@fungi.computer/braid 0.1.0 → 0.2.0

package/dist/code-execution.js

@@ -12,6 +12,8 @@ const failureCode = (failure) => {
             return "guest_exception";
         case "DeadlineExceeded":
             return "deadline_exceeded";
+        case "SandboxBusy":
+            return "sandbox_failed";
         case "Cancelled":
             return "cancelled";
         case "ResultNotJson":

package/dist/git-access.d.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 /** Frozen installation identity or explicit registered Team-source namespace. */
 export declare const workflowBindingSchema: z.ZodUnion<readonly [z.ZodObject<{
     appId: z.ZodString;

package/dist/git-access.js

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 import { repositoryRefSchema, repositoryRefsEqual, } from "@fungi.computer/agar/git";
 const repository = z
     .string()

package/dist/runtime/git-pass-contract.d.ts

@@ -1,5 +1,26 @@
 import { z } from "zod";
 import type { GitWriter } from "@fungi.computer/agar/git";
+/** One credential grammar for both hosts; the owner is public, the token is not. */
+export declare const workflowGitPassPrefix = "wgp.";
+export declare const workflowGitPassTokenSchema: z.ZodPipe<z.ZodString, z.ZodTransform<{
+    ownerId: string;
+    token: string;
+}, string>>;
+/** Format the existing standalone bearer shape, never a credential-bearing URL. */
+export declare function formatWorkflowGitPassToken(ownerId: string, token: string): string;
+/** Returned once to the native dispatcher, never to an App or a durable record. */
+export type WorkflowGitCredential = Readonly<{
+    bearer: string;
+    remote: string;
+    expiresAt: number;
+}>;
+/** Git reads this command-local config without writing a credential or repository config. */
+export declare function workflowGitExecutionEnvironment(credential: WorkflowGitCredential): {
+    FUNGI_GIT_REMOTE: string;
+    GIT_CONFIG_COUNT: string;
+    GIT_CONFIG_KEY_0: string;
+    GIT_CONFIG_VALUE_0: string;
+};
 /** Non-secret Team-issued authority for one stored Workflow step on its pinned Computer. */
 export declare const workflowGitPassGrantSchema: z.ZodLazy<z.ZodObject<{
     teamId: z.ZodString;

package/dist/runtime/git-pass-contract.js

@@ -2,6 +2,30 @@ import { z } from "zod";
 import { workflowAttestationSchema } from "@fungi.computer/puffball/app-method-runtime";
 import { gitAccessScope, resolvedGitAccessSchema } from "../git-access.js";
 const id = z.string().min(1).max(256);
+/** One credential grammar for both hosts; the owner is public, the token is not. */
+export const workflowGitPassPrefix = "wgp.";
+export const workflowGitPassTokenSchema = z
+    .string()
+    .regex(/^wgp\.([a-zA-Z0-9_-]{1,256})\.([0-9a-f]{64})$/u)
+    .transform((bearer) => {
+    const [, ownerId = "", token = ""] = bearer.split(".");
+    return { ownerId, token };
+});
+/** Format the existing standalone bearer shape, never a credential-bearing URL. */
+export function formatWorkflowGitPassToken(ownerId, token) {
+    const bearer = `${workflowGitPassPrefix}${ownerId}.${token}`;
+    workflowGitPassTokenSchema.parse(bearer);
+    return bearer;
+}
+/** Git reads this command-local config without writing a credential or repository config. */
+export function workflowGitExecutionEnvironment(credential) {
+    return {
+        FUNGI_GIT_REMOTE: credential.remote,
+        GIT_CONFIG_COUNT: "1",
+        GIT_CONFIG_KEY_0: `http.${credential.remote}.extraHeader`,
+        GIT_CONFIG_VALUE_0: `Authorization: Bearer ${credential.bearer}`,
+    };
+}
 /** Non-secret Team-issued authority for one stored Workflow step on its pinned Computer. */
 export const workflowGitPassGrantSchema = z.lazy(() => z
     .strictObject({

package/dist/runtime/git-pass-store.d.ts

@@ -1,32 +1,35 @@
 import { type RepositoryRef } from "@fungi.computer/agar/git";
 import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
-import { type WorkflowGitPassGrant } from "./git-pass-contract.js";
-/** Scoped pass state shared by both Computer hosts; credentials never enter the grant. */
+import { type WorkflowGitCredential, type WorkflowGitPassGrant } from "./git-pass-contract.js";
+/** One fresh credential per newly admitted native invocation; only its digest is durable. */
 export declare function createWorkflowGitPassStore(options: Readonly<{
     sql: WatchdogSqliteOwner["sql"];
     transactionSync: <T>(body: () => T) => T;
     ownerId(): string | null;
     computerId(): string | undefined;
-    mintPassId(): string;
-    remote(passId: string, repository: RepositoryRef): string;
+    mintToken?: () => string;
+    remote(repository: RepositoryRef): string;
     denied(): Error;
     now?: () => number;
 }>): Readonly<{
-    openWorkflowPass(raw: WorkflowGitPassGrant): {
-        passId: string;
-        remote: string;
-        expiresAt: number;
-        bearer?: string;
-    };
+    /** Only the NEW native-admission path calls this; replay never obtains another secret. */
+    issue(rawInvocationId: string, rawGrant: WorkflowGitPassGrant): Promise<WorkflowGitCredential>;
+    /** A live native replay can extend its existing lease, never issue or resurrect it. */
+    renew(rawInvocationId: string, rawGrant: WorkflowGitPassGrant): void;
+    /** Keep the public receipt so a delayed issuer cannot reopen the same invocation. */
+    close(rawInvocationId: string, rawGrant: WorkflowGitPassGrant): void;
     /** Retain a tombstone so a delayed mint cannot resurrect a terminal run. */
     revokeWorkflowRunGitPasses(input: {
         teamId: string;
         runId: string;
     }): void;
-    /** Re-admit the stored scope for every Git request; an expired pass grants nothing. */
+    /** Every request also needs the host's live native-invocation and domain admission. */
     admit(input: {
-        passId: string;
+        bearer: string;
         repository: RepositoryRef;
         scope: "read" | "write";
-    }): WorkflowGitPassGrant | null;
+    }): Promise<{
+        invocationId: string;
+        grant: WorkflowGitPassGrant;
+    } | null>;
 }>;

package/dist/runtime/git-pass-store.js

@@ -1,55 +1,124 @@
 import { repositoryRefsEqual, } from "@fungi.computer/agar/git";
-import { workflowGitPassResultSchema } from "@fungi.computer/agar/computer-contracts";
 import { z } from "zod";
-import { workflowGitPassGrantSchema, workflowGitPassRevocationSchema, } from "./git-pass-contract.js";
-/** Scoped pass state shared by both Computer hosts; credentials never enter the grant. */
+import { canonicalJson } from "../index.js";
+import { formatWorkflowGitPassToken, workflowGitPassTokenSchema, workflowGitPassGrantSchema, workflowGitPassRevocationSchema, } from "./git-pass-contract.js";
+const invocationIdSchema = z.string().min(1).max(256);
+const tokenSchema = z.string().regex(/^[0-9a-f]{64}$/u);
+const leaseSchema = z.strictObject({
+    invocation_id: invocationIdSchema,
+    run_id: z.string(),
+    grant_json: z.string(),
+    token_digest: z.string().nullable(),
+    expires_at: z.number().int(),
+    state: z.enum(["open", "closed"]),
+});
+const remoteSchema = z
+    .url({ protocol: /^https$/, abort: true })
+    .refine((value) => {
+    const url = new URL(value);
+    return url.username === "" && url.password === "";
+}, "Workflow Git remotes must not contain credentials");
+function mintToken() {
+    return Array.from(crypto.getRandomValues(new Uint8Array(32)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** A verifier digest, never a native invocation identity or replay hash. */
+async function tokenDigest(token) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** Optional internal fields use JSON's omission semantics at the storage boundary. */
+function serializeGrant(grant) {
+    return canonicalJson(z.json().parse(JSON.parse(JSON.stringify(grant))));
+}
+/** One fresh credential per newly admitted native invocation; only its digest is durable. */
 export function createWorkflowGitPassStore(options) {
     const { sql } = options;
     const now = options.now ?? Date.now;
-    sql.exec(`CREATE TABLE IF NOT EXISTS computer_workflow_git_passes (
-    pass_id TEXT PRIMARY KEY, node_key TEXT NOT NULL UNIQUE, run_id TEXT NOT NULL,
-    grant_json TEXT NOT NULL, expires_at INTEGER NOT NULL
+    // Pre-release reusable, plaintext pass state is disposable, not another reader.
+    sql.exec("DROP TABLE IF EXISTS computer_workflow_git_passes");
+    sql.exec(`CREATE TABLE IF NOT EXISTS computer_workflow_git_invocations (
+    invocation_id TEXT PRIMARY KEY, run_id TEXT NOT NULL,
+    grant_json TEXT NOT NULL, token_digest TEXT UNIQUE,
+    expires_at INTEGER NOT NULL,
+    state TEXT NOT NULL CHECK (state IN ('open', 'closed'))
   ) STRICT`);
     sql.exec(`CREATE TABLE IF NOT EXISTS computer_workflow_git_ended_runs (run_id TEXT PRIMARY KEY) STRICT`);
+    function admittedGrant(raw) {
+        const grant = workflowGitPassGrantSchema.parse(raw);
+        if (grant.teamId !== options.ownerId() ||
+            grant.computerId !== options.computerId() ||
+            grant.workflow.runId !== grant.runId ||
+            grant.workflow.nodeId !== grant.nodeId ||
+            grant.workflow.armedBy.kind !== "member" ||
+            grant.workflow.armedBy.memberId !== grant.memberId)
+            throw options.denied();
+        return grant;
+    }
+    function ended(runId) {
+        return (sql
+            .exec("SELECT 1 FROM computer_workflow_git_ended_runs WHERE run_id=?", runId)
+            .toArray().length !== 0);
+    }
+    function read(invocationId) {
+        const row = sql
+            .exec("SELECT * FROM computer_workflow_git_invocations WHERE invocation_id=?", invocationId)
+            .toArray()[0];
+        return row === undefined ? undefined : leaseSchema.parse(row);
+    }
     return Object.freeze({
-        openWorkflowPass(raw) {
-            const grant = workflowGitPassGrantSchema.parse(raw);
-            if (grant.teamId !== options.ownerId() ||
-                grant.computerId !== options.computerId() ||
-                grant.workflow.runId !== grant.runId ||
-                grant.workflow.nodeId !== grant.nodeId ||
-                grant.workflow.armedBy.kind !== "member" ||
-                grant.workflow.armedBy.memberId !== grant.memberId)
+        /** Only the NEW native-admission path calls this; replay never obtains another secret. */
+        async issue(rawInvocationId, rawGrant) {
+            const invocationId = invocationIdSchema.parse(rawInvocationId);
+            const grant = admittedGrant(rawGrant);
+            if (ended(grant.runId) || read(invocationId) !== undefined)
                 throw options.denied();
+            const remote = remoteSchema.parse(options.remote(grant.gitAccess.repository));
+            const token = tokenSchema.parse((options.mintToken ?? mintToken)());
+            const bearer = formatWorkflowGitPassToken(grant.teamId, token);
+            const digest = await tokenDigest(token);
             return options.transactionSync(() => {
-                if (sql
-                    .exec("SELECT 1 FROM computer_workflow_git_ended_runs WHERE run_id=?", grant.runId)
-                    .toArray().length > 0)
-                    throw options.denied();
-                const key = JSON.stringify([
-                    grant.runId,
-                    grant.graphId ?? null,
-                    grant.nodeId,
-                    grant.iteration,
-                    grant.scope,
-                ]);
-                const row = sql
-                    .exec("SELECT pass_id,grant_json,expires_at FROM computer_workflow_git_passes WHERE node_key=?", key)
-                    .toArray()[0];
-                if (row !== undefined &&
-                    z.string().parse(row.grant_json) !== JSON.stringify(grant))
+                // The digest await can race a terminal revocation or another issuer.
+                admittedGrant(grant);
+                if (ended(grant.runId) || read(invocationId) !== undefined)
                     throw options.denied();
-                const passId = row === undefined
-                    ? options.mintPassId()
-                    : z.string().parse(row.pass_id);
                 const expiresAt = now() + 60_000;
-                sql.exec(`INSERT INTO computer_workflow_git_passes VALUES(?,?,?,?,?)
-          ON CONFLICT(node_key) DO UPDATE SET expires_at=excluded.expires_at`, passId, key, grant.runId, JSON.stringify(grant), expiresAt);
-                return workflowGitPassResultSchema.parse({
-                    passId,
-                    expiresAt,
-                    remote: options.remote(passId, grant.gitAccess.repository),
-                });
+                sql.exec("INSERT INTO computer_workflow_git_invocations VALUES(?,?,?,?,?,'open')", invocationId, grant.runId, serializeGrant(grant), digest, expiresAt);
+                return { bearer, remote, expiresAt };
+            });
+        },
+        /** A live native replay can extend its existing lease, never issue or resurrect it. */
+        renew(rawInvocationId, rawGrant) {
+            const invocationId = invocationIdSchema.parse(rawInvocationId);
+            const grant = admittedGrant(rawGrant);
+            options.transactionSync(() => {
+                const row = read(invocationId);
+                if (row?.state !== "open" ||
+                    row.expires_at <= now() ||
+                    row.grant_json !== serializeGrant(grant) ||
+                    ended(grant.runId))
+                    throw options.denied();
+                sql.exec("UPDATE computer_workflow_git_invocations SET expires_at=? WHERE invocation_id=?", now() + 60_000, invocationId);
+            });
+        },
+        /** Keep the public receipt so a delayed issuer cannot reopen the same invocation. */
+        close(rawInvocationId, rawGrant) {
+            const invocationId = invocationIdSchema.parse(rawInvocationId);
+            options.transactionSync(() => {
+                const row = read(invocationId);
+                if (row !== undefined) {
+                    // Revocation never depends on current authority or reconstructed
+                    // metadata still being sufficient to admit a new command.
+                    sql.exec("UPDATE computer_workflow_git_invocations SET state='closed',token_digest=NULL WHERE invocation_id=?", invocationId);
+                    return;
+                }
+                const grant = workflowGitPassGrantSchema.parse(rawGrant);
+                // The run tombstone already prevents delayed issuance. Do not recreate
+                // receipts after terminal cleanup has deleted the run's invocation rows.
+                if (ended(grant.runId))
+                    return;
+                // Close can beat the issue RPC or its digest await. Retain the same
+                // public identity either way, so neither can publish a later credential.
+                sql.exec("INSERT INTO computer_workflow_git_invocations VALUES(?,?,?,NULL,0,'closed')", invocationId, grant.runId, serializeGrant(grant));
             });
         },
         /** Retain a tombstone so a delayed mint cannot resurrect a terminal run. */
@@ -59,24 +128,31 @@ export function createWorkflowGitPassStore(options) {
                 throw options.denied();
             options.transactionSync(() => {
                 sql.exec("INSERT OR IGNORE INTO computer_workflow_git_ended_runs VALUES(?)", runId);
-                sql.exec("DELETE FROM computer_workflow_git_passes WHERE run_id=?", runId);
+                sql.exec("DELETE FROM computer_workflow_git_invocations WHERE run_id=?", runId);
             });
         },
-        /** Re-admit the stored scope for every Git request; an expired pass grants nothing. */
-        admit(input) {
-            const at = now();
-            const row = sql
-                .exec("SELECT grant_json,expires_at FROM computer_workflow_git_passes WHERE pass_id=?", input.passId)
+        /** Every request also needs the host's live native-invocation and domain admission. */
+        async admit(input) {
+            const parsed = workflowGitPassTokenSchema.safeParse(input.bearer);
+            if (!parsed.success || parsed.data.ownerId !== options.ownerId())
+                return null;
+            const digest = await tokenDigest(parsed.data.token);
+            const raw = sql
+                .exec("SELECT * FROM computer_workflow_git_invocations WHERE token_digest=?", digest)
                 .toArray()[0];
-            if (row === undefined || z.number().parse(row.expires_at) <= at)
+            if (raw === undefined)
+                return null;
+            const row = leaseSchema.parse(raw);
+            if (row.state !== "open" || row.expires_at <= now())
                 return null;
-            const grant = workflowGitPassGrantSchema.parse(JSON.parse(z.string().parse(row.grant_json)));
+            const grant = workflowGitPassGrantSchema.parse(JSON.parse(row.grant_json));
             if (grant.teamId !== options.ownerId() ||
                 grant.computerId !== options.computerId() ||
                 !repositoryRefsEqual(grant.gitAccess.repository, input.repository) ||
-                (input.scope === "write" && grant.scope !== "write"))
+                (input.scope === "write" && grant.scope !== "write") ||
+                ended(grant.runId))
                 return null;
-            return grant;
+            return { invocationId: row.invocation_id, grant };
         },
     });
 }

package/dist/runtime/git-pass.d.ts

@@ -1,5 +1,4 @@
 import type { RepositoryRef } from "@fungi.computer/agar/git";
-import { type WorkflowGitPassResult } from "@fungi.computer/agar/computer-contracts";
 import type { WorkflowRunContext } from "./graph-contract.js";
 import type { StoredWorkflowNode } from "./graph-dispatch.js";
 import { type WorkflowGitPassGrant } from "./git-pass-contract.js";
@@ -19,7 +18,6 @@ export declare function createWorkflowGitPasses(ports: Readonly<{
         method: string;
     }): WorkflowGitPassNode | null;
     admitMemberGitAccess(memberId: string, repository: RepositoryRef, scope: WorkflowGitScope): Promise<void>;
-    open(computerId: string, grant: WorkflowGitPassGrant): Promise<WorkflowGitPassResult>;
     revoke(computerId: string, input: {
         teamId: string;
         runId: string;
@@ -33,9 +31,10 @@ export declare function createWorkflowGitPasses(ports: Readonly<{
     wake?(due: number | null): Promise<void>;
 }>): {
     cleanupWake: () => number | null;
-    openWorkflowPass(context: WorkflowRunContext, target: {
+    /** Returns only public authority; native NEW admission owns credential issuance. */
+    admitWorkflowGit(context: WorkflowRunContext, target: {
         installationId: string;
         method: string;
-    }): Promise<WorkflowGitPassResult>;
+    }): Promise<WorkflowGitPassGrant>;
     deliverCleanups(): Promise<void>;
 };

package/dist/runtime/git-pass.js

@@ -1,4 +1,3 @@
-import { workflowGitPassResultSchema, } from "@fungi.computer/agar/computer-contracts";
 import { canonicalJson } from "../index.js";
 import { gitAccessScope } from "../git-access.js";
 import { workflowGitPassGrantSchema, } from "./git-pass-contract.js";
@@ -7,7 +6,8 @@ export function createWorkflowGitPasses(ports) {
     const cleanupWake = () => ports.pending().length === 0 ? null : Date.now() + 5000;
     return {
         cleanupWake,
-        async openWorkflowPass(context, target) {
+        /** Returns only public authority; native NEW admission owns credential issuance. */
+        async admitWorkflowGit(context, target) {
             const admitted = ports.admitNode(context, target);
             if (admitted?.computerId == null ||
                 admitted.context.gitAccess === undefined ||
@@ -38,21 +38,7 @@ export function createWorkflowGitPasses(ports) {
             if (canonicalJson(ports.admitNode(context, target)) !==
                 canonicalJson(admitted))
                 throw ports.denied();
-            const pass = workflowGitPassResultSchema.parse(await ports.open(grant.computerId, grant));
-            try {
-                await ports.admitMemberGitAccess(grant.memberId, grant.gitAccess.repository, scope);
-                if (canonicalJson(ports.admitNode(context, target)) !==
-                    canonicalJson(admitted))
-                    throw ports.denied();
-            }
-            catch (cause) {
-                await ports.revoke(grant.computerId, {
-                    teamId: grant.teamId,
-                    runId: grant.runId,
-                });
-                throw cause;
-            }
-            return pass;
+            return grant;
         },
         async deliverCleanups() {
             try {

package/dist/runtime/graph-contract.d.ts

@@ -416,7 +416,7 @@ export declare const graphRunSchema: S.Struct<{
             readonly graphId: S.optionalKey<S.String>;
             readonly nodeId: S.String;
             readonly level: S.Literals<readonly ["read", "write"]>;
-            readonly capabilities: S.$Array<S.Literals<readonly ["agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>>;
+            readonly capabilities: S.$Array<S.Literals<readonly ["approvals", "agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>>;
             readonly bindings: S.$Array<S.Union<S.Struct<{
                 readonly name: S.Literal<"BACKGROUND" | "GIT" | "EVENTS" | "APPS" | "WORKFLOWS" | "APP_STORAGE" | "MEDIA" | "COMPUTER" | "INBOX" | "AGENTS">;
                 readonly operations: S.$Array<S.Literals<string[]>>;

package/dist/runtime/ports.d.ts

@@ -145,10 +145,17 @@ export type WorkflowTriggerRunPorts = Readonly<{
     startCachedGraph(binding: import("./trigger-owner.js").ArmedWorkflowTrigger, request: Pick<import("./graph-start.js").GraphStartRequest, "requestId" | "input"> & {
         /** The firing event's repository, evaluated from the armed trigger. */
         triggerRepository?: string;
-    }): Promise<Exclude<GraphStartReply, {
+    }, 
+    /** Host-private binding check, evaluated with the durable run write. */
+    admission?: WorkflowTriggerAdmission): Promise<Exclude<GraphStartReply, {
         kind: "invalid";
     }>>;
 }>;
+/** Host-private checks and reservation identity, never supplied by a sender. */
+export type WorkflowTriggerAdmission = Readonly<{
+    admitBinding(): boolean;
+    reservationId?: string;
+}>;
 /** Hosts retain their existing error vocabulary and denial classification. */
 export type WorkflowErrorPort = Readonly<{
     denied(): Error;

package/dist/runtime/run-ceiling.d.ts

@@ -51,7 +51,7 @@ export declare const runCeilingSchema: S.Struct<{
         readonly graphId: S.optionalKey<S.String>;
         readonly nodeId: S.String;
         readonly level: S.Literals<readonly ["read", "write"]>;
-        readonly capabilities: S.$Array<S.Literals<readonly ["agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>>;
+        readonly capabilities: S.$Array<S.Literals<readonly ["approvals", "agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>>;
         readonly bindings: S.$Array<S.Union<S.Struct<{
             readonly name: S.Literal<"BACKGROUND" | "GIT" | "EVENTS" | "APPS" | "WORKFLOWS" | "APP_STORAGE" | "MEDIA" | "COMPUTER" | "INBOX" | "AGENTS">;
             readonly operations: S.$Array<S.Literals<string[]>>;

package/dist/runtime/run-owner.d.ts

@@ -1,11 +1,12 @@
 import * as S from "effect/Schema";
 import { type NodeEvent, type NodeAdmissionResult } from "../execution.js";
+import { z } from "zod";
 import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
 import { type WorkflowRunAuthority } from "./run-authority.js";
 import type { ArmedWorkflowTrigger } from "./trigger-owner.js";
 import { type WorkflowRunContext, type GraphRun, type WorkflowRunDelivery } from "./graph-contract.js";
 import { type StoredWorkflowNode } from "./graph-dispatch.js";
-import type { WorkflowAppCall, WorkflowAppCallResult, WorkflowCatalogEntry } from "./ports.js";
+import type { WorkflowAppCall, WorkflowAppCallResult, WorkflowCatalogEntry, WorkflowTriggerAdmission } from "./ports.js";
 import { type GraphStartRequest } from "./graph-start.js";
 /** The member can supply a plan, never stored authority or a captured ceiling. */
 export declare const memberCompiledGraphStartSchema: S.Struct<{
@@ -301,6 +302,8 @@ export declare function createTeamWorkflowRuns(options: {
     sql: WatchdogSqliteOwner["sql"];
     transactionSync: <T>(body: () => T) => T;
     teamId: () => string;
+    /** Host-owned wall clock; deterministic native journeys may supply their clock. */
+    now?: () => number;
     admission: () => "active" | "suspended";
     errors: Readonly<{
         app(code: "denied" | "invalid" | "unavailable"): Error;
@@ -655,7 +658,7 @@ export declare function createTeamWorkflowRuns(options: {
                     readonly operations: readonly string[];
                 }[];
                 readonly nodeId: string;
-                readonly capabilities: readonly ("agent.list" | "agent.manage" | "agent.rename" | "agent.avatar" | "agent.toolPolicy" | "agent.read" | "agent.send" | "computer.list" | "computer.readFile" | "computer.writeFile" | "computer.execute" | "llm.generation" | "media.generation" | "games:servers" | "git.repository" | "apps.open" | "apps.call" | "app.storage" | "app.events.emit" | "team.workbenchHost" | "marketplace.browse" | "marketplace.purchase" | "workflow.run" | "workflow.publish" | "workflow.arm" | "world" | "channels.read" | "channels.personal.manage")[];
+                readonly capabilities: readonly ("approvals" | "agent.list" | "agent.manage" | "agent.rename" | "agent.avatar" | "agent.toolPolicy" | "agent.read" | "agent.send" | "computer.list" | "computer.readFile" | "computer.writeFile" | "computer.execute" | "llm.generation" | "media.generation" | "games:servers" | "git.repository" | "apps.open" | "apps.call" | "app.storage" | "app.events.emit" | "team.workbenchHost" | "marketplace.browse" | "marketplace.purchase" | "workflow.run" | "workflow.publish" | "workflow.arm" | "world" | "channels.read" | "channels.personal.manage")[];
                 readonly graphId?: string;
             }[];
             readonly nodeGitAccess: readonly {
@@ -1555,7 +1558,7 @@ export declare function createTeamWorkflowRuns(options: {
     }>;
     startCachedGraph(binding: ArmedWorkflowTrigger, started: Pick<GraphStartRequest, "requestId" | "input"> & {
         triggerRepository?: string;
-    }): Promise<{
+    }, admission?: WorkflowTriggerAdmission): Promise<{
         kind: "conflict" | "started" | "replay";
         runId: string;
         planDigest: string;
@@ -1581,6 +1584,66 @@ export declare function createTeamWorkflowRuns(options: {
     revokeReleaseInMutation(appIds: readonly string[]): void;
     /** The kernel's lifecycle caller owns the transaction. Suspension ends every run. */
     onLifecycle(status: "active" | "suspended"): void;
+    reserveWebhookDelivery(raw: z.input<z.ZodObject<{
+        scope: z.ZodLazy<z.ZodObject<{
+            installationId: z.ZodString;
+            workflowId: z.ZodString;
+            commit: z.ZodString;
+            triggerId: z.ZodString;
+        }, z.core.$strict>>;
+        delivery: z.ZodObject<{
+            host: z.ZodString;
+            tenant: z.ZodString;
+            bindingId: z.ZodString;
+            eventId: z.ZodString;
+        }, z.core.$strict>;
+        cargo: z.ZodJSONSchema;
+        limits: z.ZodObject<{
+            hostConcurrency: z.ZodNumber;
+            bindingConcurrency: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>>): {
+        kind: "reserved" | "replay";
+        reservationId: string;
+        runId: string | null;
+    } | {
+        kind: "refused";
+        reason: "limit";
+    };
+    pendingWebhookDeliveries(rawOwner: z.input<z.ZodObject<{
+        host: z.ZodString;
+        tenant: z.ZodString;
+    }, z.core.$strict>>): ({
+        kind: "launch";
+        reservationId: string;
+        runId: string;
+    } | {
+        scope: {
+            installationId: string;
+            workflowId: string;
+            commit: string;
+            triggerId: string;
+        };
+        delivery: {
+            host: string;
+            tenant: string;
+            bindingId: string;
+            eventId: string;
+        };
+        cargo: z.core.util.JSONType;
+        limits: {
+            hostConcurrency: number;
+            bindingConcurrency: number;
+        };
+        kind: "start";
+        reservationId: string;
+        runId?: never;
+    })[];
+    nextWebhookWake(rawOwner: z.input<z.ZodObject<{
+        host: z.ZodString;
+        tenant: z.ZodString;
+    }, z.core.$strict>>): number | null;
+    completeWebhookDelivery(rawReservationId: string): void;
     reserveTriggerRun(raw: {
         scope: import("./trigger-run-reservations.js").TriggerRunScope;
         requestId: string;
@@ -1599,7 +1662,7 @@ export declare function createTeamWorkflowRuns(options: {
         list(filter: {
             installationId: string;
             actorId?: string;
-            workflowId? /** A report names its Workflows library, so only a library run may declare one. */: string;
+            workflowId?: string;
         }): readonly (GraphRun & {
             startedAt: number;
         })[];

package/dist/runtime/run-owner.js

@@ -384,7 +384,7 @@ export function createTeamWorkflowRuns(options) {
                 throw options.errors.app("denied");
             return startCompiled(preparation, request, identity, ceiling, undefined, publication, libraryInstallationId);
         },
-        async startCachedGraph(binding, started) {
+        async startCachedGraph(binding, started, admission) {
             const { triggerRepository, ...request } = started;
             await admitGraphMember(binding.armedBy, binding.computerId);
             const stored = triggerPlans.read(binding);
@@ -467,15 +467,30 @@ export function createTeamWorkflowRuns(options) {
                 trigger = { ...trigger, nodeGitAccess: binding.nodeGitAccess };
             if (triggerRepository !== undefined)
                 trigger = { ...trigger, repository: triggerRepository };
-            return startCompiled(preparation, binding.delivery === undefined
-                ? request
-                : { ...request, delivery: binding.delivery }, identity, ceiling, trigger, {
-                installationId: binding.installationId,
-                workflowId: binding.workflowId,
-                commit: binding.commit,
-                digest: binding.digest,
-                armedBy: { kind: "member", memberId: binding.armedBy },
-            }, binding.installationId);
+            return options.transactionSync(() => {
+                // Different external bindings may share the compiled publication.
+                // Check the binding's owning store after all capture I/O, in the same
+                // transaction as the durable start, rather than invalidating its peers.
+                if (admission !== undefined && !admission.admitBinding())
+                    return {
+                        kind: "refused",
+                        reason: "Trigger binding is no longer armed",
+                    };
+                const result = startCompiled(preparation, binding.delivery === undefined
+                    ? request
+                    : { ...request, delivery: binding.delivery }, identity, ceiling, trigger, {
+                    installationId: binding.installationId,
+                    workflowId: binding.workflowId,
+                    commit: binding.commit,
+                    digest: binding.digest,
+                    armedBy: { kind: "member", memberId: binding.armedBy },
+                }, binding.installationId);
+                if (admission?.reservationId !== undefined &&
+                    (result.kind === "started" || result.kind === "replay") &&
+                    triggerReservations.bindTriggerRun(admission.reservationId, result.runId) === "conflict")
+                    throw new Error("Trigger reservation binding conflict");
+                return result;
+            });
         },
         callWorkflowApp: options.callWorkflowApp,
         admitDelivery: options.admitDelivery,

package/dist/runtime/schedules.d.ts

@@ -24,6 +24,7 @@ export declare function createWorkflowSchedules(options: {
     }>;
     list(principal: WorkflowTriggerPrincipal, installationId: string): Promise<{
         scheduleId: string;
+        installationId: string;
         workflowId: string;
         triggerId: string;
         nextDueAt: number;

package/dist/runtime/schedules.js

@@ -95,6 +95,7 @@ export function createWorkflowSchedules(options) {
                 .filter((record) => record.installationId === installationId)
                 .map((record) => ({
                 scheduleId: record.id,
+                installationId: record.installationId,
                 workflowId: record.workflowId,
                 triggerId: record.triggerId,
                 nextDueAt: record.nextDueAt,

package/dist/runtime/trigger-owner.d.ts

@@ -3,7 +3,7 @@ import * as S from "effect/Schema";
 import { type GitBinding, type RepositoryRef } from "@fungi.computer/agar/git";
 import { type TriggerEvent } from "../index.js";
 import { type WorkflowArmingAuthorityPorts, type WorkflowArmingReceipt } from "./arming-authority.js";
-import type { PublishedDefinitionPort, WorkflowPublicationContext, WorkflowTriggerRunPorts, WorkflowErrorPort } from "./ports.js";
+import type { PublishedDefinitionPort, WorkflowPublicationContext, WorkflowTriggerRunPorts, WorkflowErrorPort, WorkflowTriggerAdmission } from "./ports.js";
 export declare const workflowTriggerTargetSchema: z.ZodObject<{
     installationId: z.ZodString;
     workflowId: z.ZodString;
@@ -581,7 +581,7 @@ export declare function createTeamWorkflowTriggers(options: {
     invalidateInstallation: (installationId: string) => void;
     /** The single native push owner supplies host-issued Git, never a fire caller. */
     revalidatePublished(installationId: string, git: GitBinding): Promise<void>;
-    fire(raw: ArmedWorkflowTrigger, scope: string, event: TriggerEvent): Promise<Readonly<{
+    fire(raw: ArmedWorkflowTrigger, scope: string, event: TriggerEvent, admission?: WorkflowTriggerAdmission): Promise<Readonly<{
         kind: "ignored";
     }> | Readonly<{
         kind: "started" | "replay" | "conflict";

package/dist/runtime/trigger-owner.js

@@ -213,7 +213,7 @@ export function createTeamWorkflowTriggers(options) {
                     options.runs.triggerPlans.refuse(binding, "commit no longer published");
             }
         },
-        async fire(raw, scope, event) {
+        async fire(raw, scope, event, admission) {
             const binding = armedWorkflowTriggerSchema.parse(raw);
             try {
                 const current = await options.admit(binding.armedBy, binding.installationId, binding.computerId);
@@ -256,7 +256,7 @@ export function createTeamWorkflowTriggers(options) {
                 };
                 const result = await options.runs.startCachedGraph(binding, mapped.repository === undefined
                     ? request
-                    : { ...request, triggerRepository: mapped.repository });
+                    : { ...request, triggerRepository: mapped.repository }, admission);
                 if (result.kind === "refused")
                     return result;
                 if (result.kind === "conflict")

package/dist/runtime/trigger-run-reservations.d.ts

@@ -7,8 +7,72 @@ declare const triggerRunScopeSchema: z.ZodLazy<z.ZodObject<{
     triggerId: z.ZodString;
 }, z.core.$strict>>;
 export type TriggerRunScope = z.output<typeof triggerRunScopeSchema>;
+declare const deliveryInputSchema: z.ZodObject<{
+    scope: z.ZodLazy<z.ZodObject<{
+        installationId: z.ZodString;
+        workflowId: z.ZodString;
+        commit: z.ZodString;
+        triggerId: z.ZodString;
+    }, z.core.$strict>>;
+    delivery: z.ZodObject<{
+        host: z.ZodString;
+        tenant: z.ZodString;
+        bindingId: z.ZodString;
+        eventId: z.ZodString;
+    }, z.core.$strict>;
+    cargo: z.ZodJSONSchema;
+    limits: z.ZodObject<{
+        hostConcurrency: z.ZodNumber;
+        bindingConcurrency: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+declare const deliveryOwnerSchema: z.ZodObject<{
+    host: z.ZodString;
+    tenant: z.ZodString;
+}, z.core.$strict>;
 /** The enclosing Team owner supplies SQLite; callers never select the Team. */
-export declare function createTriggerRunReservations(options: Pick<WatchdogSqliteOwner, "sql" | "transactionSync">): {
+export declare function createTriggerRunReservations(options: Pick<WatchdogSqliteOwner, "sql" | "transactionSync"> & {
+    now?: () => number;
+}): {
+    /** Opaque verified cargo and delivery identity live with the run reservation. */
+    reserveWebhookDelivery(raw: z.input<typeof deliveryInputSchema>): {
+        kind: "reserved" | "replay";
+        reservationId: string;
+        runId: string | null;
+    } | {
+        kind: "refused";
+        reason: "limit";
+    };
+    /** Bounded restart/lost-launch-reply recovery over the SAME reservations. */
+    pendingWebhookDeliveries(rawOwner: z.input<typeof deliveryOwnerSchema>): ({
+        kind: "launch";
+        reservationId: string;
+        runId: string;
+    } | {
+        scope: {
+            installationId: string;
+            workflowId: string;
+            commit: string;
+            triggerId: string;
+        };
+        delivery: {
+            host: string;
+            tenant: string;
+            bindingId: string;
+            eventId: string;
+        };
+        cargo: z.core.util.JSONType;
+        limits: {
+            hostConcurrency: number;
+            bindingConcurrency: number;
+        };
+        kind: "start";
+        reservationId: string;
+        runId?: never;
+    })[];
+    /** Native alarms share this deadline with schedules, including idle TTL cleanup. */
+    nextWebhookWake(rawOwner: z.input<typeof deliveryOwnerSchema>): number | null;
+    completeWebhookDelivery(rawReservationId: string): void;
     reserveTriggerRun(raw: {
         scope: TriggerRunScope;
         requestId: string;

package/dist/runtime/trigger-run-reservations.js

@@ -33,15 +33,134 @@ const scopeKey = (scope) => {
         parsed.triggerId,
     ]);
 };
+const deliveryIdentitySchema = z.strictObject({
+    host: identity,
+    tenant: identity,
+    bindingId: identity,
+    eventId: identity,
+});
+const deliveryInputSchema = z.strictObject({
+    scope: triggerRunScopeSchema,
+    delivery: deliveryIdentitySchema,
+    cargo: z.json(),
+    limits: z.strictObject({
+        hostConcurrency: z.number().int().positive().max(20),
+        bindingConcurrency: z.number().int().positive().max(20),
+    }),
+});
+const deliveryOwnerSchema = deliveryIdentitySchema.pick({
+    host: true,
+    tenant: true,
+});
+const pendingDeliverySchema = rowSchema.and(z.object({
+    scope: z.string(),
+    delivery_record: z.string().nullable(),
+}));
+const DAY = 24 * 60 * 60 * 1000;
 /** The enclosing Team owner supplies SQLite; callers never select the Team. */
 export function createTriggerRunReservations(options) {
     const { sql } = options;
+    const now = options.now ?? Date.now;
     sql.exec(`CREATE TABLE IF NOT EXISTS hub_trigger_run_reservations (
     reservation_id TEXT PRIMARY KEY, scope TEXT NOT NULL, request_id TEXT NOT NULL,
     run_id TEXT UNIQUE, status TEXT NOT NULL CHECK(status IN ('active','released','terminal')),
+    delivery_key TEXT, delivery_record TEXT, delivery_expires_at INTEGER,
+    delivery_host TEXT, delivery_tenant TEXT, delivery_binding TEXT,
+    delivery_pending INTEGER NOT NULL DEFAULT 0 CHECK(delivery_pending IN (0,1)),
     UNIQUE(scope,request_id)
   ) STRICT`);
+    sql.exec(`CREATE INDEX IF NOT EXISTS hub_trigger_delivery_identity
+    ON hub_trigger_run_reservations(delivery_key,delivery_expires_at)`);
+    sql.exec(`CREATE INDEX IF NOT EXISTS hub_trigger_delivery_expiry
+    ON hub_trigger_run_reservations(delivery_expires_at)`);
+    const expireDeliveries = () => {
+        const at = now();
+        // An expired unstarted intent cannot wake forever. A recorded active run
+        // still owns its concurrency slot even after delivery deduplication expires.
+        sql.exec("UPDATE hub_trigger_run_reservations SET status='terminal',delivery_pending=0 WHERE reservation_id IN (SELECT reservation_id FROM hub_trigger_run_reservations WHERE delivery_expires_at<=? AND run_id IS NULL LIMIT 100)", at);
+        sql.exec("DELETE FROM hub_trigger_run_reservations WHERE reservation_id IN (SELECT reservation_id FROM hub_trigger_run_reservations WHERE delivery_expires_at<=? AND status!='active' AND delivery_pending=0 LIMIT 100)", at);
+        sql.exec("UPDATE hub_trigger_run_reservations SET delivery_key=NULL,delivery_record=NULL,delivery_expires_at=NULL WHERE reservation_id IN (SELECT reservation_id FROM hub_trigger_run_reservations WHERE delivery_expires_at<=? AND run_id IS NOT NULL LIMIT 100)", at);
+        sql.exec("DELETE FROM hub_trigger_run_reservations WHERE reservation_id IN (SELECT reservation_id FROM hub_trigger_run_reservations WHERE delivery_host IS NOT NULL AND delivery_expires_at IS NULL AND status!='active' AND delivery_pending=0 LIMIT 100)");
+    };
     return {
+        /** Opaque verified cargo and delivery identity live with the run reservation. */
+        reserveWebhookDelivery(raw) {
+            const input = deliveryInputSchema.parse(raw);
+            const key = JSON.stringify(input.delivery);
+            return options.transactionSync(() => {
+                expireDeliveries();
+                const prior = sql
+                    .exec("SELECT reservation_id,run_id,status FROM hub_trigger_run_reservations WHERE delivery_key=? AND delivery_expires_at>? ORDER BY delivery_expires_at DESC LIMIT 1", key, now())
+                    .toArray()[0];
+                if (prior !== undefined) {
+                    const row = rowSchema.parse(prior);
+                    return {
+                        kind: "replay",
+                        reservationId: row.reservation_id,
+                        runId: row.run_id,
+                    };
+                }
+                const active = z
+                    .object({
+                    count: z.number(),
+                    binding_count: z.number(),
+                })
+                    .parse(sql
+                    .exec("SELECT count(*) AS count,coalesce(sum(delivery_host=? AND delivery_tenant=? AND delivery_binding=?),0) AS binding_count FROM hub_trigger_run_reservations WHERE status='active'", input.delivery.host, input.delivery.tenant, input.delivery.bindingId)
+                    .toArray()[0]);
+                if (active.count >= input.limits.hostConcurrency ||
+                    active.binding_count >= input.limits.bindingConcurrency)
+                    return { kind: "refused", reason: "limit" };
+                const reservationId = reservationIds.reservation.generate();
+                sql.exec("INSERT INTO hub_trigger_run_reservations(reservation_id,scope,request_id,run_id,status,delivery_key,delivery_record,delivery_expires_at,delivery_pending,delivery_host,delivery_tenant,delivery_binding) VALUES(?,?,?,NULL,'active',?,?,?,1,?,?,?)", reservationId, scopeKey(input.scope), reservationId, key, JSON.stringify(input), now() + DAY, input.delivery.host, input.delivery.tenant, input.delivery.bindingId);
+                return { kind: "reserved", reservationId, runId: null };
+            });
+        },
+        /** Bounded restart/lost-launch-reply recovery over the SAME reservations. */
+        pendingWebhookDeliveries(rawOwner) {
+            const owner = deliveryOwnerSchema.parse(rawOwner);
+            return options.transactionSync(() => {
+                expireDeliveries();
+                return sql
+                    .exec("SELECT reservation_id,run_id,status,scope,delivery_record FROM hub_trigger_run_reservations WHERE delivery_host=? AND delivery_tenant=? AND delivery_pending=1 ORDER BY delivery_expires_at LIMIT 32", owner.host, owner.tenant)
+                    .toArray()
+                    .map((raw) => {
+                    const row = pendingDeliverySchema.parse(raw);
+                    if (row.run_id !== null)
+                        return {
+                            kind: "launch",
+                            reservationId: row.reservation_id,
+                            runId: row.run_id,
+                        };
+                    const record = deliveryInputSchema.parse(JSON.parse(z.string().parse(row.delivery_record)));
+                    return {
+                        kind: "start",
+                        reservationId: row.reservation_id,
+                        ...record,
+                    };
+                });
+            });
+        },
+        /** Native alarms share this deadline with schedules, including idle TTL cleanup. */
+        nextWebhookWake(rawOwner) {
+            const owner = deliveryOwnerSchema.parse(rawOwner);
+            return options.transactionSync(() => {
+                expireDeliveries();
+                const row = z
+                    .object({
+                    pending: z.number(),
+                    expiry: z.number().nullable(),
+                })
+                    .parse(sql
+                    .exec("SELECT coalesce(max(delivery_pending),0) AS pending,min(delivery_expires_at) AS expiry FROM hub_trigger_run_reservations WHERE delivery_host=? AND delivery_tenant=?", owner.host, owner.tenant)
+                    .toArray()[0]);
+                return row.pending === 1 ? now() + 1000 : row.expiry;
+            });
+        },
+        completeWebhookDelivery(rawReservationId) {
+            const reservationId = identity.parse(rawReservationId);
+            sql.exec("UPDATE hub_trigger_run_reservations SET delivery_pending=0,delivery_record=NULL,status=CASE WHEN run_id IS NULL THEN 'terminal' ELSE status END WHERE reservation_id=? AND delivery_pending=1", reservationId);
+        },
         reserveTriggerRun(raw) {
             const input = reservationInputSchema.parse(raw);
             const scope = scopeKey(input.scope);

package/dist/workflow-id.d.ts

@@ -1,3 +1,3 @@
-import { z } from "zod";
+import * as z from "zod";
 /** Identity of a versioned Workflow document, shared by hosts and the Trellis App. */
 export declare const workflowIdSchema: z.ZodString;

package/dist/workflow-id.js

@@ -1,3 +1,3 @@
-import { z } from "zod";
+import * as z from "zod";
 /** Identity of a versioned Workflow document, shared by hosts and the Trellis App. */
 export const workflowIdSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/braid",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "author": "Levi <levi@technomancy.dev>",
   "type": "module",
   "description": "Pure versioned Workflow graph validation and content-addressed compilation",
@@ -29,17 +29,17 @@
   ],
   "dependencies": {
     "@cfworker/json-schema": "4.1.1",
-    "@fungi.computer/almanac": "0.1.0",
-    "@fungi.computer/mycelium": "0.1.0",
+    "@fungi.computer/almanac": "0.2.0",
+    "@fungi.computer/mycelium": "0.2.0",
     "effect": "4.0.2",
     "jsonpointer": "5.0.1",
     "mustache": "4.2.0",
     "zod": "4.4.3",
-    "@fungi.computer/agar": "0.2.0",
-    "@fungi.computer/gills": "0.1.0",
-    "@fungi.computer/watchdog": "0.0.1",
-    "@fungi.computer/puffball": "0.1.0",
-    "@fungi.computer/cairn": "0.0.1"
+    "@fungi.computer/agar": "0.3.0",
+    "@fungi.computer/gills": "0.2.0",
+    "@fungi.computer/watchdog": "0.1.0",
+    "@fungi.computer/puffball": "0.2.0",
+    "@fungi.computer/cairn": "0.1.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "5.20260828.1",