@fungi.computer/braid 0.0.0-stage → 0.1.0

package/dist/runtime/trigger-owner.d.ts

@@ -0,0 +1,594 @@
+import { z } from "zod";
+import * as S from "effect/Schema";
+import { type GitBinding, type RepositoryRef } from "@fungi.computer/agar/git";
+import { type TriggerEvent } from "../index.js";
+import { type WorkflowArmingAuthorityPorts, type WorkflowArmingReceipt } from "./arming-authority.js";
+import type { PublishedDefinitionPort, WorkflowPublicationContext, WorkflowTriggerRunPorts, WorkflowErrorPort } from "./ports.js";
+export declare const workflowTriggerTargetSchema: z.ZodObject<{
+    installationId: z.ZodString;
+    workflowId: z.ZodString;
+    commit: z.ZodString;
+    digest: z.ZodString & z.ZodType<string & {
+        readonly appReleaseKind: "Sha256Digest";
+    }, string, z.core.$ZodTypeInternals<string & {
+        readonly appReleaseKind: "Sha256Digest";
+    }, string>>;
+    triggerId: z.ZodString;
+    bindings: z.ZodRecord<z.ZodLazy<z.ZodString>, z.ZodUnion<readonly [z.ZodString, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"team-source">;
+    }, z.core.$strict>>]>>;
+    delivery: z.ZodOptional<z.ZodCustom<{
+        readonly agentId: string;
+        readonly sessionId: string;
+    }, {
+        readonly agentId: string;
+        readonly sessionId: string;
+    }>>;
+}, z.core.$strict>;
+/** The host frame's installation selection and verified artifact, pinned at arm time. */
+export declare const workflowInstallationAuthoritySchema: z.ZodObject<{
+    selection: z.ZodObject<{
+        instanceId: z.ZodString;
+        owner: z.ZodObject<{
+            kind: z.ZodEnum<{
+                installation: "installation";
+                deployment: "deployment";
+            }>;
+            id: z.ZodString;
+        }, z.core.$strict>;
+        appId: z.ZodString & z.ZodType<string & {
+            readonly appReleaseKind: "AppId";
+        }, string, z.core.$ZodTypeInternals<string & {
+            readonly appReleaseKind: "AppId";
+        }, string>>;
+        releaseId: z.ZodString & z.ZodType<string & {
+            readonly appReleaseKind: "ReleaseId";
+        }, string, z.core.$ZodTypeInternals<string & {
+            readonly appReleaseKind: "ReleaseId";
+        }, string>>;
+        authorityVersion: z.ZodNumber;
+    }, z.core.$strict>;
+    artifactDigest: z.ZodString & z.ZodType<string & {
+        readonly appReleaseKind: "Sha256Digest";
+    }, string, z.core.$ZodTypeInternals<string & {
+        readonly appReleaseKind: "Sha256Digest";
+    }, string>>;
+}, z.core.$strict>;
+export type WorkflowInstallationAuthority = z.infer<typeof workflowInstallationAuthoritySchema>;
+export declare const armedWorkflowTriggerSchema: z.ZodObject<{
+    installationId: z.ZodString;
+    workflowId: z.ZodString;
+    commit: z.ZodString;
+    digest: z.ZodString & z.ZodType<string & {
+        readonly appReleaseKind: "Sha256Digest";
+    }, string, z.core.$ZodTypeInternals<string & {
+        readonly appReleaseKind: "Sha256Digest";
+    }, string>>;
+    triggerId: z.ZodString;
+    bindings: z.ZodRecord<z.ZodLazy<z.ZodString>, z.ZodUnion<readonly [z.ZodString, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"team-source">;
+    }, z.core.$strict>>]>>;
+    delivery: z.ZodOptional<z.ZodCustom<{
+        readonly agentId: string;
+        readonly sessionId: string;
+    }, {
+        readonly agentId: string;
+        readonly sessionId: string;
+    }>>;
+    armedBy: z.ZodString;
+    armedVia: z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"connector">;
+        agentId: z.ZodString;
+        attachmentId: z.ZodString;
+        attachmentVersion: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"policy">;
+        agentId: z.ZodString;
+        policyRevision: z.ZodString;
+        grantorMemberId: z.ZodString;
+    }, z.core.$strict>], "kind">>;
+    grantorMembershipVersion: z.ZodNumber;
+    installationAuthority: z.ZodObject<{
+        selection: z.ZodObject<{
+            instanceId: z.ZodString;
+            owner: z.ZodObject<{
+                kind: z.ZodEnum<{
+                    installation: "installation";
+                    deployment: "deployment";
+                }>;
+                id: z.ZodString;
+            }, z.core.$strict>;
+            appId: z.ZodString & z.ZodType<string & {
+                readonly appReleaseKind: "AppId";
+            }, string, z.core.$ZodTypeInternals<string & {
+                readonly appReleaseKind: "AppId";
+            }, string>>;
+            releaseId: z.ZodString & z.ZodType<string & {
+                readonly appReleaseKind: "ReleaseId";
+            }, string, z.core.$ZodTypeInternals<string & {
+                readonly appReleaseKind: "ReleaseId";
+            }, string>>;
+            authorityVersion: z.ZodNumber;
+        }, z.core.$strict>;
+        artifactDigest: z.ZodString & z.ZodType<string & {
+            readonly appReleaseKind: "Sha256Digest";
+        }, string, z.core.$ZodTypeInternals<string & {
+            readonly appReleaseKind: "Sha256Digest";
+        }, string>>;
+    }, z.core.$strict>;
+    computerId: z.ZodString;
+    nodeGitAccess: z.ZodOptional<z.ZodCustom<readonly {
+        readonly nodeId: string;
+        readonly gitAccess: {
+            repository: {
+                kind: "installation";
+                installationId: string;
+                repository: string;
+            } | {
+                kind: "team-source";
+                repository: string;
+            };
+            branches: string[];
+        } | {
+            repository: {
+                kind: "installation";
+                installationId: string;
+                repository: string;
+            } | {
+                kind: "team-source";
+                repository: string;
+            };
+            access: "read";
+        };
+        readonly graphId?: string;
+    }[], readonly {
+        readonly nodeId: string;
+        readonly gitAccess: {
+            repository: {
+                kind: "installation";
+                installationId: string;
+                repository: string;
+            } | {
+                kind: "team-source";
+                repository: string;
+            };
+            branches: string[];
+        } | {
+            repository: {
+                kind: "installation";
+                installationId: string;
+                repository: string;
+            } | {
+                kind: "team-source";
+                repository: string;
+            };
+            access: "read";
+        };
+        readonly graphId?: string;
+    }[]>>;
+}, z.core.$strict>;
+export type WorkflowTriggerTarget = z.infer<typeof workflowTriggerTargetSchema>;
+export type ArmedWorkflowTrigger = z.infer<typeof armedWorkflowTriggerSchema>;
+/** Host-attested arming principal: the grantor member and, for an Agent, its live source. */
+export type WorkflowArmer = Pick<WorkflowArmingReceipt, "armedBy" | "armedVia">;
+/** Host-attested control principal for listing and disarming stored triggers. */
+export type WorkflowTriggerPrincipal = Readonly<{
+    kind: "member";
+    memberId: string;
+}> | Readonly<{
+    kind: "agent";
+    agentId: string;
+    grantorMemberId: string;
+}>;
+/** The member whose installation grant authorizes this principal's control. */
+export declare const workflowTriggerPrincipalMember: (principal: WorkflowTriggerPrincipal) => string;
+/** A member controls every decodable trigger; an Agent controls only its own arms. */
+export declare const workflowTriggerControlledBy: (principal: WorkflowTriggerPrincipal, binding: Pick<ArmedWorkflowTrigger, "armedVia">) => boolean;
+/** Separate arming principals keep separate stored triggers. */
+export declare const workflowArmerKey: (armer: WorkflowArmer) => (string | null)[];
+/** Published provenance and current member authority shared by every trigger kind. */
+export declare function createTeamWorkflowTriggers(options: {
+    runs: WorkflowTriggerRunPorts;
+    published: PublishedDefinitionPort<WorkflowPublicationContext>;
+    errors: WorkflowErrorPort;
+    /** Host-resolved installation GIT; rechecks membership and workflow.run on every call. */
+    source: (memberId: string, installationId: string, computerId: string) => Promise<GitBinding>;
+    /**
+     * Live installation authority only (workflow.run, workflow.arm, Git and the
+     * Computer); never opens Git or Artifact bytes. Returns the current pin.
+     */
+    admit: (memberId: string, installationId: string, computerId: string) => Promise<WorkflowInstallationAuthority>;
+    /** The current Agent source owner; the member reader is the run owner's. */
+    readAgentAccess: WorkflowArmingAuthorityPorts["readAgentAccess"];
+    /** The member's current Team Git policy; this never mints a pass. */
+    admitGitAccess: (memberId: string, repository: RepositoryRef, scope: "read" | "write") => Promise<void>;
+    /** Idempotently ensure the recorded run has an engine instance, including on replay. */
+    launch: (run: Readonly<{
+        runId: string;
+        planDigest: string;
+    }>) => Promise<void>;
+}): {
+    arm: (armer: WorkflowArmer, raw: WorkflowTriggerTarget, computerId: string, rawAuthority: WorkflowInstallationAuthority) => Promise<{
+        kind: "refused";
+        reason: string;
+    } | {
+        kind: "refused";
+        reason: string;
+        issues: readonly import("../validate.js").Issue[];
+        binding?: never;
+        trigger?: never;
+        definition?: never;
+    } | {
+        kind: "armed";
+        binding: {
+            installationId: string;
+            workflowId: string;
+            commit: string;
+            digest: string & {
+                readonly appReleaseKind: "Sha256Digest";
+            };
+            triggerId: string;
+            bindings: Record<string, string | {
+                kind: "team-source";
+            }>;
+            armedBy: string;
+            armedVia: {
+                kind: "connector";
+                agentId: string;
+                attachmentId: string;
+                attachmentVersion: number;
+            } | {
+                kind: "policy";
+                agentId: string;
+                policyRevision: string;
+                grantorMemberId: string;
+            } | null;
+            grantorMembershipVersion: number;
+            installationAuthority: {
+                selection: {
+                    instanceId: string;
+                    owner: {
+                        kind: "installation" | "deployment";
+                        id: string;
+                    };
+                    appId: string & {
+                        readonly appReleaseKind: "AppId";
+                    };
+                    releaseId: string & {
+                        readonly appReleaseKind: "ReleaseId";
+                    };
+                    authorityVersion: number;
+                };
+                artifactDigest: string & {
+                    readonly appReleaseKind: "Sha256Digest";
+                };
+            };
+            computerId: string;
+            delivery?: {
+                readonly agentId: string;
+                readonly sessionId: string;
+            } | undefined;
+            nodeGitAccess?: readonly {
+                readonly nodeId: string;
+                readonly gitAccess: {
+                    repository: {
+                        kind: "installation";
+                        installationId: string;
+                        repository: string;
+                    } | {
+                        kind: "team-source";
+                        repository: string;
+                    };
+                    branches: string[];
+                } | {
+                    repository: {
+                        kind: "installation";
+                        installationId: string;
+                        repository: string;
+                    } | {
+                        kind: "team-source";
+                        repository: string;
+                    };
+                    access: "read";
+                };
+                readonly graphId?: string;
+            }[] | undefined;
+        };
+        trigger: {
+            readonly id: string;
+            readonly on: "webhook";
+            readonly input?: {
+                readonly [x: string]: import("../schema.js").Mapping;
+            };
+            readonly title?: string;
+            readonly when?: import("../schema.js").Predicate;
+        } | {
+            readonly id: string;
+            readonly on: "schedule";
+            readonly cron: {
+                readonly expression: string;
+                readonly timeZone: string;
+            };
+            readonly input?: {
+                readonly [x: string]: import("../schema.js").Mapping;
+            };
+            readonly title?: string;
+        } | {
+            readonly id: string;
+            readonly on: "event";
+            readonly event: string;
+            readonly app: string;
+            readonly eventDigest: string;
+            readonly input?: {
+                readonly [x: string]: import("../schema.js").Mapping;
+            };
+            readonly title?: string;
+            readonly when?: import("../schema.js").Predicate;
+            readonly repository?: import("../schema.js").Mapping;
+        };
+        definition: {
+            readonly input: {
+                readonly [x: string]: S.Json;
+            };
+            readonly output: {
+                readonly [x: string]: {
+                    readonly node: string;
+                    readonly port: string;
+                };
+            };
+            readonly title: string;
+            readonly format: "fungi.workflow/v1";
+            readonly nodes: readonly ({
+                readonly id: string;
+                readonly kind: "code";
+                readonly source: string;
+                readonly input: {
+                    readonly [x: string]: S.Json;
+                };
+                readonly output: {
+                    readonly [x: string]: S.Json;
+                };
+                readonly values: {
+                    readonly [x: string]: import("../schema.js").Mapping;
+                };
+            } | {
+                readonly values: {
+                    readonly [x: string]: import("../schema.js").Mapping;
+                };
+                readonly id: string;
+                readonly method: string;
+                readonly kind: "app";
+                readonly app: string;
+                readonly methodDigest: string;
+                readonly gitAccess?: {
+                    binding: string;
+                    repository: string;
+                    branches: string[];
+                } | {
+                    binding: string;
+                    repository: string;
+                    access: "read";
+                };
+                readonly retry?: {
+                    readonly attempts: number;
+                };
+            } | {
+                readonly show: readonly {
+                    readonly node: string;
+                    readonly port: string;
+                }[];
+                readonly id: string;
+                readonly title: string;
+                readonly timeout: number;
+                readonly kind: "review";
+                readonly reviewers: "runner" | "owners";
+                readonly detail?: string;
+                readonly choices?: readonly {
+                    readonly id: string;
+                    readonly label: string;
+                    readonly description?: string;
+                }[];
+            } | {
+                readonly id: string;
+                readonly kind: "condition";
+                readonly test: import("../schema.js").Predicate;
+            } | {
+                readonly id: string;
+                readonly kind: "map";
+                readonly over: {
+                    readonly node: string;
+                    readonly port: string;
+                };
+                readonly body: string;
+                readonly concurrency: number;
+                readonly maxItems: number;
+            } | {
+                readonly id: string;
+                readonly kind: "repeat";
+                readonly body: string;
+                readonly maxRounds: number;
+                readonly until: import("../schema.js").Predicate;
+            } | {
+                readonly id: string;
+                readonly kind: "wait";
+                readonly for: number;
+            } | {
+                readonly id: string;
+                readonly kind: "transform";
+                readonly fields: {
+                    readonly [x: string]: import("../schema.js").Mapping;
+                };
+            })[];
+            readonly edges: readonly {
+                readonly from: {
+                    readonly node: string;
+                    readonly port: string;
+                };
+                readonly to: {
+                    readonly node: string;
+                    readonly port: string;
+                };
+            }[];
+            readonly apps: {
+                readonly [x: string]: {
+                    readonly appId: string;
+                    readonly role?: string;
+                };
+            };
+            readonly description?: string;
+            readonly subgraphs?: {
+                readonly [x: string]: {
+                    readonly input: {
+                        readonly [x: string]: S.Json;
+                    };
+                    readonly nodes: readonly ({
+                        readonly id: string;
+                        readonly kind: "code";
+                        readonly source: string;
+                        readonly input: {
+                            readonly [x: string]: S.Json;
+                        };
+                        readonly output: {
+                            readonly [x: string]: S.Json;
+                        };
+                        readonly values: {
+                            readonly [x: string]: import("../schema.js").Mapping;
+                        };
+                    } | {
+                        readonly values: {
+                            readonly [x: string]: import("../schema.js").Mapping;
+                        };
+                        readonly id: string;
+                        readonly method: string;
+                        readonly kind: "app";
+                        readonly app: string;
+                        readonly methodDigest: string;
+                        readonly gitAccess?: {
+                            binding: string;
+                            repository: string;
+                            branches: string[];
+                        } | {
+                            binding: string;
+                            repository: string;
+                            access: "read";
+                        };
+                        readonly retry?: {
+                            readonly attempts: number;
+                        };
+                    } | {
+                        readonly show: readonly {
+                            readonly node: string;
+                            readonly port: string;
+                        }[];
+                        readonly id: string;
+                        readonly title: string;
+                        readonly timeout: number;
+                        readonly kind: "review";
+                        readonly reviewers: "runner" | "owners";
+                        readonly detail?: string;
+                        readonly choices?: readonly {
+                            readonly id: string;
+                            readonly label: string;
+                            readonly description?: string;
+                        }[];
+                    } | {
+                        readonly id: string;
+                        readonly kind: "condition";
+                        readonly test: import("../schema.js").Predicate;
+                    } | {
+                        readonly id: string;
+                        readonly kind: "map";
+                        readonly over: {
+                            readonly node: string;
+                            readonly port: string;
+                        };
+                        readonly body: string;
+                        readonly concurrency: number;
+                        readonly maxItems: number;
+                    } | {
+                        readonly id: string;
+                        readonly kind: "repeat";
+                        readonly body: string;
+                        readonly maxRounds: number;
+                        readonly until: import("../schema.js").Predicate;
+                    } | {
+                        readonly id: string;
+                        readonly kind: "wait";
+                        readonly for: number;
+                    } | {
+                        readonly id: string;
+                        readonly kind: "transform";
+                        readonly fields: {
+                            readonly [x: string]: import("../schema.js").Mapping;
+                        };
+                    })[];
+                    readonly edges: readonly {
+                        readonly from: {
+                            readonly node: string;
+                            readonly port: string;
+                        };
+                        readonly to: {
+                            readonly node: string;
+                            readonly port: string;
+                        };
+                    }[];
+                    readonly output: {
+                        readonly [x: string]: {
+                            readonly node: string;
+                            readonly port: string;
+                        };
+                    };
+                };
+            };
+            readonly triggers?: readonly ({
+                readonly id: string;
+                readonly on: "webhook";
+                readonly input?: {
+                    readonly [x: string]: import("../schema.js").Mapping;
+                };
+                readonly title?: string;
+                readonly when?: import("../schema.js").Predicate;
+            } | {
+                readonly id: string;
+                readonly on: "schedule";
+                readonly cron: {
+                    readonly expression: string;
+                    readonly timeZone: string;
+                };
+                readonly input?: {
+                    readonly [x: string]: import("../schema.js").Mapping;
+                };
+                readonly title?: string;
+            } | {
+                readonly id: string;
+                readonly on: "event";
+                readonly event: string;
+                readonly app: string;
+                readonly eventDigest: string;
+                readonly input?: {
+                    readonly [x: string]: import("../schema.js").Mapping;
+                };
+                readonly title?: string;
+                readonly when?: import("../schema.js").Predicate;
+                readonly repository?: import("../schema.js").Mapping;
+            })[];
+        };
+        reason?: never;
+        issues?: never;
+    }>;
+    disarm: (binding: ArmedWorkflowTrigger) => void;
+    refusal: (binding: ArmedWorkflowTrigger) => string | null;
+    invalidateInstallation: (installationId: string) => void;
+    /** The single native push owner supplies host-issued Git, never a fire caller. */
+    revalidatePublished(installationId: string, git: GitBinding): Promise<void>;
+    fire(raw: ArmedWorkflowTrigger, scope: string, event: TriggerEvent): Promise<Readonly<{
+        kind: "ignored";
+    }> | Readonly<{
+        kind: "started" | "replay" | "conflict";
+        runId: string;
+        planDigest: string;
+    }> | Readonly<{
+        kind: "refused";
+        reason: string;
+    }>>;
+};