@ixo/flow-work 0.6.0 → 0.7.0

package/dist/gateway-client.js

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+import { readBoundedRecord } from './bounded-codec.js';
+import { bounded, encodeBoundedJson, id, } from './bounded-protocol.js';
+const gatewayEvent = z
+    .object({
+    eventId: id,
+    roomId: id,
+    sender: id,
+    type: id,
+    content: z.custom(() => true),
+    encrypted: z.boolean(),
+    originServerTs: z.number().int().safe().nonnegative(),
+})
+    .strict();
+export class GatewayClient {
+    binding;
+    consumer;
+    constructor(binding, consumer) {
+        this.binding = binding;
+        this.consumer = consumer;
+        id.parse(consumer);
+    }
+    async call(path, body) {
+        const response = await this.binding.fetch(`https://flow.internal${path}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: encodeBoundedJson(body),
+            signal: AbortSignal.timeout(25_000),
+        });
+        if (!response.ok) {
+            let code = '';
+            if (response.body) {
+                try {
+                    const failure = await readBoundedRecord(response.body);
+                    if (failure &&
+                        typeof failure === 'object' &&
+                        !Array.isArray(failure) &&
+                        typeof failure.error === 'string')
+                        code = `:${failure.error}`;
+                }
+                catch {
+                    await response.body?.cancel();
+                }
+            }
+            throw new Error(`GATEWAY_HTTP_${response.status}${code}`);
+        }
+        if (!response.body)
+            throw new Error('GATEWAY_RESPONSE_MISSING');
+        return readBoundedRecord(response.body);
+    }
+    async read() {
+        // A single event can consume the complete record allowance. Never request an unbounded batch.
+        return bounded(z
+            .object({ events: z.array(gatewayEvent).max(1), hasMore: z.boolean() })
+            .strict(), await this.call('/v1/events/read', { consumer: this.consumer, limit: 1 }));
+    }
+    async ack(eventId) {
+        bounded(z.object({ acknowledged: z.literal(true) }).strict(), await this.call('/v1/events/ack', { consumer: this.consumer, eventId }));
+    }
+    async send(request) {
+        const response = bounded(z.object({ eventId: id }).strict(), await this.call('/v1/events/send', request));
+        return response.eventId;
+    }
+}
+/** Node hosts use a fixed configured service URL and a distinct private credential. */
+export class AuthenticatedServiceBinding {
+    baseUrl;
+    credential;
+    constructor(baseUrl, credential) {
+        this.baseUrl = baseUrl;
+        this.credential = credential;
+        const url = new URL(baseUrl);
+        const loopback = ['localhost', '127.0.0.1', '::1'].includes(url.hostname);
+        if (credential.length < 32 ||
+            credential.length > 4096 ||
+            url.username ||
+            url.password ||
+            (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) ||
+            url.pathname !== '/' ||
+            url.search ||
+            url.hash)
+            throw new Error('INVALID_SERVICE_CONFIGURATION');
+        this.baseUrl = url.toString();
+    }
+    fetch(input, init) {
+        const path = new URL(typeof input === 'string' ? input : input.url)
+            .pathname;
+        const headers = new Headers(init?.headers);
+        headers.set('authorization', `Bearer ${this.credential}`);
+        return fetch(new URL(path, this.baseUrl), {
+            ...init,
+            headers,
+            redirect: 'error',
+        });
+    }
+}
+//# sourceMappingURL=gateway-client.js.map

package/dist/gateway-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-client.js","sourceRoot":"","sources":["../src/gateway-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,EAAE,GAGH,MAAM,uBAAuB,CAAC;AAK/B,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,CAAC,CAAC,MAAM,CAAc,GAAG,EAAE,CAAC,IAAI,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;CACtD,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,OAAO,aAAa;IAEL;IACR;IAFX,YACmB,OAAuB,EAC/B,QAAgB;QADR,YAAO,GAAP,OAAO,CAAgB;QAC/B,aAAQ,GAAR,QAAQ,CAAQ;QAEzB,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,IAAI,EAAE,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,iBAAiB,CAAC,IAAmB,CAAa;YACxD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACvD,IACE,OAAO;wBACP,OAAO,OAAO,KAAK,QAAQ;wBAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;wBACvB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;wBAEjC,IAAI,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAChC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,CAAC,IAAI;QACR,8FAA8F;QAC9F,OAAO,OAAO,CACZ,CAAC;aACE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;aACtE,MAAM,EAAE,EACX,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,OAAO,CACL,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EACpD,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,OAMV;QACC,MAAM,QAAQ,GAAG,OAAO,CACtB,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAClC,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAC5C,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,OAAO,2BAA2B;IAEnB;IACA;IAFnB,YACmB,OAAe,EACf,UAAkB;QADlB,YAAO,GAAP,OAAO,CAAQ;QACf,eAAU,GAAV,UAAU,CAAQ;QAEnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1E,IACE,UAAU,CAAC,MAAM,GAAG,EAAE;YACtB,UAAU,CAAC,MAAM,GAAG,IAAI;YACxB,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;YACtE,GAAG,CAAC,QAAQ,KAAK,GAAG;YACpB,GAAG,CAAC,MAAM;YACV,GAAG,CAAC,IAAI;YAER,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IACD,KAAK,CAAC,KAAuB,EAAE,IAAkB;QAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;aAChE,QAAQ,CAAC;QACZ,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YACxC,GAAG,IAAI;YACP,OAAO;YACP,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/node-sqlite.d.ts

@@ -0,0 +1,12 @@
+import { DatabaseSync } from 'node:sqlite';
+import type { WorkSql } from './durable-store.js';
+/** One local SQLite file per helper process group. SQL claims serialize concurrent helper instances. */
+export declare class NodeWorkSql implements WorkSql {
+    readonly database: DatabaseSync;
+    private transactionDepth;
+    readonly sql: WorkSql['sql'];
+    constructor(path: string);
+    transactionSync<T>(body: () => T): T;
+    close(): void;
+}
+//# sourceMappingURL=node-sqlite.d.ts.map

package/dist/node-sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-sqlite.d.ts","sourceRoot":"","sources":["../src/node-sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,wGAAwG;AACxG,qBAAa,WAAY,YAAW,OAAO;IACzC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,OAAO,CAAC,gBAAgB,CAAK;IAC7B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,IAAI,EAAE,MAAM;IAkBxB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC;IAoBpC,KAAK,IAAI,IAAI;CAGd"}

package/dist/node-sqlite.js

@@ -0,0 +1,45 @@
+import { DatabaseSync } from 'node:sqlite';
+/** One local SQLite file per helper process group. SQL claims serialize concurrent helper instances. */
+export class NodeWorkSql {
+    database;
+    transactionDepth = 0;
+    sql;
+    constructor(path) {
+        this.database = new DatabaseSync(path);
+        this.database.exec('PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA busy_timeout=5000;');
+        this.sql = {
+            exec: (statement, ...args) => {
+                const query = this.database.prepare(statement);
+                if (/^\s*(SELECT|WITH|PRAGMA)\b/i.test(statement))
+                    return { toArray: () => query.all(...args) };
+                query.run(...args);
+                return { toArray: () => [] };
+            },
+        };
+    }
+    transactionSync(body) {
+        const depth = this.transactionDepth++;
+        const name = `work_${depth}`;
+        try {
+            this.database.exec(depth ? `SAVEPOINT ${name}` : 'BEGIN IMMEDIATE');
+            try {
+                const result = body();
+                this.database.exec(depth ? `RELEASE SAVEPOINT ${name}` : 'COMMIT');
+                return result;
+            }
+            catch (error) {
+                this.database.exec(depth ? `ROLLBACK TO SAVEPOINT ${name}` : 'ROLLBACK');
+                if (depth)
+                    this.database.exec(`RELEASE SAVEPOINT ${name}`);
+                throw error;
+            }
+        }
+        finally {
+            this.transactionDepth--;
+        }
+    }
+    close() {
+        this.database.close();
+    }
+}
+//# sourceMappingURL=node-sqlite.js.map

package/dist/node-sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-sqlite.js","sourceRoot":"","sources":["../src/node-sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,wGAAwG;AACxG,MAAM,OAAO,WAAW;IACb,QAAQ,CAAe;IACxB,gBAAgB,GAAG,CAAC,CAAC;IACpB,GAAG,CAAiB;IAC7B,YAAY,IAAY;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAChB,6EAA6E,CAC9E,CAAC;QACF,IAAI,CAAC,GAAG,GAAG;YACT,IAAI,EAAE,CACJ,SAAiB,EACjB,GAAG,IAAgC,EACnC,EAAE;gBACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC/C,IAAI,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC/C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAQ,EAAE,CAAC;gBACtD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBACnB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAS,EAAE,CAAC;YACtC,CAAC;SACF,CAAC;IACJ,CAAC;IACD,eAAe,CAAI,IAAa;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACpE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACnE,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,IAAI,CAChB,KAAK,CAAC,CAAC,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CACrD,CAAC;gBACF,IAAI,KAAK;oBAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;gBAC3D,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/protocol.d.ts

@@ -76,12 +76,12 @@ export declare const flowWorkInvokeSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type FlowWorkInvoke = z.infer<typeof flowWorkInvokeSchema>;
 export declare const flowWorkErrorCodeSchema: z.ZodEnum<{
+    delegation_expired: "delegation_expired";
+    delegation_invalid: "delegation_invalid";
     assignment_missing: "assignment_missing";
     sender_untrusted: "sender_untrusted";
     binding_mismatch: "binding_mismatch";
     deadline_expired: "deadline_expired";
-    delegation_invalid: "delegation_invalid";
-    delegation_expired: "delegation_expired";
     capability_not_declared: "capability_not_declared";
     input_invalid: "input_invalid";
     output_invalid: "output_invalid";
@@ -109,12 +109,12 @@ export declare const flowWorkReceiptSchema: z.ZodDiscriminatedUnion<[z.ZodObject
     output: z.ZodNull;
     error: z.ZodObject<{
         code: z.ZodEnum<{
+            delegation_expired: "delegation_expired";
+            delegation_invalid: "delegation_invalid";
             assignment_missing: "assignment_missing";
             sender_untrusted: "sender_untrusted";
             binding_mismatch: "binding_mismatch";
             deadline_expired: "deadline_expired";
-            delegation_invalid: "delegation_invalid";
-            delegation_expired: "delegation_expired";
             capability_not_declared: "capability_not_declared";
             input_invalid: "input_invalid";
             output_invalid: "output_invalid";

package/dist/provider-journal.d.ts

@@ -0,0 +1,26 @@
+import { type BoundedJson } from './bounded-protocol.js';
+import type { WorkSql } from './durable-store.js';
+export declare class ProviderOutcomeUnknown extends Error {
+    constructor();
+}
+/** Provider attempts and pure preparation records share a durable business key, never an attempt id. */
+export declare class ProviderJournal {
+    private readonly storage;
+    constructor(storage: WorkSql);
+    prepare(key: string, stage: string, inputs: BoundedJson, compute: () => Promise<BoundedJson>): Promise<BoundedJson>;
+    execute(options: {
+        key: string;
+        stage: string;
+        submitted: BoundedJson;
+        invoke(): Promise<BoundedJson>;
+        readback(submitted: BoundedJson): Promise<{
+            proven: true;
+            result: BoundedJson;
+        } | {
+            proven: false;
+        }>;
+    }): Promise<BoundedJson>;
+    /** Restore the exact provider request before any model or calendar default can change it. */
+    submitted(key: string, stage: string): BoundedJson | null;
+}
+//# sourceMappingURL=provider-journal.d.ts.map

package/dist/provider-journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-journal.d.ts","sourceRoot":"","sources":["../src/provider-journal.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAIlD,qBAAa,sBAAuB,SAAQ,KAAK;;CAIhD;AACD,wGAAwG;AACxG,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,OAAO;IASvC,OAAO,CACX,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC;IA+BjB,OAAO,CAAC,OAAO,EAAE;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,WAAW,CAAC;QACvB,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/B,QAAQ,CACN,SAAS,EAAE,WAAW,GACrB,OAAO,CAAC;YAAE,MAAM,EAAE,IAAI,CAAC;YAAC,MAAM,EAAE,WAAW,CAAA;SAAE,GAAG;YAAE,MAAM,EAAE,KAAK,CAAA;SAAE,CAAC,CAAC;KACvE,GAAG,OAAO,CAAC,WAAW,CAAC;IAkExB,6FAA6F;IAC7F,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;CAU1D"}

package/dist/provider-journal.js

@@ -0,0 +1,94 @@
+import { z } from 'zod';
+import { hash, text, parse, same, } from './bounded-protocol.js';
+const json = z.custom(() => true);
+export class ProviderOutcomeUnknown extends Error {
+    constructor() {
+        super('PROVIDER_OUTCOME_UNKNOWN');
+    }
+}
+/** Provider attempts and pure preparation records share a durable business key, never an attempt id. */
+export class ProviderJournal {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+        storage.sql.exec(`CREATE TABLE IF NOT EXISTS helper_provider (
+      operation_key TEXT NOT NULL, stage TEXT NOT NULL, fingerprint TEXT NOT NULL,
+      submitted TEXT NOT NULL, state TEXT NOT NULL, result TEXT,
+      PRIMARY KEY(operation_key,stage))`);
+        storage.sql.exec(`CREATE TABLE IF NOT EXISTS helper_preparation (
+      operation_key TEXT NOT NULL, stage TEXT NOT NULL, fingerprint TEXT NOT NULL,
+      result TEXT NOT NULL, PRIMARY KEY(operation_key,stage))`);
+    }
+    async prepare(key, stage, inputs, compute) {
+        const fingerprint = await hash(inputs);
+        const read = () => this.storage.sql
+            .exec('SELECT fingerprint,result FROM helper_preparation WHERE operation_key=? AND stage=?', key, stage)
+            .toArray()[0];
+        const prior = read();
+        if (prior) {
+            if (prior.fingerprint !== fingerprint)
+                throw new Error('PREPARATION_INPUT_CONFLICT');
+            return parse(json, String(prior.result));
+        }
+        const result = text(await compute());
+        return this.storage.transactionSync(() => {
+            this.storage.sql.exec('INSERT OR IGNORE INTO helper_preparation VALUES (?,?,?,?)', key, stage, fingerprint, result);
+            const accepted = read();
+            if (accepted.fingerprint !== fingerprint)
+                throw new Error('PREPARATION_INPUT_CONFLICT');
+            return parse(json, String(accepted.result));
+        });
+    }
+    async execute(options) {
+        const fingerprint = await hash(options.submitted);
+        const read = () => this.storage.sql
+            .exec('SELECT * FROM helper_provider WHERE operation_key=? AND stage=?', options.key, options.stage)
+            .toArray()[0];
+        const first = this.storage.transactionSync(() => {
+            const prior = read();
+            if (prior) {
+                if (prior.fingerprint !== fingerprint ||
+                    prior.submitted !== text(options.submitted))
+                    throw new Error('PROVIDER_FINGERPRINT_CONFLICT');
+                return false;
+            }
+            this.storage.sql.exec(`INSERT INTO helper_provider VALUES (?,?,?,?,'armed',NULL)`, options.key, options.stage, fingerprint, text(options.submitted));
+            return true;
+        });
+        const prior = read();
+        if (prior.state === 'complete')
+            return parse(json, String(prior.result));
+        let result;
+        try {
+            if (first)
+                result = await options.invoke();
+            else {
+                const evidence = await options.readback(parse(json, String(prior.submitted)));
+                if (!evidence.proven)
+                    throw new ProviderOutcomeUnknown();
+                result = evidence.result;
+            }
+            const encoded = text(result);
+            this.storage.transactionSync(() => {
+                const current = read();
+                if (current.result !== null &&
+                    !same(parse(json, String(current.result)), result))
+                    throw new Error('PROVIDER_RESULT_CONFLICT');
+                this.storage.sql.exec(`UPDATE helper_provider SET state='complete',result=? WHERE operation_key=? AND stage=?`, encoded, options.key, options.stage);
+            });
+            return result;
+        }
+        catch (error) {
+            this.storage.sql.exec(`UPDATE helper_provider SET state='needs_verification' WHERE operation_key=? AND stage=? AND state<>'complete'`, options.key, options.stage);
+            throw error;
+        }
+    }
+    /** Restore the exact provider request before any model or calendar default can change it. */
+    submitted(key, stage) {
+        const row = this.storage.sql
+            .exec('SELECT submitted FROM helper_provider WHERE operation_key=? AND stage=?', key, stage)
+            .toArray()[0];
+        return row ? parse(json, String(row.submitted)) : null;
+    }
+}
+//# sourceMappingURL=provider-journal.js.map

package/dist/provider-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-journal.js","sourceRoot":"","sources":["../src/provider-journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,KAAK,EACL,IAAI,GAEL,MAAM,uBAAuB,CAAC;AAI/B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAc,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC/C,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpC,CAAC;CACF;AACD,wGAAwG;AACxG,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;QAC3C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;;;wCAGmB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;;8DAEyC,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,OAAO,CACX,GAAW,EACX,KAAa,EACb,MAAmB,EACnB,OAAmC;QAEnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,IAAI,CAAC,OAAO,CAAC,GAAG;aACb,IAAI,CACH,qFAAqF,EACrF,GAAG,EACH,KAAK,CACN;aACA,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;QACrB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;gBACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE;YACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACnB,2DAA2D,EAC3D,GAAG,EACH,KAAK,EACL,WAAW,EACX,MAAM,CACP,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,EAAG,CAAC;YACzB,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW;gBACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAQb;QACC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,IAAI,CAAC,OAAO,CAAC,GAAG;aACb,IAAI,CACH,iEAAiE,EACjE,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,CACd;aACA,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE;YAC9C,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,IAAI,KAAK,EAAE,CAAC;gBACV,IACE,KAAK,CAAC,WAAW,KAAK,WAAW;oBACjC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;oBAE3C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACnB,2DAA2D,EAC3D,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,EACb,WAAW,EACX,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CACxB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,EAAG,CAAC;QACtB,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;iBACtC,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CACrC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACrC,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,MAAM;oBAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;gBACzD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC3B,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE;gBAChC,MAAM,OAAO,GAAG,IAAI,EAAG,CAAC;gBACxB,IACE,OAAO,CAAC,MAAM,KAAK,IAAI;oBACvB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC;oBAElD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACnB,wFAAwF,EACxF,OAAO,EACP,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,CACd,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACnB,+GAA+G,EAC/G,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,CACd,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,6FAA6F;IAC7F,SAAS,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG;aACzB,IAAI,CACH,yEAAyE,EACzE,GAAG,EACH,KAAK,CACN;aACA,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;CACF"}

package/dist/work-authority.d.ts

@@ -0,0 +1,16 @@
+import { type BoundedWorkBinding } from './bounded-protocol.js';
+import { type ExecutionCatalog, type ExecutionAuthorityPort, type ExecutionDefinitionPort } from './execution-service.js';
+import type { WorkAuthority } from './durable-listener.js';
+/** The helper verifies its exact independently stored routing grant and the current execution authority. */
+export declare class DefinitionWorkAuthority implements WorkAuthority {
+    private readonly definitions;
+    private readonly authority;
+    private readonly catalog;
+    constructor(definitions: ExecutionDefinitionPort, authority: ExecutionAuthorityPort, catalog: Pick<ExecutionCatalog, 'validate'>);
+    authorize(binding: BoundedWorkBinding): Promise<{
+        expiresAt: number;
+        stateVersion: number;
+        grantDigest: string;
+    }>;
+}
+//# sourceMappingURL=work-authority.d.ts.map

package/dist/work-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-authority.d.ts","sourceRoot":"","sources":["../src/work-authority.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,4GAA4G;AAC5G,qBAAa,uBAAwB,YAAW,aAAa;IAEzD,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFP,WAAW,EAAE,uBAAuB,EACpC,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC;IAExD,SAAS,CAAC,OAAO,EAAE,kBAAkB;;;;;CA2B5C"}

package/dist/work-authority.js

@@ -0,0 +1,31 @@
+import { decodeDefinitionRecord } from './bounded-definitions.js';
+import { bounded, decodeBoundedJson, encodeBoundedJson, same, } from './bounded-protocol.js';
+import { actionReferenceSchema, workAuthorizationSchema, } from './execution-service.js';
+/** The helper verifies its exact independently stored routing grant and the current execution authority. */
+export class DefinitionWorkAuthority {
+    definitions;
+    authority;
+    catalog;
+    constructor(definitions, authority, catalog) {
+        this.definitions = definitions;
+        this.authority = authority;
+        this.catalog = catalog;
+    }
+    async authorize(binding) {
+        const a = binding.admission;
+        const stored = workAuthorizationSchema.parse(decodeBoundedJson(await this.definitions.readExecutionAuthorization(a.flowId, a.id)));
+        if (!('binding' in stored) || !same(stored.binding, binding))
+            throw new Error('STORED_WORK_AUTHORITY_MISMATCH');
+        const definition = decodeDefinitionRecord(await this.definitions.readExecutionDefinition(a.flowId, a.id));
+        if (definition.category !== 'step' ||
+            definition.value.stepId !== a.stepId ||
+            definition.value.resource !== binding.resource)
+            throw new Error('HELPER_DEFINITION_MISMATCH');
+        const action = bounded(actionReferenceSchema, definition.value.action);
+        if (action.type !== binding.actionType || action.can !== binding.capability)
+            throw new Error('HELPER_CONTRACT_MISMATCH');
+        this.catalog.validate(action);
+        return this.authority.authorizeExecution(a.flowId, encodeBoundedJson(a));
+    }
+}
+//# sourceMappingURL=work-authority.js.map

package/dist/work-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-authority.js","sourceRoot":"","sources":["../src/work-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,iBAAiB,EACjB,IAAI,GAGL,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAIxB,MAAM,wBAAwB,CAAC;AAGhC,4GAA4G;AAC5G,MAAM,OAAO,uBAAuB;IAEf;IACA;IACA;IAHnB,YACmB,WAAoC,EACpC,SAAiC,EACjC,OAA2C;QAF3C,gBAAW,GAAX,WAAW,CAAyB;QACpC,cAAS,GAAT,SAAS,CAAwB;QACjC,YAAO,GAAP,OAAO,CAAoC;IAC3D,CAAC;IACJ,KAAK,CAAC,SAAS,CAAC,OAA2B;QACzC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAC1C,iBAAiB,CACf,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAClE,CACF,CAAC;QACF,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,sBAAsB,CACvC,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAC/D,CAAC;QACF,IACE,UAAU,CAAC,QAAQ,KAAK,MAAM;YAC9B,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YACpC,UAAU,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;YAE9C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU;YACzE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,CACtC,CAAC,CAAC,MAAM,EACR,iBAAiB,CAAC,CAA2B,CAAC,CAC/C,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,12 +1,20 @@
 {
   "name": "@ixo/flow-work",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Oracle-side flow-work plugin: accept UCAN-delegated ixo.flow.work invocations from the IXO flow-manager over Matrix and post receipts.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
+    "./bounded": {
+      "types": "./dist/bounded.d.ts",
+      "import": "./dist/bounded.js"
+    },
+    "./node-sqlite": {
+      "types": "./dist/node-sqlite.d.ts",
+      "import": "./dist/node-sqlite.js"
+    },
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"