@fungi.computer/oyster 0.2.0 → 0.3.0

package/dist/standalone/workflow-host.js

@@ -7,7 +7,7 @@ import { verifyRelease, } from "../host.js";
 import { APP_INVOCATION_CEILING_MS, invocationAuthorityOf, invocationFacts, invocationFactsSchema, } from "../invocation.js";
 import { AppInstanceError } from "../index.js";
 import { appCapabilityIds } from "@fungi.computer/puffball";
-import { createGraphWorkflowRuns, compileForMember, graphStartRequestSchema, preparationFromRun, planNodeCall, workflowRunContextSchema, } from "@fungi.computer/braid/runtime";
+import { createGraphWorkflowRuns, createTriggerRunReservations, compileForMember, graphStartRequestSchema, preparationFromRun, planNodeCall, workflowRunContextSchema, } from "@fungi.computer/braid/runtime";
 import { appMethodCallContextSchema } from "@fungi.computer/puffball/app";
 import { appEventFactSchema, } from "@fungi.computer/puffball/app-event-facts";
 import { keyAppAccess } from "../keys.js";
@@ -97,7 +97,19 @@ const summarizedEntry = (entry) => {
 };
 /** The standalone host's installation admission, above the portable engine. */
 export function createStandaloneWorkflowHost(owner, host, options) {
-    const store = createGraphWorkflowRuns(owner);
+    const graph = createGraphWorkflowRuns(owner);
+    const reservations = createTriggerRunReservations(owner);
+    const store = {
+        ...graph,
+        markTerminal(...args) {
+            // The standalone run owner ends graph/review state and the SAME Braid
+            // reservation atomically, without creating a Hub Computer-cleanup queue.
+            owner.transactionSync(() => {
+                graph.markTerminal(...args);
+                reservations.terminalTriggerRun(args[0]);
+            });
+        },
+    };
     // Only the host's attested invocation context is associated here. Lifecycle,
     // events, reviews and replay are owned by the shared runtime store.
     owner.sql.exec(`CREATE TABLE IF NOT EXISTS standalone_workflow_callers (
@@ -169,14 +181,22 @@ export function createStandaloneWorkflowHost(owner, host, options) {
         if (declaration === null)
             return false;
         const snapshot = await deriveDeclaredOperations(selected.installation.release, declaration, host.capabilities ?? []);
-        return (grantsFor(selected.installation, declaration, snapshot, "workflow.publish") !== null);
+        return (grantsFor({
+            status: selected.installation.status,
+            authority: selected.installation.authority,
+            artifactDigest: selected.installation.release.artifact.artifactDigest,
+        }, declaration, snapshot, "workflow.publish") !== null);
     };
     const runGranted = async (selected) => {
         const declaration = selected.verified.declaration;
         if (declaration === null)
             return false;
         const snapshot = await deriveDeclaredOperations(selected.installation.release, declaration, host.capabilities ?? []);
-        if (grantsFor(selected.installation, declaration, snapshot, "workflow.run") === null)
+        if (grantsFor({
+            status: selected.installation.status,
+            authority: selected.installation.authority,
+            artifactDigest: selected.installation.release.artifact.artifactDigest,
+        }, declaration, snapshot, "workflow.run") === null)
             return false;
         return approvedBindingGrants(selected.installation, declaration).some((binding) => binding.binding === "WORKFLOWS" &&
             binding.operations.includes("runGraph"));
@@ -192,12 +212,10 @@ export function createStandaloneWorkflowHost(owner, host, options) {
         checkLibraryOperation(selected, operation);
         return selected;
     };
-    const admitInvocation = async (raw, operation) => {
-        const facts = S.decodeUnknownSync(invocationFactsSchema)(raw, {
-            onExcessProperty: "error",
-        });
-        if (facts.subject.kind !== "call" ||
-            facts.selection.owner.kind !== "installation")
+    // All frame kinds re-open the same live installation pin and grants.
+    // A lifecycle admission does not turn the frame into a member call.
+    const admitFrame = async (facts, operation) => {
+        if (facts.selection.owner.kind !== "installation")
             throw new AppInstanceError("revoked");
         if (facts.deadlineAt <= Date.now())
             throw new AppInstanceError("expired");
@@ -217,13 +235,54 @@ export function createStandaloneWorkflowHost(owner, host, options) {
         return {
             ...selected,
             libraryId,
-            context: facts.subject.context,
             installationAuthority: {
                 selection: current.selection,
                 artifactDigest: current.artifactDigest,
             },
         };
     };
+    const admitInvocation = async (raw, operation) => {
+        const facts = S.decodeUnknownSync(invocationFactsSchema)(raw, {
+            onExcessProperty: "error",
+        });
+        if (facts.subject.kind !== "call")
+            throw new AppInstanceError("revoked");
+        return {
+            ...(await admitFrame(facts, operation)),
+            context: facts.subject.context,
+        };
+    };
+    const admitLifecycle = async (raw, operation) => {
+        const facts = S.decodeUnknownSync(invocationFactsSchema)(raw, {
+            onExcessProperty: "error",
+        });
+        if (facts.subject.kind !== "lifecycle" ||
+            facts.subject.name !== "onGitPush")
+            throw new AppInstanceError("revoked");
+        return admitFrame(facts, operation);
+    };
+    const admitStart = async (raw) => {
+        const facts = S.decodeUnknownSync(invocationFactsSchema)(raw, {
+            onExcessProperty: "error",
+        });
+        if (facts.subject.kind === "call")
+            return admitInvocation(facts, "runGraph");
+        const selected = await admitLifecycle(facts, "runGraph");
+        const member = await options.lifecycleMember();
+        if (member === null)
+            throw new AppInstanceError("revoked");
+        const current = await options
+            .authority(selected.libraryId)
+            .member(member.memberId);
+        if (current.membershipVersion !== member.membershipVersion)
+            throw new AppInstanceError("revoked");
+        const context = {
+            actor: { kind: "member", memberId: member.memberId },
+            role: "owner",
+            computerId: host.computerId ?? null,
+        };
+        return { ...selected, context };
+    };
     /** A trigger's live library pin; any missing grant is a typed revocation. */
     const triggerAuthority = async (installationId) => {
         const installation = await host.installations.get(installationId);
@@ -325,7 +384,8 @@ export function createStandaloneWorkflowHost(owner, host, options) {
                     workflowRunGranted = await runGranted(selected);
                     const after = await host.installations.get(current.installationId);
                     if (after?.status !== "enabled" ||
-                        after.authorityVersion !== current.authorityVersion ||
+                        after.authority.authorityVersion !==
+                            current.authority.authorityVersion ||
                         releaseKey(after) !== releaseKey(current))
                         throw new AppInstanceError("revoked");
                 }
@@ -357,7 +417,9 @@ export function createStandaloneWorkflowHost(owner, host, options) {
         return { apps };
     }
     const catalog = async (facts, input) => {
-        const library = await admitInvocation(facts, "catalog");
+        const library = facts.subject.kind === "call"
+            ? await admitInvocation(facts, "catalog")
+            : await admitLifecycle(facts, "catalog");
         if (input?.installationId === undefined)
             return catalogForLibrary(library);
         const { apps } = await catalogForLibrary(library, {
@@ -399,12 +461,15 @@ export function createStandaloneWorkflowHost(owner, host, options) {
         // Host readers use this only after admitting the live member and library.
         catalogForLibrary,
         async prepare(facts, raw) {
-            const selected = await admitInvocation(facts, "runGraph");
+            const selected = await admitStart(facts);
             const { libraryId, context } = selected;
             const request = S.decodeUnknownSync(graphStartRequestSchema)(raw, {
                 onExcessProperty: "error",
             });
             const publication = request.published;
+            // Only immutable, published runs receive Workflow node attestations.
+            if (facts.subject.kind === "lifecycle" && publication === undefined)
+                return { error: "not_granted" };
             if (publication !== undefined) {
                 if (!(await publisherGranted(selected)))
                     return { error: "not_granted" };
@@ -459,8 +524,11 @@ export function createStandaloneWorkflowHost(owner, host, options) {
             const admitted = admitRunInput(compiled.plan.definition, request.input);
             if (admitted.kind === "invalid")
                 return { error: "invalid_input" };
-            const runId = "run_" +
-                (await contentDigest([libraryId, request.requestId])).slice(7, 47);
+            // The host's accepted event owns lifecycle replay, not a guest request id.
+            const requestId = facts.subject.kind === "lifecycle" && facts.subject.name === "onGitPush"
+                ? ["onGitPush", facts.subject.eventId]
+                : request.requestId;
+            const runId = "run_" + (await contentDigest([libraryId, requestId])).slice(7, 47);
             // An Agent runs with the access of the person who approved its App
             // tools.
             const subject = facts.subject.kind === "call" ? facts.subject : null;
@@ -516,7 +584,7 @@ export function createStandaloneWorkflowHost(owner, host, options) {
                     }
                     : {
                         initiatedBy: { kind: "member", memberId: actorId },
-                        source: "manual",
+                        source: facts.subject.kind === "lifecycle" ? "event" : "manual",
                         libraryInstallationId: libraryId,
                         computerId: context.computerId,
                         plan: compiled.plan,
@@ -532,7 +600,7 @@ export function createStandaloneWorkflowHost(owner, host, options) {
             const started = {
                 teamId: libraryId,
                 runId,
-                requestId: await contentDigest([libraryId, request.requestId]),
+                requestId: await contentDigest([libraryId, requestId]),
                 actorId,
                 computerId: context.computerId,
                 plan: compiled.plan,
@@ -542,7 +610,10 @@ export function createStandaloneWorkflowHost(owner, host, options) {
                 initiatedBy: preparation.initiatedBy,
             };
             const record = delivery === undefined ? started : { ...started, delivery };
-            const current = await admitInvocation(facts, "runGraph");
+            const current = await admitStart(facts);
+            if (canonicalJson(S.decodeUnknownSync(S.Json)(current.context)) !==
+                canonicalJson(S.decodeUnknownSync(S.Json)(context)))
+                return { error: "not_granted" };
             if (publication !== undefined && !(await publisherGranted(current)))
                 return { error: "not_granted" };
             const callContext = {
@@ -699,6 +770,7 @@ export function createStandaloneWorkflowHost(owner, host, options) {
                     // retryable fault; same for an instance the owner state marks
                     // inactive.
                     case "revoked":
+                    case "disabled":
                     case "instance_owner_mismatch":
                     case "instance_authority_version_mismatch":
                     case "instance_release_mismatch":
@@ -714,6 +786,14 @@ export function createStandaloneWorkflowHost(owner, host, options) {
                             ? "App execution failed"
                             : `App execution failed (${result.causeClass})`);
                     case "expired":
+                    case "backend_load_failed":
+                    case "backend_construction_failed":
+                    case "ui_mount_failed":
+                    case "boot_runner_unavailable":
+                    case "boot_browser_binding_missing":
+                    case "boot_clone_unavailable":
+                    case "boot_timeout":
+                    case "boot_cleanup_failed":
                     case "binding_unavailable":
                     case "reentrant":
                     case "conflicting_owner_state":
@@ -731,9 +811,9 @@ export function createStandaloneWorkflowHost(owner, host, options) {
                 }
             }
             // The engine's closed refusal vocabulary names host decisions; an App's
-            // own domain refusal fails the node with its code.
+            // own domain refusal fails the node with its code and caller-facing reason.
             if (result.value.kind === "refused")
-                throw new Error(`App method refused (${result.value.code})`);
+                throw new Error(`App method refused (${result.value.code}): ${result.value.message}`);
             const value = result.value.value;
             const pending = pinned.pending === true ? pendingSchema.safeParse(value) : null;
             if (pending?.success)

package/dist/standalone/workflow-node-capture.js

@@ -31,7 +31,13 @@ export function createStandaloneWorkflowNodeCapture(options) {
             return null;
         const facts = {
             principal: { actor: caller.actor, role: caller.role ?? null },
-            installation,
+            installation: {
+                status: installation.status,
+                visibility: installation.visibility,
+                instanceId: installation.instanceId,
+                authority: installation.authority,
+                artifactDigest: installation.release.artifact.artifactDigest,
+            },
             declaration: verified.declaration,
             declaredOperations: await deriveDeclaredOperations(installation.release, verified.declaration, host.capabilities ?? []),
             api: verified.api,
@@ -57,9 +63,10 @@ export function createStandaloneWorkflowNodeCapture(options) {
         const after = await readers.member(actor.memberId);
         if (latest?.status !== "enabled" ||
             latest.instanceId !== installation.instanceId ||
-            latest.authorityVersion !== installation.authorityVersion ||
-            latest.declaredOperationsDigest !==
-                installation.declaredOperationsDigest ||
+            latest.authority.authorityVersion !==
+                installation.authority.authorityVersion ||
+            latest.authority.declaredOperationsDigest !==
+                installation.authority.declaredOperationsDigest ||
             latest.release.releaseId !== installation.release.releaseId ||
             latest.release.artifact.artifactDigest !==
                 installation.release.artifact.artifactDigest ||

package/dist/standalone/workflow-schedules.d.ts

@@ -1,8 +1,10 @@
 import { createWorkflowSchedules, type WorkflowInstallationAuthority } from "@fungi.computer/braid/runtime";
 import type { AppMethodCallContext } from "@fungi.computer/puffball/app-method-runtime";
+import type { workflowAgentAuthority } from "../workflow-agent-authority.js";
 import { type TriggerArmTarget, type ScheduleDisarmInput } from "./workflow-binding.js";
 /** The host supplies this result only after reopening the protected invocation. */
 export type TriggerAdmission = Readonly<{
+    authority: Awaited<ReturnType<typeof workflowAgentAuthority>>;
     libraryId: string;
     context: AppMethodCallContext;
     /** The admitted frame's selection and verified artifact, pinned on arm. */
@@ -26,7 +28,7 @@ export declare function createStandaloneWorkflowSchedules<Frame>(options: Parame
     } | {
         kind: "refused";
         reason: string;
-        readonly error?: undefined;
+        error?: undefined;
     }>;
     disarm(frame: Frame, raw: ScheduleDisarmInput): Promise<{
         kind: "not_found";
@@ -41,12 +43,13 @@ export declare function createStandaloneWorkflowSchedules<Frame>(options: Parame
     } | {
         schedules: {
             scheduleId: string;
+            installationId: string;
             workflowId: string;
             triggerId: string;
             nextDueAt: number;
             state: "active" | "finished" | "paused" | "cancelled";
             lastError: string | null;
         }[];
-        readonly error?: undefined;
+        error?: undefined;
     }>;
 };

package/dist/standalone/workflow-schedules.js

@@ -10,30 +10,29 @@ export function createStandaloneWorkflowSchedules(options) {
         alarm: () => schedules.fireDue(),
         async arm(frame, raw) {
             const target = triggerArmTargetSchema.parse(raw);
-            const { libraryId, context, installationAuthority } = await options.admitInvocation(frame, "armSchedule");
-            if (context.actor.kind !== "member")
+            const { libraryId, context, installationAuthority, authority } = await options.admitInvocation(frame, "armSchedule");
+            if (authority === null)
                 return { error: "not_granted" };
             if (context.computerId === null)
                 return {
                     kind: "refused",
                     reason: "Select a Computer before arming a schedule",
                 };
-            // Standalone has no Agent arming source: the owner arms as themself.
-            return schedules.arm({ armedBy: context.actor.memberId, armedVia: null }, { ...target, installationId: libraryId }, context.computerId, installationAuthority);
+            return schedules.arm(authority.armer, { ...target, installationId: libraryId }, context.computerId, installationAuthority);
         },
         async disarm(frame, raw) {
             const { scheduleId } = scheduleDisarmInputSchema.parse(raw);
-            const { libraryId, context } = await options.admitInvocation(frame, "disarmSchedule");
-            if (context.actor.kind !== "member")
+            const { libraryId, authority } = await options.admitInvocation(frame, "disarmSchedule");
+            if (authority === null)
                 return { error: "not_granted" };
-            return schedules.disarm({ kind: "member", memberId: context.actor.memberId }, libraryId, scheduleId);
+            return schedules.disarm(authority.principal, libraryId, scheduleId);
         },
         async list(frame) {
-            const { libraryId, context } = await options.admitInvocation(frame, "schedules");
-            if (context.actor.kind !== "member")
+            const { libraryId, authority } = await options.admitInvocation(frame, "schedules");
+            if (authority === null)
                 return { error: "not_granted" };
             return {
-                schedules: await schedules.list({ kind: "member", memberId: context.actor.memberId }, libraryId),
+                schedules: await schedules.list(authority.principal, libraryId),
             };
         },
     };

package/dist/standalone/workflow-trigger-host.d.ts

@@ -1,4 +1,4 @@
-import { createTeamWorkflowRuns, createTeamWorkflowTriggers, type WorkflowErrorPort, type WorkflowRunAuthority } from "@fungi.computer/braid/runtime";
+import { createTeamWorkflowRuns, createTeamWorkflowTriggers, type WorkflowErrorPort, type WorkflowRunAuthority, type WorkflowTriggerAdmission } from "@fungi.computer/braid/runtime";
 /** Standalone denial is the Instance's revoked refusal; other failures retry. */
 export declare const standaloneTriggerErrors: WorkflowErrorPort;
 /**
@@ -8,7 +8,7 @@ export declare const standaloneTriggerErrors: WorkflowErrorPort;
  */
 export declare function createStandaloneWorkflowTriggerHost(options: {
     authority: WorkflowRunAuthority;
-    runs: Pick<Parameters<typeof createTeamWorkflowRuns>[0], "sql" | "transactionSync" | "teamId">;
+    runs: Pick<Parameters<typeof createTeamWorkflowRuns>[0], "sql" | "transactionSync" | "teamId" | "now">;
     triggers: Omit<Parameters<typeof createTeamWorkflowTriggers>[0], "runs" | "errors">;
     /** Whether this member may have run endings reported to the Agent Session. */
     admitDelivery: Parameters<typeof createTeamWorkflowRuns>[0]["admitDelivery"];
@@ -344,7 +344,7 @@ export declare function createStandaloneWorkflowTriggerHost(options: {
                         readonly operations: readonly string[];
                     }[];
                     readonly nodeId: string;
-                    readonly capabilities: readonly ("agent.list" | "agent.manage" | "agent.rename" | "agent.avatar" | "agent.toolPolicy" | "agent.read" | "agent.send" | "computer.list" | "computer.readFile" | "computer.writeFile" | "computer.execute" | "llm.generation" | "media.generation" | "games:servers" | "git.repository" | "apps.open" | "apps.call" | "app.storage" | "app.events.emit" | "team.workbenchHost" | "marketplace.browse" | "marketplace.purchase" | "workflow.run" | "workflow.publish" | "workflow.arm" | "world" | "channels.read" | "channels.personal.manage")[];
+                    readonly capabilities: readonly ("approvals" | "agent.list" | "agent.manage" | "agent.rename" | "agent.avatar" | "agent.toolPolicy" | "agent.read" | "agent.send" | "computer.list" | "computer.readFile" | "computer.writeFile" | "computer.execute" | "llm.generation" | "media.generation" | "games:servers" | "git.repository" | "apps.open" | "apps.call" | "app.storage" | "app.events.emit" | "team.workbenchHost" | "marketplace.browse" | "marketplace.purchase" | "workflow.run" | "workflow.publish" | "workflow.arm" | "world" | "channels.read" | "channels.personal.manage")[];
                     readonly graphId?: string;
                 }[];
                 readonly nodeGitAccess: readonly {
@@ -1242,7 +1242,7 @@ export declare function createStandaloneWorkflowTriggerHost(options: {
         }>;
         startCachedGraph(binding: import("@fungi.computer/braid/runtime").ArmedWorkflowTrigger, started: Pick<import("@fungi.computer/braid/runtime").GraphStartRequest, "requestId" | "input"> & {
             triggerRepository?: string;
-        }): Promise<{
+        }, admission?: WorkflowTriggerAdmission): Promise<{
             kind: "conflict" | "started" | "replay";
             runId: string;
             planDigest: string;
@@ -1264,6 +1264,66 @@ export declare function createStandaloneWorkflowTriggerHost(options: {
         revokeInstallationInMutation(rawInstallationId: string): void;
         revokeReleaseInMutation(appIds: readonly string[]): void;
         onLifecycle(status: "active" | "suspended"): void;
+        reserveWebhookDelivery(raw: import("zod").input<import("zod").ZodObject<{
+            scope: import("zod").ZodLazy<import("zod").ZodObject<{
+                installationId: import("zod").ZodString;
+                workflowId: import("zod").ZodString;
+                commit: import("zod").ZodString;
+                triggerId: import("zod").ZodString;
+            }, import("zod/v4/core").$strict>>;
+            delivery: import("zod").ZodObject<{
+                host: import("zod").ZodString;
+                tenant: import("zod").ZodString;
+                bindingId: import("zod").ZodString;
+                eventId: import("zod").ZodString;
+            }, import("zod/v4/core").$strict>;
+            cargo: import("zod").ZodJSONSchema;
+            limits: import("zod").ZodObject<{
+                hostConcurrency: import("zod").ZodNumber;
+                bindingConcurrency: import("zod").ZodNumber;
+            }, import("zod/v4/core").$strict>;
+        }, import("zod/v4/core").$strict>>): {
+            kind: "reserved" | "replay";
+            reservationId: string;
+            runId: string | null;
+        } | {
+            kind: "refused";
+            reason: "limit";
+        };
+        pendingWebhookDeliveries(rawOwner: import("zod").input<import("zod").ZodObject<{
+            host: import("zod").ZodString;
+            tenant: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>>): ({
+            kind: "launch";
+            reservationId: string;
+            runId: string;
+        } | {
+            scope: {
+                installationId: string;
+                workflowId: string;
+                commit: string;
+                triggerId: string;
+            };
+            delivery: {
+                host: string;
+                tenant: string;
+                bindingId: string;
+                eventId: string;
+            };
+            cargo: import("zod").JSONType;
+            limits: {
+                hostConcurrency: number;
+                bindingConcurrency: number;
+            };
+            kind: "start";
+            reservationId: string;
+            runId?: never;
+        })[];
+        nextWebhookWake(rawOwner: import("zod").input<import("zod").ZodObject<{
+            host: import("zod").ZodString;
+            tenant: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>>): number | null;
+        completeWebhookDelivery(rawReservationId: string): void;
         reserveTriggerRun(raw: {
             scope: import("@fungi.computer/braid/runtime").TriggerRunScope;
             requestId: string;
@@ -1702,7 +1762,7 @@ export declare function createStandaloneWorkflowTriggerHost(options: {
         refusal: (binding: import("@fungi.computer/braid/runtime").ArmedWorkflowTrigger) => string | null;
         invalidateInstallation: (installationId: string) => void;
         revalidatePublished(installationId: string, git: import("@fungi.computer/agar/git").GitBinding): Promise<void>;
-        fire(raw: import("@fungi.computer/braid/runtime").ArmedWorkflowTrigger, scope: string, event: import("@fungi.computer/braid").TriggerEvent): Promise<Readonly<{
+        fire(raw: import("@fungi.computer/braid/runtime").ArmedWorkflowTrigger, scope: string, event: import("@fungi.computer/braid").TriggerEvent, admission?: WorkflowTriggerAdmission): Promise<Readonly<{
             kind: "ignored";
         }> | Readonly<{
             kind: "started" | "replay" | "conflict";

package/dist/standalone/workflow-trigger-host.js

@@ -37,8 +37,8 @@ export function createStandaloneWorkflowTriggerHost(options) {
         errors: standaloneTriggerErrors,
         runs: {
             ...runs,
-            async startCachedGraph(binding, request) {
-                const started = await runs.startCachedGraph(binding, request);
+            async startCachedGraph(binding, request, admission) {
+                const started = await runs.startCachedGraph(binding, request, admission);
                 // A replay re-records the same caller after a lost reply.
                 if (started.kind === "started" || started.kind === "replay")
                     options.recordCaller(started.runId, binding.armedBy, binding.computerId);

package/dist/standalone/workflow-webhooks.d.ts

@@ -0,0 +1,22 @@
+import { Hono } from "hono";
+import type { OysterEnv, OysterHost } from "../host.js";
+import type { StandaloneWorkflowEnv } from "./workflows.js";
+/** The root resolves the origin before this unauthenticated signed-delivery path. */
+export declare function standaloneWorkflowWebhookRoutes(env: Pick<StandaloneWorkflowEnv, "WORKFLOW_RUNS">, hostFor: (request: Request) => Promise<Pick<OysterHost, "installations"> | null>): import("hono/hono-base").HonoBase<import("hono/types").BlankEnv, {
+    "/api/installations/:installationId/workflows/webhooks/:bindingId": {
+        $all: {
+            input: {
+                param: {
+                    installationId: string;
+                } & {
+                    bindingId: string;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: import("hono/utils/http-status").StatusCode;
+        };
+    };
+}, "/", "/api/installations/:installationId/workflows/webhooks/:bindingId">;
+/** Mounted only under the root's authenticated owner routes; the DO re-admits. */
+export declare function standaloneWorkflowWebhookControls(env: Pick<StandaloneWorkflowEnv, "WORKFLOW_RUNS">, hostFor: () => Promise<Pick<OysterHost, "installations">>): Hono<OysterEnv>;

package/dist/standalone/workflow-webhooks.js

@@ -0,0 +1,39 @@
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import * as Schema from "effect/Schema";
+import { workflowWebhookCommandSchema } from "../webhooks.js";
+const refused = () => Response.json({ error: "refused" }, { status: 403, headers: { "cache-control": "no-store" } });
+/** Address an existing library, never use an opaque binding ID as a DO name. */
+async function libraryExists(host, installationId) {
+    const installation = await host.installations.get(installationId);
+    return (installation?.status === "enabled" &&
+        installation.authority.approvedGrants.some((grant) => grant.capability === "workflow.run"));
+}
+/** The root resolves the origin before this unauthenticated signed-delivery path. */
+export function standaloneWorkflowWebhookRoutes(env, hostFor) {
+    return new Hono().all("/api/installations/:installationId/workflows/webhooks/:bindingId", async (context) => {
+        const host = await hostFor(context.req.raw);
+        const installationId = context.req.param("installationId");
+        if (host === null || !(await libraryExists(host, installationId)))
+            return refused();
+        const address = new URL(context.req.url);
+        address.pathname = `/webhooks/${encodeURIComponent(context.req.param("bindingId"))}`;
+        address.search = "";
+        return env.WORKFLOW_RUNS.getByName(installationId).fetch(new Request(address, context.req.raw));
+    });
+}
+/** Mounted only under the root's authenticated owner routes; the DO re-admits. */
+export function standaloneWorkflowWebhookControls(env, hostFor) {
+    return new Hono().post("/api/installations/:installationId/workflows/webhooks", bodyLimit({ maxSize: 64 * 1024, onError: refused }), async (context) => {
+        const installationId = context.req.param("installationId");
+        if (!(await libraryExists(await hostFor(), installationId)))
+            return refused();
+        const body = Schema.decodeUnknownResult(Schema.fromJsonString(Schema.Json))(await context.req.text());
+        if (body._tag === "Failure")
+            return refused();
+        const command = workflowWebhookCommandSchema.safeParse(body.success);
+        if (!command.success)
+            return refused();
+        return env.WORKFLOW_RUNS.getByName(installationId).webhookControl(context.get("principal"), installationId, command.data);
+    });
+}