@fungi.computer/oyster 0.1.0 → 0.3.0

package/dist/webhooks.js

@@ -0,0 +1,189 @@
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import { z } from "zod";
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import { armedWorkflowTriggerSchema, workflowTriggerTargetSchema, } from "@fungi.computer/braid/runtime";
+import { workflowWebhookCustody, workflowWebhookVerifierSchema, } from "./webhook-custody.js";
+import { workflowWebhookIngress, } from "./webhook-ingress.js";
+import { workflowWebhookAbuse } from "./webhook-abuse.js";
+const ids = defineIdFamily({
+    family: "workflow-webhooks",
+    version: 1,
+    kinds: { binding: { prefix: "workflow_hook" } },
+});
+const cargoSchema = z.strictObject({
+    binding: armedWorkflowTriggerSchema,
+    body: z.json(),
+    headers: z.partialRecord(z.enum(["content-type", "x-github-event"]), z.string().max(1024)),
+});
+const bindingId = z.string().min(1).max(256);
+export const workflowWebhookCommandSchema = z.discriminatedUnion("operation", [
+    z.strictObject({
+        operation: z.literal("create"),
+        target: workflowTriggerTargetSchema,
+        computerId: bindingId,
+        verifier: workflowWebhookVerifierSchema,
+    }),
+    z.strictObject({
+        operation: z.enum(["rotate", "retirePrevious", "revoke"]),
+        bindingId,
+    }),
+    z.strictObject({ operation: z.literal("list"), after: bindingId.optional() }),
+]);
+/**
+ * Dispatch the hosts' decoded closed control contract. Hosts decode before
+ * resolving installation dependencies; only they supply the current pin and
+ * their captured target.
+ */
+export async function workflowWebhookControlResponse(webhooks, principal, command, authorize) {
+    if (command.operation === "create") {
+        const { target, authority } = await authorize(command.target, command.computerId);
+        return Response.json(await webhooks.create(principal, target, command.computerId, authority, command.verifier), { headers: { "cache-control": "no-store" } });
+    }
+    const result = command.operation === "list"
+        ? await webhooks.list(principal, command.after)
+        : await webhooks[command.operation](principal, command.bindingId);
+    return Response.json(result, { headers: { "cache-control": "no-store" } });
+}
+/**
+ * Host-owned composition: custody verifies, Braid reserves/maps/starts, and the
+ * host's ordinary idempotent launch ensures its recorded engine instance.
+ * No separate intake state machine or run/settlement store exists here.
+ */
+export function createWorkflowWebhooks(options) {
+    const custody = workflowWebhookCustody(options);
+    const abuse = workflowWebhookAbuse({
+        ...options.abuse,
+        scope: options.scope,
+    });
+    let recovering = false;
+    const nextWake = () => options.runs.nextWebhookWake(options.scope);
+    const receive = workflowWebhookIngress({
+        limits: options.limits,
+        hostLease: () => abuse.hostLease(),
+        reportReadFailure: () => {
+            options.reportFailure();
+        },
+        reportOwnerFailure: () => {
+            options.reportFailure();
+        },
+        async deliver(delivery) {
+            if (!(await abuse.bindingAdmission(delivery.bindingId)))
+                return { status: "refused" };
+            const verified = custody.verification.verify(delivery);
+            if (verified.status !== "ok")
+                return { status: "refused" };
+            const body = z
+                .json()
+                .parse(JSON.parse(new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(delivery.body)));
+            const headers = Object.fromEntries(["content-type", "x-github-event"].flatMap((name) => {
+                const value = delivery.headers.get(name);
+                return value === null ? [] : [[name, value]];
+            }));
+            const cargo = cargoSchema.parse({
+                binding: verified.binding,
+                body,
+                headers,
+            });
+            const reserved = options.transactionSync(() => {
+                if (!custody.verification.isActive(delivery.bindingId))
+                    return { kind: "refused" };
+                return options.runs.reserveWebhookDelivery({
+                    scope: {
+                        installationId: cargo.binding.installationId,
+                        workflowId: cargo.binding.workflowId,
+                        commit: cargo.binding.commit,
+                        triggerId: cargo.binding.triggerId,
+                    },
+                    delivery: {
+                        ...options.scope,
+                        bindingId: delivery.bindingId,
+                        eventId: verified.eventId,
+                    },
+                    cargo: z.json().parse(cargo),
+                    limits: abuse.concurrency,
+                });
+            });
+            if (reserved.kind === "refused")
+                return { status: "refused" };
+            const accepted = {
+                status: "accepted",
+                deliveryId: reserved.reservationId,
+            };
+            // Admission already committed. A lost wake acknowledgement cannot undo
+            // it or prove refusal; the existing recovery owner retains this identity.
+            try {
+                await options.wake();
+            }
+            catch {
+                options.reportFailure();
+                return accepted;
+            }
+            return accepted;
+        },
+    });
+    return {
+        receive,
+        nextWake,
+        async create(principal, target, computerId, authority, verifier) {
+            const creator = await options.owner(principal);
+            if (creator === null)
+                return { kind: "refused" };
+            const armed = await options.triggers.arm({ armedBy: creator, armedVia: null }, target, computerId, authority);
+            if (armed.kind !== "armed")
+                return armed;
+            if (armed.trigger.on !== "webhook")
+                return { kind: "refused" };
+            return custody.create(principal, ids.binding.generate(), verifier, armed.binding);
+        },
+        rotate: (principal, bindingId) => custody.rotate(principal, bindingId),
+        retirePrevious: (principal, bindingId) => custody.retirePrevious(principal, bindingId),
+        revoke: (principal, bindingId) => custody.revoke(principal, bindingId),
+        list: (principal, after = null) => custody.list(principal, after),
+        async recover() {
+            if (recovering)
+                return;
+            recovering = true;
+            try {
+                for (const row of options.runs.pendingWebhookDeliveries(options.scope)) {
+                    const outcome = await Effect.runPromise(Effect.result(Effect.tryPromise(async () => {
+                        if (row.kind === "launch") {
+                            // Durable admission linearized before revocation; finish ensuring
+                            // THAT existing run, never admit a fresh run from expired cargo.
+                            const run = options.runs.graph.read(row.runId);
+                            if (run === null)
+                                throw new Error("Reserved Workflow run is missing");
+                            await options.launch({
+                                runId: row.runId,
+                                planDigest: run.plan.planDigest,
+                            });
+                        }
+                        else {
+                            const cargo = cargoSchema.parse(row.cargo);
+                            const active = () => custody.verification.isActive(row.delivery.bindingId);
+                            if (active())
+                                await options.triggers.fire(cargo.binding, row.reservationId, {
+                                    body: cargo.body,
+                                    headers: cargo.headers,
+                                    eventId: row.delivery.eventId,
+                                }, {
+                                    admitBinding: active,
+                                    reservationId: row.reservationId,
+                                });
+                        }
+                        options.runs.completeWebhookDelivery(row.reservationId);
+                    })));
+                    if (Result.isFailure(outcome)) {
+                        // Leave the SAME reservation pending; do not expose error text or
+                        // mint a replacement request after a lost launch response.
+                        options.reportFailure();
+                    }
+                }
+            }
+            finally {
+                recovering = false;
+                await options.wake();
+            }
+        },
+    };
+}

package/dist/workers-git.d.ts

@@ -16,7 +16,7 @@ import { type OysterAgents } from "./agents.js";
 import { type ArtifactsNamespace } from "@fungi.computer/burrow";
 import { type HostEventSource, type HostRecipientEvent, type RecipientDelivery } from "./event-recipients.js";
 export type { HostEventSource, HostRecipientEvent, RecipientDelivery, } from "./event-recipients.js";
-import { type OysterCapability, type OysterEnv, type OysterGitHost, type OysterHost } from "./host.js";
+import { type OysterAuth, type OysterCapability, type OysterEnv, type OysterGitHost, type OysterHost } from "./host.js";
 import type { GitWriter } from "@fungi.computer/agar/git";
 import { OysterInstance, type OysterBindingContext, type OysterBindingRow, type OysterBindingTable, type OysterWorkspace, type OysterWorkerEnv, type OysterInvocationHost } from "./workers.js";
 /** The GIT binding plus the credential only the host's git door may use. */
@@ -166,16 +166,6 @@ declare const OysterBinding_base: abstract new (ctx: ExecutionContext, env: Oyst
 /** A git Worker's one guest binding entrypoint, over `gitBindings`. */
 export declare class OysterBinding extends OysterBinding_base {
 }
-/** One listed or issued key's owner-facing summary; never its secret or owner id. */
-export type OysterKeySummary = Readonly<{
-    keyId: string;
-    name: string;
-    grants: readonly Grant<OysterKeyCapability>[];
-    expiresAt: number | null;
-    createdAt: number;
-    lastUsedAt: number | null;
-    revokedAt: number | null;
-}>;
 /** Owner routes for keys and webhooks; `createOyster` mounts them owner-only. */
 export declare function gitAdminRoutes(env: OysterGitEnv, scope: TenantScope): Hono<OysterEnv>;
 /** A standalone Oyster Worker that also hosts git Apps. */
@@ -193,7 +183,7 @@ export type OysterGitWorkerEnv = OysterWorkerEnv & OysterGitEnv & Readonly<{
 export declare abstract class OysterGitInstance<Env extends OysterGitWorkerEnv = OysterGitWorkerEnv> extends OysterInstance<Env> {
     protected readonly bindings: OysterBindingTable<Env>;
     /** The deployable root's host for one pinned tenant: `root.hostFor(this.env, scope)`. */
-    protected abstract hostFor(scope: TenantScope): OysterHost;
+    protected abstract hostFor(scope: TenantScope): Promise<OysterHost>;
 }
 /**
  * One deployable Git root's options. Every door (HTTP, MCP, Agents, Workflows,
@@ -201,6 +191,8 @@ export declare abstract class OysterGitInstance<Env extends OysterGitWorkerEnv =
  * `oysterGitRoot(options).hostFor`.
  */
 export type OysterGitWorkerOptions<Env extends OysterGitWorkerEnv> = Readonly<{
+    /** Workflow controls supplied by the host's existing run owner. */
+    workflows?: (env: Env, host: OysterGitWorkerHost) => NonNullable<OysterHost["workflows"]>;
     /** Resolve one host-selected tenant before authentication; unknown origins refuse.
      * A single-owner root passes `ownerOrKeyTenancy`. */
     tenancy: (env: Env) => OysterTenancy;
@@ -217,11 +209,14 @@ export type OysterGitWorkerOptions<Env extends OysterGitWorkerEnv> = Readonly<{
      * workspace, but whether that key's owner is still this tenant's live
      * owner is this one port's job, never reimplemented against `env.KEYS`.
      */
-    workspace?: (env: Env, keysLive: OysterKeysLivePort) => OysterWorkspace;
+    workspace?: (env: Env, keysLive: OysterKeysLivePort, scope: TenantScope, request?: Readonly<{
+        request: Request;
+        auth: OysterAuth;
+    }>) => OysterWorkspace | Promise<OysterWorkspace>;
     /** Additional capabilities share the exact workspace selected for the base host. */
     capabilities?: (env: Env, workspace: OysterWorkspace, keysLive: OysterKeysLivePort) => readonly OysterCapability[];
-    /** Admit a host-minted Workflow Git pass for one repository and scope;
-     * omit when this host mints no Workflow Git passes. */
+    /** Admit a presented Workflow Git credential for one repository and scope;
+     * omit when this host issues no Workflow Git credentials. */
     workflowGitPass?: (env: Env, scope: TenantScope, pass: string, target: GitDoorTarget) => Promise<Extract<GitWriter, {
         kind: "actor";
     }> | null>;
@@ -249,7 +244,7 @@ export type OysterGitRoot<Env extends OysterGitWorkerEnv> = Readonly<{
     /** Select a request's tenant once; `hostFor` reuses that admission for the same request. */
     admit(env: Env, request: Request): Promise<ResolvedTenant | null>;
     /** One pinned tenant's host. HTTP, MCP, Agents, Workflows and background wakes all reach it here. */
-    hostFor(env: Env, scope: TenantScope): OysterGitWorkerHost;
+    hostFor(env: Env, scope: TenantScope, request?: Request): Promise<OysterGitWorkerHost>;
 }>;
 /** Compose a Git Worker's root from its one options value. */
 export declare function oysterGitRoot<Env extends OysterGitWorkerEnv>(options: OysterGitWorkerOptions<Env>): OysterGitRoot<Env>;
@@ -280,6 +275,6 @@ export declare function oysterWorkerGit<Env extends OysterGitWorkerEnv>(env: Env
  * One selected tenant's whole host from a root's options. Roots reach it through
  * `oysterGitRoot(options).hostFor`; a cold directory passes its own resolved tenant.
  */
-export declare function oysterGitWorkerHost<Env extends OysterGitWorkerEnv>(env: Env, options: OysterGitWorkerOptions<Env>, selected: ResolvedTenant): OysterGitWorkerHost;
+export declare function oysterGitWorkerHost<Env extends OysterGitWorkerEnv>(env: Env, options: OysterGitWorkerOptions<Env>, selected: ResolvedTenant, request?: Request): Promise<OysterGitWorkerHost>;
 /** Deploy the MCP owner from the same root as createOysterGitWorker. */
 export declare function createOysterGitMcpOwner<Env extends OysterGitWorkerEnv>(root: OysterGitRoot<Env>): new (ctx: DurableObjectState, env: Env) => import("./mcp-owner.js").OysterMcpOwner<Env>;

package/dist/workers-git.js

@@ -1,4 +1,3 @@
-import * as z from "zod";
 import { defaultTenant, implicitTenancy, tenantScope, } from "./tenant.js";
 import { createOysterMcpOwner } from "./mcp-owner.js";
 import { createAdmittedGit, createInstallationGitAdmission, } from "./git-admission.js";
@@ -15,19 +14,20 @@ import { AppInstanceError, selectionOf } from "./index.js";
 import { ownerOrKeyAuth } from "./auth.js";
 import { causeClass } from "./cause-class.js";
 import { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
 import * as Schema from "effect/Schema";
 import { defineIdFamily } from "@fungi.computer/cairn";
 import {} from "@fungi.computer/agar/git";
 import { parseAppMethodCallContext, workflowAttestationSchema, } from "@fungi.computer/puffball/app-method-runtime";
 import { lsRefsRequest, parseLsRefs, } from "./git.js";
-import { createKeyStore, } from "@fungi.computer/ear-tag/keys";
+import { createKeyStore, keyWire, } from "@fungi.computer/ear-tag/keys";
 import { oysterKeyVocabulary, } from "./keys.js";
 import { agentCapabilities, agentApprovalRoutes, agentMcpServerRoutes, } from "./agents.js";
 import { createArtifactsRestNamespace, } from "@fungi.computer/burrow";
 import { attemptWebhook } from "./webhook-delivery.js";
 import { createRecipientDeliveries, } from "./event-recipients.js";
 import { createOyster, oysterPrincipalIsOwner, } from "./host.js";
-import { OysterInstance, oysterBindingEntrypoint, oysterBindings, oysterWorkerHost, r2FileSource, r2ArtifactStore, } from "./workers.js";
+import { OysterInstance, oysterBindingEntrypoint, oysterBindings, oysterWorkerHost, r2FileSource, r2ArtifactStore, serveOysterBootCapability, } from "./workers.js";
 import { registryInstallations } from "./internal/registry-installations.js";
 const infoSchema = Schema.Struct({
     name: Schema.String,
@@ -473,7 +473,7 @@ export class OysterKeys extends DurableObject {
     }
     /** The live facts behind one key id, for the host's `keys.live` port; `null` for an unknown, revoked, expired or suspended key. */
     async live(keyId) {
-        const result = await this.#store.read("host", keyId);
+        const result = await this.#store.live({ keyId });
         if (result.kind !== "ok")
             return null;
         return {
@@ -764,30 +764,7 @@ const subscribeSchema = Schema.Struct({
 const keyNamePattern = /^[a-z0-9][a-z0-9-]{0,39}$/u;
 /** `invocation.ts:486` uses `team-key:visitor` for anonymous readers; a key can never claim that name. */
 const reservedKeyName = "visitor";
-const issueKeySchema = Schema.Struct({
-    name: Schema.String.check(Schema.isPattern(keyNamePattern)),
-    grants: Schema.Unknown,
-    expiresAt: Schema.optional(Schema.Number),
-});
-const revokeKeySchema = Schema.Struct({
-    keyId: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256)),
-    requestId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_.:-]{1,112}$/u)),
-});
-const oysterGrantsArraySchema = z
-    .array(oysterKeyVocabulary.grantSchema)
-    .min(1)
-    .max(64);
-function keySummary(record) {
-    return {
-        keyId: record.keyId,
-        name: record.name,
-        grants: record.scope?.grants ?? [],
-        expiresAt: record.expiresAt,
-        createdAt: record.createdAt,
-        lastUsedAt: record.lastUsedAt,
-        revokedAt: record.revokedAt,
-    };
-}
+const keysWire = keyWire(oysterKeyVocabulary);
 /** Owner routes for keys and webhooks; `createOyster` mounts them owner-only. */
 export function gitAdminRoutes(env, scope) {
     const routes = new Hono();
@@ -799,40 +776,44 @@ export function gitAdminRoutes(env, scope) {
         const listed = await keys().list(owner.actor.memberId);
         if (listed.kind === "error")
             return Response.json({ error: listed.error.code }, { status: 500 });
-        return Response.json({ keys: listed.value.map(keySummary) });
+        return Response.json({ keys: listed.value.map(keysWire.toSummary) });
     });
     routes.post("/api/keys", async (context) => {
-        const body = Schema.decodeUnknownOption(issueKeySchema)(await context.req.json());
-        if (body._tag === "None")
+        const body = keysWire.issue.safeParse(await context.req.json());
+        if (!body.success)
             return Response.json({ error: "Invalid key" }, { status: 400 });
-        if (body.value.name === reservedKeyName)
+        // Named identities and rate policy belong to this host, not the wire grammar.
+        if (!keyNamePattern.test(body.data.name) ||
+            body.data.name === reservedKeyName ||
+            body.data.keyId !== undefined ||
+            body.data.rateLimit !== undefined)
             return Response.json({ error: "Invalid key name" }, { status: 400 });
         const owner = context.get("principal");
         if (!oysterPrincipalIsOwner(owner))
             return Response.json({ error: "Owner only" }, { status: 403 });
-        const grants = oysterGrantsArraySchema.safeParse(body.value.grants);
-        if (!grants.success)
-            return Response.json({ error: "Invalid grants" }, { status: 400 });
         const issued = await keys().issue(owner.actor.memberId, {
-            name: body.value.name,
-            grants: grants.data,
-            expiresAt: body.value.expiresAt,
+            name: body.data.name,
+            grants: body.data.grants,
+            expiresAt: body.data.expiresAt,
         });
         if (issued.kind === "error")
             return Response.json({ error: issued.error.code }, { status: issued.error.code === "conflict" ? 409 : 400 });
-        return Response.json({ plaintext: issued.value.key, key: keySummary(issued.value.record) }, { status: 201 });
+        return Response.json({
+            plaintext: issued.value.key,
+            key: keysWire.toSummary(issued.value.record),
+        }, { status: 201 });
     });
     routes.post("/api/keys/revoke", async (context) => {
-        const body = Schema.decodeUnknownOption(revokeKeySchema)(await context.req.json());
-        if (body._tag === "None")
+        const body = keysWire.revoke.safeParse(await context.req.json());
+        if (!body.success)
             return Response.json({ error: "Invalid request" }, { status: 400 });
         const owner = context.get("principal");
         if (!oysterPrincipalIsOwner(owner))
             return Response.json({ error: "Owner only" }, { status: 403 });
-        const revoked = await keys().revoke(owner.actor.memberId, body.value.requestId, body.value.keyId);
+        const revoked = await keys().revoke(owner.actor.memberId, body.data.requestId, body.data.keyId);
         if (revoked.kind === "error")
             return Response.json({ error: revoked.error.code }, { status: revoked.error.code === "denied" ? 404 : 400 });
-        return Response.json({ key: keySummary(revoked.value) });
+        return Response.json({ key: keysWire.toSummary(revoked.value) });
     });
     routes.post("/api/webhooks", async (context) => {
         const body = Schema.decodeUnknownOption(subscribeSchema)(await context.req.json());
@@ -864,7 +845,11 @@ export function oysterGitRoot(options) {
     const stateOf = (env) => {
         let state = environments.get(env);
         if (state === undefined) {
-            state = { tenancy: options.tenancy(env), admissions: new WeakMap() };
+            state = {
+                tenancy: options.tenancy(env),
+                admissions: new WeakMap(),
+                authentications: new WeakMap(),
+            };
             environments.set(env, state);
         }
         return state;
@@ -877,12 +862,12 @@ export function oysterGitRoot(options) {
                 state.admissions.set(request, resolved);
             return resolved;
         },
-        hostFor(env, scope) {
+        hostFor(env, scope, request) {
             const state = stateOf(env);
             return oysterGitWorkerHost(env, options, {
                 scope,
-                auth: pinnedTenantAuth(state.tenancy, scope, state.admissions),
-            });
+                auth: pinnedTenantAuth(state.tenancy, scope, state.admissions, state.authentications),
+            }, request);
         },
     };
 }
@@ -907,7 +892,19 @@ export function createOysterGitWorker(root) {
             if (resolved === null)
                 return new Response("Not found", { status: 404 });
             const { scope } = resolved;
-            const key = `${scope.tenantId}:${scope.origin}`;
+            const boot = await serveOysterBootCapability(request, env, scope);
+            if (boot !== null)
+                return boot;
+            let host;
+            try {
+                host = await root.hostFor(env, scope, request);
+            }
+            catch (error) {
+                if (error instanceof HTTPException)
+                    return error.getResponse();
+                throw error;
+            }
+            const key = `${scope.tenantId}:${scope.origin}:${host.computerId ?? ""}`;
             let entry = hosts.get(key);
             let cache = true;
             if (entry === undefined) {
@@ -919,7 +916,7 @@ export function createOysterGitWorker(root) {
                         hosts.delete(idle[0]);
                     }
                 }
-                entry = { app: createOyster(root.hostFor(env, scope)), active: 0 };
+                entry = { app: createOyster(host), active: 0 };
                 if (cache)
                     hosts.set(key, entry);
             }
@@ -969,7 +966,7 @@ export function oysterWorkerGit(env, options, frame) {
                     if (selected.owner.kind !== "installation" ||
                         selected.owner.id !== current.installationId ||
                         selected.instanceId !== current.instanceId ||
-                        selected.authorityVersion !== current.authorityVersion ||
+                        selected.authorityVersion !== current.authority.authorityVersion ||
                         selected.appId !== current.release.appId ||
                         selected.releaseId !== current.release.releaseId ||
                         captured.release.appId !== current.release.appId ||
@@ -990,7 +987,8 @@ export function oysterWorkerGit(env, options, frame) {
                 beforeProvider();
                 if (current?.status !== "enabled" ||
                     current.instanceId !== installation.instanceId ||
-                    current.authorityVersion !== installation.authorityVersion ||
+                    current.authority.authorityVersion !==
+                        installation.authority.authorityVersion ||
                     current.release.appId !== installation.release.appId ||
                     current.release.releaseId !== installation.release.releaseId ||
                     current.release.artifact.artifactRef !==
@@ -1072,7 +1070,7 @@ export function oysterWorkerGit(env, options, frame) {
  * One selected tenant's whole host from a root's options. Roots reach it through
  * `oysterGitRoot(options).hostFor`; a cold directory passes its own resolved tenant.
  */
-export function oysterGitWorkerHost(env, options, selected) {
+export async function oysterGitWorkerHost(env, options, selected, request) {
     const { scope, auth } = selected;
     // The one path to a key's liveness: the stored owner id is re-checked
     // against the live, current owner on every read (S3 inherits this port,
@@ -1090,7 +1088,7 @@ export function oysterGitWorkerHost(env, options, selected) {
         });
         return current !== null && oysterPrincipalIsOwner(current) ? key : null;
     };
-    const workspace = options.workspace?.(env, keysLive) ?? {
+    const workspace = (await options.workspace?.(env, keysLive, scope, request === undefined ? undefined : { request, auth })) ?? {
         computerId: scope.computerName("workspace"),
         files: r2FileSource(env.RELEASES, scope.workspacePrefix),
     };
@@ -1133,6 +1131,8 @@ export function oysterGitWorkerHost(env, options, selected) {
     };
     if (options.pageScript !== undefined)
         host = { ...host, pageScript: options.pageScript };
+    if (options.workflows !== undefined)
+        host = { ...host, workflows: options.workflows(env, host) };
     if (options.homeInstallationId !== undefined)
         host = { ...host, homeInstallationId: options.homeInstallationId(env) };
     return host;
@@ -1141,7 +1141,7 @@ export function oysterGitWorkerHost(env, options, selected) {
  * Authenticate against the pinned tenant. A request admitted at the Worker's
  * top reuses that one admission; any other entry resolves its own.
  */
-function pinnedTenantAuth(tenancy, scope, admissions) {
+function pinnedTenantAuth(tenancy, scope, admissions, authentications) {
     const admitted = async (incoming) => admissions.get(incoming) ?? (await tenancy.resolve(incoming));
     return {
         resolve: async (actor) => {
@@ -1156,7 +1156,12 @@ function pinnedTenantAuth(tenancy, scope, admissions) {
             if (current?.scope.tenantId !== scope.tenantId ||
                 current.scope.origin !== scope.origin)
                 return { kind: "refused", status: 404 };
-            return current.auth.authenticate(incoming);
+            let authenticated = authentications.get(incoming);
+            if (authenticated === undefined) {
+                authenticated = current.auth.authenticate(incoming);
+                authentications.set(incoming, authenticated);
+            }
+            return authenticated;
         },
         login: async (incoming) => {
             const current = await admitted(incoming);