.plan,
+            };
+            if (libraryInstallationId !== undefined)
+                preparation = { ...preparation, libraryInstallationId };
+            const ceiling = await captureGraph(preparation);
+            if (publication !== undefined &&
+                !publisherGranted(await options.catalog(memberId), publication.installationId))
+                throw options.errors.app("denied");
+            return startCompiled(preparation, request, identity, ceiling, undefined, publication, libraryInstallationId);
+        },
+        async startCachedGraph(binding, started) {
+            const { triggerRepository, ...request } = started;
+            await admitGraphMember(binding.armedBy, binding.computerId);
+            const stored = triggerPlans.read(binding);
+            if (stored?.refusal !== null)
+                return {
+                    kind: "refused",
+                    reason: stored?.refusal ?? "Compiled Workflow unavailable; re-arm required",
+                };
+            const entries = await options.catalog(binding.armedBy);
+            if (!publisherGranted(entries, binding.installationId))
+                return {
+                    kind: "refused",
+                    reason: "Workflow publisher is no longer available; re-arm required",
+                };
+            if (Object.values(binding.bindings).some((selection) => {
+                const installation = bindingsSelectionSchema.valueType.options[0].safeParse(selection);
+                return (installation.success &&
+                    !entries.some((entry) => entry.installationId === installation.data));
+            }))
+                return {
+                    kind: "refused",
+                    reason: "Workflow is no longer valid for this member",
+                };
+            for (const selectedBinding of Object.values(stored.plan.bindings)) {
+                // The closed namespace variant is admitted by live Git capture below.
+                if (workflowBindingSchema.options[1].safeParse(selectedBinding).success)
+                    continue;
+                if (!("installationId" in selectedBinding))
+                    return {
+                        kind: "refused",
+                        reason: "Workflow is no longer valid for this member",
+                    };
+                const { appId, installationId } = selectedBinding;
+                const current = entries.find((entry) => entry.installationId === installationId && entry.appId === appId);
+                const pinned = stored.plan.catalog[appId];
+                if (current === undefined ||
+                    pinned === undefined ||
+                    Object.entries(pinned.methods).some(([name, method]) => current.methods[name]?.digest !== method.digest) ||
+                    Object.entries(pinned.events ?? {}).some(([name, event]) => current.events?.[name]?.digest !== event.digest))
+                    return {
+                        kind: "refused",
+                        reason: "Workflow is no longer valid for this member",
+                    };
+            }
+            const identity = await memberRunIdentity(options.teamId(), binding.armedBy, request.requestId);
+            let preparation = {
+                initiatedBy: { kind: "member", memberId: binding.armedBy },
+                source: stored.plan.definition.triggers?.find((trigger) => trigger.id === binding.triggerId)?.on === "schedule"
+                    ? "schedule"
+                    : "event",
+                libraryInstallationId: binding.installationId,
+                computerId: binding.computerId,
+                plan: stored.plan,
+            };
+            if (triggerRepository !== undefined)
+                preparation = { ...preparation, triggerRepository };
+            const ceiling = await captureGraph(preparation);
+            if (!publisherGranted(await options.catalog(binding.armedBy), binding.installationId))
+                return {
+                    kind: "refused",
+                    reason: "Workflow publisher is no longer available; re-arm required",
+                };
+            // Re-read after live admission/capture I/O: disarm or push invalidation wins.
+            const current = triggerPlans.read(binding);
+            if (current?.refusal !== null ||
+                canonicalJson(current.plan) !== canonicalJson(stored.plan))
+                return {
+                    kind: "refused",
+                    reason: current?.refusal ??
+                        "Compiled Workflow unavailable; re-arm required",
+                };
+            let trigger = {
+                libraryInstallationId: binding.installationId,
+                workflowId: binding.workflowId,
+                commit: binding.commit,
+                triggerId: binding.triggerId,
+                armedBy: binding.armedBy,
+            };
+            if (binding.nodeGitAccess !== undefined)
+                trigger = { ...trigger, nodeGitAccess: binding.nodeGitAccess };
+            if (triggerRepository !== undefined)
+                trigger = { ...trigger, repository: triggerRepository };
+            return startCompiled(preparation, binding.delivery === undefined
+                ? request
+                : { ...request, delivery: binding.delivery }, identity, ceiling, trigger, {
+                installationId: binding.installationId,
+                workflowId: binding.workflowId,
+                commit: binding.commit,
+                digest: binding.digest,
+                armedBy: { kind: "member", memberId: binding.armedBy },
+            }, binding.installationId);
+        },
+        callWorkflowApp: options.callWorkflowApp,
+        admitDelivery: options.admitDelivery,
+        memberComputer: options.memberComputer,
+        catalog: options.catalog,
+        reviewer: options.reviewer,
+        member: options.member,
+        /** A removed member's runs end now; node admission would refuse them anyway. */
+        revokeMember(rawMemberId) {
+            const memberId = z.string().min(1).max(256).parse(rawMemberId);
+            revoke((run) => run.actorId === memberId);
+        },
+        /** Apps calls this with its permission change inside the shared transaction. */
+        revokeInstallationInMutation(rawInstallationId) {
+            const installationId = z
+                .string()
+                .min(1)
+                .max(256)
+                .parse(rawInstallationId);
+            revoke((run) => runInstallations(run).has(installationId));
+        },
+        /** A revoked Release ends every run whose frozen plan binds an affected App. */
+        revokeReleaseInMutation(appIds) {
+            const affected = new Set(z.array(z.string().min(1).max(256)).parse(appIds));
+            if (affected.size === 0)
+                return;
+            revoke((run) => Object.values(run.plan.bindings).some((binding) => "appId" in binding && affected.has(binding.appId)));
+        },
+        /** The kernel's lifecycle caller owns the transaction. Suspension ends every run. */
+        onLifecycle(status) {
+            if (status === "suspended")
+                revoke(() => true);
+        },
+    };
+}

package/dist/runtime/run-report.d.ts

@@ -0,0 +1,14 @@
+import * as S from "effect/Schema";
+/** How a run ended, as its host reports it; decoded where it crosses a door. */
+export declare const workflowRunEndingSchema: S.Union<readonly [S.Struct<{
+    readonly kind: S.Literal<"complete">;
+    readonly output: S.Codec<S.Json, S.Json, never, never>;
+}>, S.Struct<{
+    readonly kind: S.Literal<"failed">;
+    readonly error: S.String;
+}>, S.Struct<{
+    readonly kind: S.Literal<"cancelled">;
+}>]>;
+export type WorkflowRunEnding = typeof workflowRunEndingSchema.Type;
+/** The follow-up the run's declared delivery Session receives, on every host. */
+export declare function workflowRunReport(title: string, runId: string, ending: WorkflowRunEnding): string;

package/dist/runtime/run-report.js

@@ -0,0 +1,23 @@
+import * as S from "effect/Schema";
+/** How a run ended, as its host reports it; decoded where it crosses a door. */
+export const workflowRunEndingSchema = S.Union([
+    S.Struct({ kind: S.Literal("complete"), output: S.Json }),
+    S.Struct({ kind: S.Literal("failed"), error: S.String }),
+    S.Struct({ kind: S.Literal("cancelled") }),
+]);
+/** A Session message stays readable; the full output remains in runStatus. */
+const OUTPUT_PREVIEW_CHARS = 2_000;
+const ERROR_CHARS = 500;
+const clip = (text, limit) => text.length <= limit ? text : `${text.slice(0, limit)}…`;
+/** The follow-up the run's declared delivery Session receives, on every host. */
+export function workflowRunReport(title, runId, ending) {
+    const name = `Workflow "${title}" (run ${runId})`;
+    switch (ending.kind) {
+        case "complete":
+            return `${name} finished.\nResult:\n${clip(JSON.stringify(ending.output, null, 2), OUTPUT_PREVIEW_CHARS)}`;
+        case "failed":
+            return `${name} failed: ${clip(ending.error, ERROR_CHARS)}`;
+        case "cancelled":
+            return `${name} was cancelled.`;
+    }
+}

package/dist/runtime/schedules.d.ts

@@ -0,0 +1,39 @@
+import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+import { type WorkflowArmer, type WorkflowInstallationAuthority, type WorkflowTriggerPrincipal, type WorkflowTriggerTarget, type createTeamWorkflowTriggers } from "./trigger-owner.js";
+/** Team-owned schedule records; Almanac alone decides occurrences and transitions. */
+export declare function createWorkflowSchedules(options: {
+    sql: WatchdogSqliteOwner["sql"];
+    triggers: ReturnType<typeof createTeamWorkflowTriggers>;
+    teamId: () => string;
+    now: () => number;
+    commit: <A>(body: () => A) => Promise<A>;
+    authorize: (memberId: string, installationId: string) => Promise<void>;
+    wake: (due: number | null) => Promise<void>;
+    reportFailure: (failure: Readonly<{
+        source: "workflow_schedule_fire";
+        cause: unknown;
+    }>) => void;
+}): {
+    nextWake: () => number | null;
+    arm(armer: WorkflowArmer, target: WorkflowTriggerTarget, computerId: string, installationAuthority: WorkflowInstallationAuthority): Promise<{
+        kind: "refused";
+        reason: string;
+    } | {
+        kind: "armed";
+        scheduleId: string;
+    }>;
+    list(principal: WorkflowTriggerPrincipal, installationId: string): Promise<{
+        scheduleId: string;
+        workflowId: string;
+        triggerId: string;
+        nextDueAt: number;
+        state: "active" | "finished" | "paused" | "cancelled";
+        lastError: string | null;
+    }[]>;
+    disarm(principal: WorkflowTriggerPrincipal, installationId: string, scheduleId: string): Promise<{
+        kind: "not_found";
+    } | {
+        kind: "disarmed";
+    }>;
+    fireDue(): Promise<void>;
+};