@ixo/flow-work 0.2.0 → 0.4.1

package/dist/listener.js

@@ -1,5 +1,6 @@
 import { findCapability } from './capability.js';
-import { FLOW_WORK_INVOKE_EVENT, FLOW_WORK_RECEIPT_EVENT, flowWorkInvokeSchema, } from './protocol.js';
+import { FlowWorkInputError, InputRequestCoordinator, } from './input-requests.js';
+import { FLOW_WORK_ASSIGN_EVENT, FLOW_WORK_BINDING_FIELDS, FLOW_WORK_INVOKE_EVENT, FLOW_WORK_READY_EVENT, FLOW_WORK_RECEIPT_EVENT, computeFlowWorkInputHash, flowWorkAssignSchema, flowWorkInvokeSchema, flowWorkReadySchema, flowWorkReceiptSchema, sameFlowWorkBinding, sameFlowWorkNb, } from './protocol.js';
 class FlowWorkFailure extends Error {
     code;
     constructor(code, message) {
@@ -8,54 +9,53 @@ class FlowWorkFailure extends Error {
         this.name = 'FlowWorkFailure';
     }
 }
-/** Hostname of '@user:server.tld' or a bare/prefixed server name. */
-export function homeserverOf(value) {
-    let candidate = value.trim().toLowerCase();
-    if (candidate.startsWith('@')) {
-        const separator = candidate.indexOf(':');
-        if (separator < 0)
-            return null;
-        candidate = candidate.slice(separator + 1);
-    }
-    if (candidate === '')
-        return null;
-    try {
-        return new URL(candidate.includes('://') ? candidate : `matrix://${candidate}`).hostname
-            .replace(/\.$/, '')
-            .toLowerCase();
-    }
-    catch {
-        return null;
-    }
-}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 /**
- * The oracle side of the flow-work contract: accepts invites from trusted
- * homeservers, executes UCAN-authorized `ixo.flow.work.invoke` events via
- * the declared capability handlers, and posts `ixo.flow.work.receipt`s.
+ * Oracle-side flow-work v2 state machine.
+ *
+ * Assignment and ready are durable state events. Invoke remains a timeline
+ * command. Receipt is durable state keyed by invocationId, so restart replay
+ * does not depend on a recent-event window.
  */
 export class FlowWorkListener {
     options;
-    trusted;
+    assignments = new Map();
     active = new Set();
     completed = new Set();
+    pendingReceipts = new Map();
+    publishedReceipts = new Map();
+    publishing = new Set();
+    retryTimers = new Map();
+    readyTimers = new Map();
+    /** Per-room seeding chain, so concurrent seeds never interleave. */
+    seeding = new Map();
+    /** In-flight ready publications, so a seed never double-sends a ready. */
+    acknowledging = new Map();
     unsubscribe = [];
+    started = false;
+    inputCoordinator;
     constructor(options) {
         this.options = options;
-        const trusted = options.trustedHomeservers
-            .map(homeserverOf)
-            .filter((value) => value !== null);
-        this.trusted = new Set(trusted);
-        if (this.trusted.size === 0) {
-            throw new Error('flow-work has no valid trusted homeserver domains');
-        }
         if (options.capabilities.length === 0) {
             throw new Error('flow-work has no declared capabilities');
         }
+        const retryMs = this.retryMs();
+        const now = () => this.options.now?.() ?? Date.now();
+        this.inputCoordinator = new InputRequestCoordinator({
+            port: options.port,
+            logger: options.logger,
+            retryMs,
+            now,
+        });
     }
+    /** Subscribe synchronously before any Matrix initial sync is started. */
     start() {
+        if (this.started)
+            return;
+        this.started = true;
+        this.inputCoordinator.start();
         const { port, logger } = this.options;
         this.unsubscribe = [
             port.onInvite((invite) => {
@@ -69,93 +69,329 @@ export class FlowWorkListener {
                 });
             }),
         ];
-        logger.log(`[flow-work] listening — capabilities: ${this.options.capabilities
+        // An assignment written before we joined arrives as room state, never as a
+        // live timeline event. joinRoom resolves before sync has that state locally,
+        // so seed again the moment our membership actually becomes join.
+        const offJoin = port.onJoin?.((roomId) => {
+            void this.bootstrapRoom(roomId).catch((error) => {
+                logger.error(`[flow-work] join seeding failed for ${roomId}: ${message(error)}`);
+            });
+        });
+        if (offJoin)
+            this.unsubscribe.push(offJoin);
+        logger.log(`[flow-work] listening - capabilities: ${this.options.capabilities
             .map((entry) => `${entry.can}#${entry.actionType}`)
             .join(', ')}`);
+        void this.bootstrap().catch((error) => {
+            logger.error(`[flow-work] bootstrap failed: ${message(error)}`);
+        });
+        for (const key of this.pendingReceipts.keys())
+            void this.publishReceipt(key);
     }
     stop() {
+        this.inputCoordinator.stop();
         for (const off of this.unsubscribe)
             off();
         this.unsubscribe = [];
+        for (const timer of this.retryTimers.values())
+            clearTimeout(timer);
+        for (const timer of this.readyTimers.values())
+            clearTimeout(timer);
+        this.retryTimers.clear();
+        this.readyTimers.clear();
+        this.started = false;
     }
-    async handleInvite(invite) {
-        const host = homeserverOf(invite.inviterUserId);
-        if (!host || !this.trusted.has(host)) {
-            this.options.logger.warn(`[flow-work] rejected invite to ${invite.roomId} from untrusted sender ${invite.inviterUserId}`);
-            return;
+    /** Reconcile invitations and current assignment state after initial sync. */
+    async bootstrap() {
+        for (const invite of this.options.port.getPendingInvites()) {
+            await this.handleInvite(invite);
         }
+        for (const roomId of this.options.port.getJoinedRoomIds()) {
+            await this.bootstrapRoom(roomId);
+        }
+    }
+    now() {
+        return this.options.now?.() ?? Date.now();
+    }
+    retryMs() {
+        const configured = this.options.receiptRetryMs ?? 1_000;
+        return Number.isFinite(configured) && configured >= 0 ? configured : 1_000;
+    }
+    async handleInvite(invite) {
         await this.options.port.joinRoom(invite.roomId);
         this.options.logger.log(`[flow-work] joined ${invite.roomId} (invited by ${invite.inviterUserId})`);
+        await this.bootstrapRoom(invite.roomId);
+    }
+    /**
+     * Seed the assignment table from a room's current state.
+     *
+     * Serialised per room and chained behind any seed already running, so a join
+     * transition, a pending invite and post-sync bootstrap can all request the
+     * same room without interleaving. Every accepted assignment is routed through
+     * {@link handleAssignment} — the same validation and deduplication path the
+     * live timeline handler uses — so a seeded assignment is never reprocessed
+     * and never re-acknowledged.
+     */
+    async bootstrapRoom(roomId) {
+        const previous = this.seeding.get(roomId) ?? Promise.resolve();
+        const run = previous.then(() => this.seedRoomAssignments(roomId));
+        this.seeding.set(roomId, run);
+        try {
+            await run;
+        }
+        finally {
+            if (this.seeding.get(roomId) === run)
+                this.seeding.delete(roomId);
+        }
+    }
+    /** Never rejects: one unreadable event must not abandon the rest of a room. */
+    async seedRoomAssignments(roomId) {
+        let events;
+        try {
+            events = this.options.port.stateEvents(roomId, FLOW_WORK_ASSIGN_EVENT);
+        }
+        catch (error) {
+            this.options.logger.error(`[flow-work] failed to read assignment state in ${roomId}: ${message(error)}`);
+            return;
+        }
+        for (const event of events) {
+            try {
+                await this.handleAssignment(event);
+            }
+            catch (error) {
+                this.options.logger.error(`[flow-work] failed to seed an assignment in ${roomId}: ${message(error)}`);
+            }
+        }
     }
     async handleRoomEvent(event) {
-        if (event.type !== FLOW_WORK_INVOKE_EVENT || !isRecord(event.content)) {
+        if (event.type === FLOW_WORK_ASSIGN_EVENT) {
+            await this.handleAssignment(event);
             return;
         }
+        if (event.type === FLOW_WORK_INVOKE_EVENT) {
+            await this.handleInvocation(event);
+        }
+    }
+    async handleAssignment(event) {
+        if (!isRecord(event.content))
+            return;
         if (event.content.audience !== this.options.oracleDid)
             return;
-        const rawId = event.content.invocationId;
-        if (typeof rawId !== 'string' || rawId.trim() === '')
+        const parsed = flowWorkAssignSchema.safeParse(event.content);
+        if (!parsed.success) {
+            this.options.logger.warn(`[flow-work] ignored malformed assignment in ${event.roomId}: ${issues(parsed.error.issues)}`);
             return;
-        const invocationId = rawId.trim();
-        const key = `${event.roomId}:${invocationId}`;
-        if (this.active.has(key) || this.completed.has(key))
+        }
+        const assignmentContent = parsed.data;
+        const assignment = bindingOf(assignmentContent);
+        const selfUserId = this.options.port.getUserId();
+        if (event.stateKey !== assignment.invocationId ||
+            !event.sender ||
+            !selfUserId ||
+            assignmentContent.oracleMatrixId !== selfUserId) {
+            this.options.logger.warn(`[flow-work] ignored malformed assignment ${assignment.invocationId} in ${event.roomId}`);
             return;
-        this.active.add(key);
-        let receiptPosted = false;
+        }
+        if (assignment.deadline <= this.now()) {
+            this.options.logger.warn(`[flow-work] ignored expired assignment ${assignment.invocationId}`);
+            return;
+        }
+        const key = assignmentKey(event.roomId, assignment.invocationId);
+        const existing = this.assignments.get(key);
+        if (existing) {
+            if (existing.sender !== event.sender ||
+                assignment.attempt < existing.binding.attempt ||
+                (assignment.attempt === existing.binding.attempt &&
+                    !sameFlowWorkBinding(existing.binding, assignment))) {
+                this.options.logger.warn(`[flow-work] ignored mutation of accepted assignment ${assignment.invocationId}`);
+                return;
+            }
+            if (assignment.attempt === existing.binding.attempt &&
+                sameFlowWorkBinding(existing.binding, assignment)) {
+                if (!existing.ready) {
+                    await this.acknowledgeAssignment(event.roomId, existing);
+                }
+                return;
+            }
+            const oldTimer = this.readyTimers.get(key);
+            if (oldTimer)
+                clearTimeout(oldTimer);
+            this.readyTimers.delete(key);
+        }
+        const accepted = {
+            binding: cloneBinding(assignment),
+            sender: event.sender,
+            ready: this.hasOwnReady(event.roomId, assignment),
+        };
+        this.assignments.set(key, accepted);
+        if (!accepted.ready)
+            await this.acknowledgeAssignment(event.roomId, accepted);
+    }
+    hasOwnReady(roomId, binding) {
+        const self = this.options.port.getUserId();
+        if (!self)
+            return false;
+        return this.options.port
+            .stateEvents(roomId, FLOW_WORK_READY_EVENT)
+            .some((event) => {
+            if (event.stateKey !== binding.invocationId || event.sender !== self) {
+                return false;
+            }
+            const ready = flowWorkReadySchema.safeParse(event.content);
+            return ready.success && sameFlowWorkBinding(ready.data, binding);
+        });
+    }
+    /**
+     * Publish ready at most once per accepted assignment at a time.
+     *
+     * `handleAssignment` runs to the point of registering the assignment
+     * synchronously, but the send that follows is awaited. Without this guard a
+     * seed and the live delivery of the same assign could both observe
+     * `ready === false` and each publish a ready. Concurrent callers for the same
+     * assignment object share the in-flight publication; a genuinely new
+     * assignment object (a later attempt) is allowed its own send.
+     */
+    async acknowledgeAssignment(roomId, assignment) {
+        const key = assignmentKey(roomId, assignment.binding.invocationId);
+        const inFlight = this.acknowledging.get(key);
+        if (inFlight?.assignment === assignment) {
+            await inFlight.promise;
+            return;
+        }
+        const promise = this.publishReady(roomId, assignment, key).finally(() => {
+            if (this.acknowledging.get(key)?.promise === promise) {
+                this.acknowledging.delete(key);
+            }
+        });
+        this.acknowledging.set(key, { assignment, promise });
+        await promise;
+    }
+    async publishReady(roomId, assignment, key) {
         try {
-            if (this.hasExistingReceipt(event.roomId, invocationId)) {
-                this.completed.add(key);
+            await this.options.port.sendStateEvent(roomId, FLOW_WORK_READY_EVENT, assignment.binding.invocationId, { ...assignment.binding, status: 'ready' });
+            assignment.ready = true;
+            const timer = this.readyTimers.get(key);
+            if (timer)
+                clearTimeout(timer);
+            this.readyTimers.delete(key);
+        }
+        catch (error) {
+            assignment.ready = false;
+            this.options.logger.error(`[flow-work] failed to publish ready for ${assignment.binding.invocationId}: ${message(error)}`);
+            if (this.started && !this.readyTimers.has(key)) {
+                const timer = setTimeout(() => {
+                    this.readyTimers.delete(key);
+                    const current = this.assignments.get(key);
+                    if (current === assignment && !current.ready) {
+                        void this.acknowledgeAssignment(roomId, current);
+                    }
+                }, this.retryMs());
+                timer.unref?.();
+                this.readyTimers.set(key, timer);
+            }
+        }
+    }
+    async handleInvocation(event) {
+        if (!isRecord(event.content))
+            return;
+        if (event.content.audience !== this.options.oracleDid)
+            return;
+        const parsed = flowWorkInvokeSchema.safeParse(event.content);
+        if (!parsed.success) {
+            this.options.logger.warn(`[flow-work] ignored malformed invoke in ${event.roomId}: ${issues(parsed.error.issues)}`);
+            return;
+        }
+        const invoke = parsed.data;
+        const binding = bindingOf(invoke);
+        const assignment = this.assignments.get(assignmentKey(event.roomId, invoke.invocationId));
+        if (!assignment) {
+            this.options.logger.warn(`[flow-work] ignored invoke ${invoke.invocationId}: no accepted assignment`);
+            return;
+        }
+        if (!event.sender || event.sender !== assignment.sender) {
+            this.options.logger.warn(`[flow-work] ignored invoke ${invoke.invocationId}: Matrix sender does not match assignment`);
+            return;
+        }
+        if (!assignment.ready) {
+            // sendStateEvent may be accepted by Matrix even when its response is
+            // lost. The manager can then observe our durable ready state and send
+            // the invoke while the original promise left this flag false. Reconcile
+            // against authenticated current state before rejecting the command.
+            if (this.hasOwnReady(event.roomId, assignment.binding)) {
+                assignment.ready = true;
+                const readyTimer = this.readyTimers.get(assignmentKey(event.roomId, invoke.invocationId));
+                if (readyTimer)
+                    clearTimeout(readyTimer);
+                this.readyTimers.delete(assignmentKey(event.roomId, invoke.invocationId));
+            }
+            else {
+                this.options.logger.warn(`[flow-work] ignored invoke ${invoke.invocationId}: ready handshake is incomplete`);
                 return;
             }
-            const parsed = flowWorkInvokeSchema.safeParse(event.content);
-            if (!parsed.success) {
-                await this.postFailure(event.roomId, invocationId, 'input_invalid', parsed.error.issues
-                    .map((issue) => `${issue.path.join('.')}: ${issue.message}`)
-                    .join('; '));
-                receiptPosted = true;
-                this.completed.add(key);
+        }
+        if (!sameFlowWorkBinding(assignment.binding, binding)) {
+            this.options.logger.warn(`[flow-work] ignored invoke ${invoke.invocationId}: immutable assignment binding differs`);
+            return;
+        }
+        const key = workKey(event.roomId, binding);
+        if (this.completed.has(key)) {
+            if (this.hasOwnReceipt(event.roomId, binding))
+                return;
+            const published = this.publishedReceipts.get(key);
+            if (published) {
+                this.pendingReceipts.set(key, published);
+                await this.publishReceipt(key);
                 return;
             }
-            const receipt = await this.execute(parsed.data);
-            await this.postReceipt(event.roomId, receipt);
-            receiptPosted = true;
+            // Current state no longer contains our receipt. A forged state event
+            // must not suppress authenticated redelivery after a process restart.
+            this.completed.delete(key);
+        }
+        if (this.pendingReceipts.has(key)) {
+            await this.publishReceipt(key);
+            return;
+        }
+        if (this.active.has(key))
+            return;
+        if (this.hasOwnReceipt(event.roomId, binding)) {
             this.completed.add(key);
+            return;
         }
-        catch (error) {
-            const failure = error instanceof FlowWorkFailure
-                ? error
-                : new FlowWorkFailure('tool_error', message(error));
-            try {
-                await this.postFailure(event.roomId, invocationId, failure.code, failure.message);
-                receiptPosted = true;
-                this.completed.add(key);
+        this.active.add(key);
+        try {
+            let receipt;
+            if (binding.deadline <= this.now()) {
+                receipt = failureReceipt(binding, 'deadline_expired', `Invocation deadline ${binding.deadline} has passed.`);
+            }
+            else if (computeFlowWorkInputHash(invoke.inputs) !== binding.inputHash) {
+                receipt = failureReceipt(binding, 'binding_mismatch', 'Invocation inputs do not match the assignment inputHash.');
             }
-            catch (postError) {
-                this.options.logger.error(`[flow-work] failed to post receipt for ${invocationId}: ${message(postError)}`);
+            else {
+                try {
+                    receipt = await this.execute(event.roomId, invoke, binding);
+                }
+                catch (error) {
+                    if (error instanceof FlowWorkInputError && error.code === 'aborted') {
+                        return;
+                    }
+                    const failure = error instanceof FlowWorkFailure
+                        ? error
+                        : new FlowWorkFailure('tool_error', message(error));
+                    receipt = failureReceipt(binding, failure.code, failure.message);
+                }
             }
+            this.pendingReceipts.set(key, {
+                roomId: event.roomId,
+                workKey: key,
+                receipt,
+            });
         }
         finally {
             this.active.delete(key);
-            if (!receiptPosted)
-                this.completed.delete(key);
-        }
-    }
-    /**
-     * Bind nb caveats to the invocation before executing. A delegation minted
-     * for one claim schema must not be reusable with unrelated claim data:
-     * `nb.claimSchema` requires the invocation's `inputs.claimSchemaId` to be
-     * present and equal.
-     */
-    enforceCaveats(nb, invoke) {
-        const claimSchema = nb?.claimSchema;
-        if (typeof claimSchema !== 'string' || claimSchema === '')
-            return;
-        const provided = invoke.inputs.claimSchemaId;
-        if (provided !== claimSchema) {
-            throw new FlowWorkFailure('delegation_invalid', `Delegation is caveated to claim schema '${claimSchema}' but the invocation carries '${typeof provided === 'string' ? provided : 'none'}'.`);
         }
+        await this.publishReceipt(key);
     }
-    async execute(invoke) {
+    async execute(roomId, invoke, binding) {
         const capability = findCapability(this.options.capabilities, invoke.capability, invoke.actionType);
         if (!capability) {
             throw new FlowWorkFailure('capability_not_declared', `Capability '${invoke.capability}' with actionType '${invoke.actionType}' is not declared by this oracle.`);
@@ -164,60 +400,161 @@ export class FlowWorkListener {
         if (!validation.ok) {
             throw new FlowWorkFailure(validation.code, validation.message);
         }
-        if (validation.capability &&
-            validation.capability.can !== invoke.capability) {
-            throw new FlowWorkFailure('delegation_invalid', `Delegation grants '${validation.capability.can}', not '${invoke.capability}'.`);
+        if (validation.invokerDid !== binding.managerDid) {
+            throw new FlowWorkFailure('delegation_invalid', `Delegation invoker '${validation.invokerDid}' does not match managerDid '${binding.managerDid}'.`);
+        }
+        if (!validation.capability) {
+            throw new FlowWorkFailure('delegation_invalid', 'Delegation validation returned no capability grant.');
+        }
+        if (validation.capability.can !== binding.capability ||
+            validation.capability.with !== binding.resource ||
+            !sameFlowWorkNb(validation.capability.nb, binding)) {
+            throw new FlowWorkFailure('delegation_invalid', 'Delegation can, with, or nb does not exactly match the assigned work binding.');
+        }
+        this.enforceCaveats(validation.capability.nb, invoke);
+        if (binding.deadline <= this.now()) {
+            throw new FlowWorkFailure('deadline_expired', `Invocation deadline ${binding.deadline} passed before execution.`);
         }
-        this.enforceCaveats(validation.capability?.nb, invoke);
         const inputs = capability.inputSchema.safeParse(invoke.inputs);
         if (!inputs.success) {
-            throw new FlowWorkFailure('input_invalid', inputs.error.issues
-                .map((issue) => `${issue.path.join('.')}: ${issue.message}`)
-                .join('; '));
+            throw new FlowWorkFailure('input_invalid', issues(inputs.error.issues));
         }
         let output;
         try {
             output = await capability.handler(inputs.data, {
                 invocationId: invoke.invocationId,
+                managerDid: invoke.managerDid,
                 capability: invoke.capability,
                 actionType: invoke.actionType,
                 nodeId: invoke.nodeId,
+                resource: invoke.resource,
+                inputHash: invoke.inputHash,
+                attempt: invoke.attempt,
+                deadline: invoke.deadline,
+                contractCaveats: structuredClone(binding.contractCaveats),
                 audience: invoke.audience,
                 delegation: invoke.delegation,
+                input: {
+                    request: (params) => this.inputCoordinator.request({
+                        roomId,
+                        invocationId: invoke.invocationId,
+                        nodeId: invoke.nodeId,
+                        attempt: invoke.attempt,
+                        inputHash: invoke.inputHash,
+                        bindingDeadline: binding.deadline,
+                    }, params),
+                },
             });
         }
         catch (error) {
+            if (error instanceof FlowWorkInputError)
+                throw error;
             throw new FlowWorkFailure('tool_error', message(error));
         }
+        if (capability.outputSchema) {
+            const validatedOutput = capability.outputSchema.safeParse(output);
+            if (!validatedOutput.success) {
+                throw new FlowWorkFailure('output_invalid', issues(validatedOutput.error.issues));
+            }
+            output = validatedOutput.data;
+        }
         return {
-            invocationId: invoke.invocationId,
+            ...binding,
             status: 'success',
             output: toReceiptOutput(output),
             error: null,
         };
     }
-    hasExistingReceipt(roomId, invocationId) {
-        const limit = this.options.receiptScanLimit ?? 100;
+    /** Preserve service contract caveats after the full exact nb comparison. */
+    enforceCaveats(nb, invoke) {
+        const claimSchema = nb?.claimSchema;
+        if (typeof claimSchema !== 'string' || claimSchema === '')
+            return;
+        const provided = invoke.inputs.claimSchemaId;
+        if (provided !== claimSchema) {
+            throw new FlowWorkFailure('delegation_invalid', `Delegation is caveated to claim schema '${claimSchema}' but the invocation carries '${typeof provided === 'string' ? provided : 'none'}'.`);
+        }
+    }
+    hasOwnReceipt(roomId, binding) {
+        const self = this.options.port.getUserId();
+        if (!self)
+            return false;
         return this.options.port
-            .recentEvents(roomId, limit)
-            .some((event) => event.type === FLOW_WORK_RECEIPT_EVENT &&
-            isRecord(event.content) &&
-            event.content.invocationId === invocationId);
-    }
-    async postFailure(roomId, invocationId, code, errorMessage) {
-        await this.postReceipt(roomId, {
-            invocationId,
-            status: 'failure',
-            output: null,
-            error: { code, message: errorMessage },
+            .stateEvents(roomId, FLOW_WORK_RECEIPT_EVENT)
+            .some((event) => {
+            if (event.stateKey !== binding.invocationId || event.sender !== self) {
+                return false;
+            }
+            const parsed = flowWorkReceiptSchema.safeParse(event.content);
+            return parsed.success && sameFlowWorkBinding(parsed.data, binding);
         });
     }
-    async postReceipt(roomId, receipt) {
-        await this.options.port.sendEvent(roomId, FLOW_WORK_RECEIPT_EVENT, {
-            ...receipt,
-        });
+    async publishReceipt(key) {
+        const pending = this.pendingReceipts.get(key);
+        if (!pending || this.publishing.has(key))
+            return;
+        this.publishing.add(key);
+        try {
+            await this.options.port.sendStateEvent(pending.roomId, FLOW_WORK_RECEIPT_EVENT, pending.receipt.invocationId, { ...pending.receipt });
+            this.pendingReceipts.delete(key);
+            this.publishedReceipts.set(key, pending);
+            this.completed.add(pending.workKey);
+            const timer = this.retryTimers.get(key);
+            if (timer)
+                clearTimeout(timer);
+            this.retryTimers.delete(key);
+        }
+        catch (error) {
+            this.options.logger.error(`[flow-work] failed to publish receipt for ${pending.receipt.invocationId}: ${message(error)}`);
+            this.scheduleReceiptRetry(key);
+        }
+        finally {
+            this.publishing.delete(key);
+        }
+    }
+    scheduleReceiptRetry(key) {
+        if (!this.started || this.retryTimers.has(key))
+            return;
+        const timer = setTimeout(() => {
+            this.retryTimers.delete(key);
+            void this.publishReceipt(key);
+        }, this.retryMs());
+        timer.unref?.();
+        this.retryTimers.set(key, timer);
     }
 }
+function assignmentKey(roomId, invocationId) {
+    return `${roomId}\u0000${invocationId}`;
+}
+function workKey(roomId, binding) {
+    return `${roomId}\u0000${binding.invocationId}\u0000${binding.attempt}`;
+}
+function bindingOf(value) {
+    return cloneBinding(Object.fromEntries(FLOW_WORK_BINDING_FIELDS.map((field) => [field, value[field]])));
+}
+function cloneBinding(binding) {
+    return deepFreeze({
+        ...binding,
+        contractCaveats: structuredClone(binding.contractCaveats),
+    });
+}
+function deepFreeze(value) {
+    if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const nested of Object.values(value)) {
+            deepFreeze(nested);
+        }
+    }
+    return value;
+}
+function failureReceipt(binding, code, errorMessage) {
+    return {
+        ...binding,
+        status: 'failure',
+        output: null,
+        error: { code, message: errorMessage },
+    };
+}
 function toReceiptOutput(value) {
     if (value === null || value === undefined)
         return null;
@@ -227,6 +564,11 @@ function toReceiptOutput(value) {
     const serializable = JSON.parse(json);
     return isRecord(serializable) ? serializable : { value: serializable };
 }
+function issues(values) {
+    return values
+        .map((issue) => `${issue.path.map(String).join('.')}: ${issue.message}`)
+        .join('; ');
+}
 function message(error) {
     return error instanceof Error ? error.message : String(error);
 }