@positronic/cloudflare 0.0.63 → 0.0.65

package/dist/src/api/index.js

@@ -169,6 +169,13 @@ app.use('*', function(c, next) {
                     next()
                 ];
             }
+            // Ignore favicon requests (browsers auto-request this when loading pages)
+            if (c.req.path === '/favicon.ico') {
+                return [
+                    2,
+                    c.body(null, 204)
+                ];
+            }
             // Skip auth for viewing pages (GET /pages/:slug but not GET /pages/ or /pages/:slug/meta)
             if (c.req.method === 'GET' && c.req.path.startsWith('/pages/') && !c.req.path.endsWith('/meta')) {
                 return [

package/dist/src/api/webhooks/coordination.js

@@ -1,11 +1,3 @@
-function _array_like_to_array(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_with_holes(arr) {
-    if (Array.isArray(arr)) return arr;
-}
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -35,44 +27,6 @@ function _async_to_generator(fn) {
         });
     };
 }
-function _iterable_to_array_limit(arr, i) {
-    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
-    if (_i == null) return;
-    var _arr = [];
-    var _n = true;
-    var _d = false;
-    var _s, _e;
-    try {
-        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
-            _arr.push(_s.value);
-            if (i && _arr.length === i) break;
-        }
-    } catch (err) {
-        _d = true;
-        _e = err;
-    } finally{
-        try {
-            if (!_n && _i["return"] != null) _i["return"]();
-        } finally{
-            if (_d) throw _e;
-        }
-    }
-    return _arr;
-}
-function _non_iterable_rest() {
-    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _sliced_to_array(arr, i) {
-    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
-}
-function _unsupported_iterable_to_array(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
-}
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -164,16 +118,16 @@ function _ts_generator(thisArg, body) {
         };
     }
 }
-import { isSignalValid, brainMachineDefinition } from '@positronic/core';
+import { isSignalValid, brainMachineDefinition, validateWebhookToken } from '@positronic/core';
 /**
  * Find a brain waiting for a webhook, queue the WEBHOOK_RESPONSE signal, and wake it up.
  * Returns a JSON response object suitable for returning from a webhook endpoint.
  *
  * This is the signal-based approach: webhook response data flows through the signal queue
  * rather than being passed directly to the resume method.
- */ export function queueWebhookAndWakeUp(context, slug, identifier, response) {
+ */ export function queueWebhookAndWakeUp(context, slug, identifier, response, submittedToken) {
     return _async_to_generator(function() {
-        var monitorId, monitorStub, brainRunId, run, validation, namespace, doId, stub;
+        var monitorId, monitorStub, result, brainRunId, expectedToken, tokenValidation, run, validation, namespace, doId, stub;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -184,11 +138,30 @@ import { isSignalValid, brainMachineDefinition } from '@positronic/core';
                         monitorStub.findWaitingBrain(slug, identifier)
                     ];
                 case 1:
-                    brainRunId = _state.sent();
-                    if (!brainRunId) return [
+                    result = _state.sent();
+                    if (!result) return [
                         3,
                         5
                     ];
+                    brainRunId = result.brainRunId, expectedToken = result.token;
+                    // Validate CSRF token
+                    tokenValidation = validateWebhookToken(expectedToken, submittedToken);
+                    if (!tokenValidation.valid) {
+                        return [
+                            2,
+                            {
+                                received: true,
+                                action: 'ignored',
+                                identifier: identifier,
+                                brainRunId: brainRunId,
+                                reason: tokenValidation.reason
+                            }
+                        ];
+                    }
+                    // Warn in dev mode when no token is present — may indicate an unprotected form
+                    if (!expectedToken && !submittedToken && context.env.NODE_ENV === 'development') {
+                        console.warn('[positronic] Webhook "'.concat(slug, '" received without a CSRF token. ') + "This is fine if you validate the request in your webhook handler, " + "but if this webhook receives form submissions from a page, consider " + "adding a token with generateFormToken(). See the docs for details.");
+                    }
                     return [
                         4,
                         monitorStub.getRun(brainRunId)
@@ -254,49 +227,5 @@ import { isSignalValid, brainMachineDefinition } from '@positronic/core';
         });
     })();
 }
-/**
- * Parse form data into a plain object, handling array fields.
- * Supports:
- * - name[] syntax for explicit arrays
- * - Multiple values with same key (converted to array)
- */ export function parseFormData(formData) {
-    var result = {};
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-    try {
-        for(var _iterator = formData.entries()[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array(_step.value, 2), key = _step_value[0], value = _step_value[1];
-            // Handle array fields (e.g., name[] for multi-select)
-            if (key.endsWith('[]')) {
-                var baseKey = key.slice(0, -2);
-                if (!result[baseKey]) {
-                    result[baseKey] = [];
-                }
-                result[baseKey].push(value);
-            } else if (result[key] !== undefined) {
-                // Convert to array if same key appears multiple times
-                if (!Array.isArray(result[key])) {
-                    result[key] = [
-                        result[key]
-                    ];
-                }
-                result[key].push(value);
-            } else {
-                result[key] = value;
-            }
-        }
-    } catch (err) {
-        _didIteratorError = true;
-        _iteratorError = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                _iterator.return();
-            }
-        } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
-            }
-        }
-    }
-    return result;
-}
+// Re-export parseFormData from core for backwards compatibility
+export { parseFormData } from '@positronic/core';

package/dist/src/api/webhooks/index.js

@@ -197,7 +197,7 @@ webhooks.get('/', function(context) {
 // Receive incoming webhook from external service (user-defined webhooks)
 webhooks.post('/:slug', function(context) {
     return _async_to_generator(function() {
-        var slug, webhookManifest, webhook, handlerResult, result, error;
+        var slug, webhookManifest, webhook, clonedReq, handlerResult, submittedToken, contentType, formData, e, result, error;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -216,10 +216,13 @@ webhooks.post('/:slug', function(context) {
                 case 1:
                     _state.trys.push([
                         1,
-                        4,
+                        8,
                         ,
-                        5
+                        9
                     ]);
+                    // Clone the request so we can extract the CSRF token separately
+                    // without consuming the body that the user's handler needs
+                    clonedReq = context.req.raw.clone();
                     return [
                         4,
                         webhook.handler(context.req.raw)
@@ -235,11 +238,44 @@ webhooks.post('/:slug', function(context) {
                             })
                         ];
                     }
+                    // Extract CSRF token from form submissions
+                    submittedToken = null;
+                    contentType = clonedReq.headers.get('content-type') || '';
+                    if (!(contentType.includes('form-urlencoded') || contentType.includes('form-data'))) return [
+                        3,
+                        6
+                    ];
+                    _state.label = 3;
+                case 3:
+                    _state.trys.push([
+                        3,
+                        5,
+                        ,
+                        6
+                    ]);
                     return [
                         4,
-                        queueWebhookAndWakeUp(context, slug, handlerResult.identifier, handlerResult.response)
+                        clonedReq.formData()
                     ];
-                case 3:
+                case 4:
+                    formData = _state.sent();
+                    submittedToken = formData.get('__positronic_token');
+                    return [
+                        3,
+                        6
+                    ];
+                case 5:
+                    e = _state.sent();
+                    return [
+                        3,
+                        6
+                    ];
+                case 6:
+                    return [
+                        4,
+                        queueWebhookAndWakeUp(context, slug, handlerResult.identifier, handlerResult.response, submittedToken)
+                    ];
+                case 7:
                     result = _state.sent();
                     // For user webhooks, return 'queued' instead of 'not_found' when no brain is waiting
                     // This allows webhooks to be received even when no brain is actively waiting
@@ -257,7 +293,7 @@ webhooks.post('/:slug', function(context) {
                         2,
                         context.json(result)
                     ];
-                case 4:
+                case 8:
                     error = _state.sent();
                     console.error("Error receiving webhook ".concat(slug, ":"), error);
                     return [
@@ -266,7 +302,7 @@ webhooks.post('/:slug', function(context) {
                             error: 'Failed to process webhook'
                         }, 500)
                     ];
-                case 5:
+                case 9:
                     return [
                         2
                     ];

package/dist/src/api/webhooks/system.js

@@ -181,7 +181,7 @@ var system = new Hono();
  * Content-Type: application/x-www-form-urlencoded or multipart/form-data
  */ system.post('/ui-form', function(context) {
     return _async_to_generator(function() {
-        var identifier, formData, response, result, error;
+        var identifier, formData, _parseFormData, response, token, result, error;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -208,13 +208,32 @@ var system = new Hono();
                     ];
                 case 2:
                     formData = _state.sent();
-                    response = parseFormData(formData);
+                    _parseFormData = parseFormData(formData), response = _parseFormData.data, token = _parseFormData.token;
+                    // System ui-form endpoint always requires a CSRF token
+                    if (!token) {
+                        return [
+                            2,
+                            context.json({
+                                received: false,
+                                action: 'ignored',
+                                identifier: identifier,
+                                reason: 'Missing form token'
+                            }, 403)
+                        ];
+                    }
                     return [
                         4,
-                        queueWebhookAndWakeUp(context, 'ui-form', identifier, response)
+                        queueWebhookAndWakeUp(context, 'ui-form', identifier, response, token)
                     ];
                 case 3:
                     result = _state.sent();
+                    // Return 403 if token mismatch
+                    if (result.action === 'ignored' && result.reason === 'Invalid form token') {
+                        return [
+                            2,
+                            context.json(result, 403)
+                        ];
+                    }
                     // Return 404 if no brain was waiting
                     if (result.action === 'not_found') {
                         return [

package/dist/src/brain-runner-do.js

@@ -294,6 +294,7 @@ import { DurableObject } from 'cloudflare:workers';
 import { CloudflareSignalProvider } from './signal-provider.js';
 import { BrainRunSQLiteAdapter } from './sqlite-adapter.js';
 import { WebhookAdapter } from './webhook-adapter.js';
+import { TimeoutAdapter } from './timeout-adapter.js';
 import { PageAdapter } from './page-adapter.js';
 import { EventLoader } from './event-loader.js';
 import { createPagesService } from './pages-service.js';
@@ -504,6 +505,8 @@ var ScheduleAdapter = /*#__PURE__*/ function() {
 }();
 // SQL to initialize the signals table
 var signalsTableSQL = "\nCREATE TABLE IF NOT EXISTS brain_signals (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  signal_type TEXT NOT NULL,\n  content TEXT,\n  queued_at INTEGER NOT NULL\n);\n";
+// SQL to initialize the wait timeout table
+var waitTimeoutTableSQL = "\nCREATE TABLE IF NOT EXISTS wait_timeout (\n  brain_run_id TEXT PRIMARY KEY,\n  timeout_at INTEGER NOT NULL\n);\n";
 export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
     "use strict";
     _inherits(BrainRunnerDO, DurableObject);
@@ -513,7 +516,7 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
         _this = _call_super(this, BrainRunnerDO, [
             state,
             env
-        ]), _define_property(_this, "sql", void 0), _define_property(_this, "brainRunId", void 0), _define_property(_this, "eventStreamAdapter", new EventStreamAdapter()), _define_property(_this, "abortController", null), _define_property(_this, "pageAdapter", null), _define_property(_this, "signalsTableInitialized", false);
+        ]), _define_property(_this, "sql", void 0), _define_property(_this, "brainRunId", void 0), _define_property(_this, "eventStreamAdapter", new EventStreamAdapter()), _define_property(_this, "abortController", null), _define_property(_this, "pageAdapter", null), _define_property(_this, "signalsTableInitialized", false), _define_property(_this, "waitTimeoutTableInitialized", false);
         _this.sql = state.storage.sql;
         _this.brainRunId = state.id.toString();
         _this.env = env;
@@ -529,6 +532,41 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
                 }
             }
         },
+        {
+            key: "initializeWaitTimeoutTable",
+            value: function initializeWaitTimeoutTable() {
+                if (!this.waitTimeoutTableInitialized) {
+                    this.sql.exec(waitTimeoutTableSQL);
+                    this.waitTimeoutTableInitialized = true;
+                }
+            }
+        },
+        {
+            key: "storeWaitTimeout",
+            value: function storeWaitTimeout(brainRunId, timeoutAt) {
+                this.initializeWaitTimeoutTable();
+                this.sql.exec("INSERT OR REPLACE INTO wait_timeout (brain_run_id, timeout_at) VALUES (?, ?)", brainRunId, timeoutAt);
+            }
+        },
+        {
+            key: "clearWaitTimeout",
+            value: function clearWaitTimeout(brainRunId) {
+                this.initializeWaitTimeoutTable();
+                this.sql.exec("DELETE FROM wait_timeout WHERE brain_run_id = ?", brainRunId);
+            }
+        },
+        {
+            key: "getWaitTimeout",
+            value: function getWaitTimeout() {
+                this.initializeWaitTimeoutTable();
+                var results = this.sql.exec("SELECT brain_run_id, timeout_at FROM wait_timeout LIMIT 1").toArray();
+                if (results.length === 0) return null;
+                return {
+                    brainRunId: results[0].brain_run_id,
+                    timeoutAt: results[0].timeout_at
+                };
+            }
+        },
         {
             key: "queueSignal",
             value: /**
@@ -928,14 +966,31 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
             key: "alarm",
             value: function alarm() {
                 return _async_to_generator(function() {
+                    var timeout;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
+                                timeout = this.getWaitTimeout();
+                                if (!(timeout && Date.now() >= timeout.timeoutAt)) return [
+                                    3,
+                                    2
+                                ];
+                                this.clearWaitTimeout(timeout.brainRunId);
                                 return [
                                     4,
-                                    this.wakeUp(this.brainRunId)
+                                    this.queueSignal({
+                                        type: 'KILL'
+                                    })
                                 ];
                             case 1:
+                                _state.sent();
+                                _state.label = 2;
+                            case 2:
+                                return [
+                                    4,
+                                    this.wakeUp(this.brainRunId)
+                                ];
+                            case 3:
                                 _state.sent();
                                 return [
                                     2
@@ -949,7 +1004,7 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
             key: "start",
             value: function start(brainTitle, brainRunId, initialData) {
                 return _async_to_generator(function() {
-                    var _this, sql, resolution, brainToRun, sqliteAdapter, eventStreamAdapter, monitorDOStub, monitorAdapter, scheduleAdapter, webhookAdapter, env, pagesService, r2Resources, runnerWithResources, signalProvider, options, initialState, batchChunkAdapter;
+                    var _this, sql, resolution, brainToRun, sqliteAdapter, eventStreamAdapter, monitorDOStub, monitorAdapter, scheduleAdapter, webhookAdapter, env, pagesService, r2Resources, runnerWithResources, signalProvider, options, initialState, batchChunkAdapter, timeoutAdapter;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -1016,6 +1071,11 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
                                 }, function(time) {
                                     return _this.ctx.storage.setAlarm(time);
                                 });
+                                timeoutAdapter = new TimeoutAdapter(function(brainRunId, timeoutAt) {
+                                    return _this.storeWaitTimeout(brainRunId, timeoutAt);
+                                }, function(time) {
+                                    return _this.ctx.storage.setAlarm(time);
+                                });
                                 runnerWithResources.withAdapters([
                                     sqliteAdapter,
                                     eventStreamAdapter,
@@ -1023,7 +1083,8 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
                                     scheduleAdapter,
                                     webhookAdapter,
                                     this.pageAdapter,
-                                    batchChunkAdapter
+                                    batchChunkAdapter,
+                                    timeoutAdapter
                                 ]).run(brainToRun, _object_spread_props(_object_spread({
                                     initialState: initialState,
                                     brainRunId: brainRunId
@@ -1054,12 +1115,29 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
    * This method reconstructs state and calls BrainRunner.resume().
    */ function wakeUp(brainRunId) {
                 return _async_to_generator(function() {
-                    var _this, sql, eventLoader, startEvent, brainTitle, initialState, originalBrainRunId, resolution, brainToRun, allEvents, machine, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, event, sqliteAdapter, eventStreamAdapter, monitorDOStub, monitorAdapter, scheduleAdapter, webhookAdapter, env, pagesService, r2Resources, runnerWithResources, signalProvider, batchChunkAdapter;
+                    var _this, sql, pendingTimeout, eventLoader, startEvent, brainTitle, initialState, originalBrainRunId, resolution, brainToRun, allEvents, machine, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, event, sqliteAdapter, eventStreamAdapter, monitorDOStub, monitorAdapter, scheduleAdapter, webhookAdapter, env, pagesService, r2Resources, runnerWithResources, signalProvider, batchChunkAdapter, timeoutAdapter;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 _this = this;
                                 sql = this.sql;
+                                // Clear any pending timeout and cancel the alarm to prevent spurious alarm
+                                // fires after explicit resume. Safe because wakeUp() is only called when a
+                                // brain is suspended (waiting/paused), never during active batch execution.
+                                pendingTimeout = this.getWaitTimeout();
+                                if (!pendingTimeout) return [
+                                    3,
+                                    2
+                                ];
+                                this.clearWaitTimeout(pendingTimeout.brainRunId);
+                                return [
+                                    4,
+                                    this.ctx.storage.deleteAlarm()
+                                ];
+                            case 1:
+                                _state.sent();
+                                _state.label = 2;
+                            case 2:
                                 if (!manifest) {
                                     throw new Error('Runtime manifest not initialized');
                                 }
@@ -1069,7 +1147,7 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
                                     4,
                                     eventLoader.loadEventByType(BRAIN_EVENTS.START, 'ASC')
                                 ];
-                            case 1:
+                            case 3:
                                 startEvent = _state.sent();
                                 if (!startEvent) {
                                     throw new Error("No START event found for brain run ".concat(brainRunId));
@@ -1102,7 +1180,7 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
                                     4,
                                     eventLoader.loadAllEvents()
                                 ];
-                            case 2:
+                            case 4:
                                 allEvents = _state.sent();
                                 // Create state machine and feed all historical events to reconstruct execution state
                                 machine = createBrainExecutionMachine({
@@ -1146,7 +1224,7 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
                                     4,
                                     this.loadResourcesFromR2()
                                 ];
-                            case 3:
+                            case 5:
                                 r2Resources = _state.sent();
                                 runnerWithResources = brainRunner;
                                 if (r2Resources) {
@@ -1167,6 +1245,11 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
                                 }, function(time) {
                                     return _this.ctx.storage.setAlarm(time);
                                 });
+                                timeoutAdapter = new TimeoutAdapter(function(brainRunId, timeoutAt) {
+                                    return _this.storeWaitTimeout(brainRunId, timeoutAt);
+                                }, function(time) {
+                                    return _this.ctx.storage.setAlarm(time);
+                                });
                                 runnerWithResources.withAdapters([
                                     sqliteAdapter,
                                     eventStreamAdapter,
@@ -1174,7 +1257,8 @@ export var BrainRunnerDO = /*#__PURE__*/ function(DurableObject) {
                                     scheduleAdapter,
                                     webhookAdapter,
                                     this.pageAdapter,
-                                    batchChunkAdapter
+                                    batchChunkAdapter,
+                                    timeoutAdapter
                                 ]).resume(brainToRun, {
                                     machine: machine,
                                     brainRunId: originalBrainRunId,

package/dist/src/monitor-do.js

@@ -259,6 +259,12 @@ export var MonitorDO = /*#__PURE__*/ function(DurableObject) {
         _this.storage = state.storage.sql;
         // Update table schema and indexes
         _this.storage.exec("\n      CREATE TABLE IF NOT EXISTS brain_runs (\n        run_id TEXT PRIMARY KEY,\n        brain_title TEXT NOT NULL,\n        brain_description TEXT,\n        type TEXT NOT NULL,\n        status TEXT NOT NULL,\n        options TEXT,\n        error TEXT,\n        created_at INTEGER NOT NULL,\n        started_at INTEGER,\n        completed_at INTEGER\n      );\n\n      CREATE TABLE IF NOT EXISTS brain_events (\n        id INTEGER PRIMARY KEY AUTOINCREMENT,\n        run_id TEXT NOT NULL,\n        event_type TEXT NOT NULL,\n        event_data TEXT NOT NULL,\n        created_at INTEGER NOT NULL\n      );\n\n      CREATE INDEX IF NOT EXISTS idx_brain_events_run\n      ON brain_events(run_id, id);\n\n      CREATE INDEX IF NOT EXISTS idx_brain_status -- Renamed index\n      ON brain_runs(brain_title, status);\n\n      CREATE INDEX IF NOT EXISTS idx_brain_time -- Renamed index\n      ON brain_runs(created_at DESC);\n\n      CREATE TABLE IF NOT EXISTS webhook_registrations (\n        id INTEGER PRIMARY KEY AUTOINCREMENT,\n        slug TEXT NOT NULL,\n        identifier TEXT NOT NULL,\n        brain_run_id TEXT NOT NULL,\n        created_at INTEGER NOT NULL\n      );\n\n      CREATE INDEX IF NOT EXISTS idx_webhook_lookup\n      ON webhook_registrations(slug, identifier);\n\n      CREATE INDEX IF NOT EXISTS idx_webhook_brain_run\n      ON webhook_registrations(brain_run_id);\n\n      CREATE TABLE IF NOT EXISTS page_registrations (\n        id INTEGER PRIMARY KEY AUTOINCREMENT,\n        slug TEXT NOT NULL UNIQUE,\n        brain_run_id TEXT NOT NULL,\n        persist INTEGER NOT NULL DEFAULT 0,\n        created_at INTEGER NOT NULL\n      );\n\n      CREATE INDEX IF NOT EXISTS idx_page_brain_run\n      ON page_registrations(brain_run_id);\n\n      CREATE INDEX IF NOT EXISTS idx_page_persist\n      ON page_registrations(persist);\n    ");
+        // Migration: add token column to webhook_registrations
+        try {
+            _this.storage.exec("ALTER TABLE webhook_registrations ADD COLUMN token TEXT");
+        } catch (e) {
+        // Column already exists
+        }
         return _this;
     }
     _create_class(MonitorDO, [
@@ -476,18 +482,24 @@ export var MonitorDO = /*#__PURE__*/ function(DurableObject) {
    * Register a webhook to wait for
    * Called when a brain emits a WEBHOOK event
    */ key: "registerWebhook",
-            value: function registerWebhook(slug, identifier, brainRunId) {
-                this.storage.exec("\n      INSERT INTO webhook_registrations (slug, identifier, brain_run_id, created_at)\n      VALUES (?, ?, ?, ?)\n    ", slug, identifier, brainRunId, Date.now());
+            value: function registerWebhook(slug, identifier, brainRunId, token) {
+                this.storage.exec("\n      INSERT INTO webhook_registrations (slug, identifier, brain_run_id, token, created_at)\n      VALUES (?, ?, ?, ?, ?)\n    ", slug, identifier, brainRunId, token !== null && token !== void 0 ? token : null, Date.now());
             }
         },
         {
             /**
    * Find a brain waiting for this webhook
-   * Returns the brain_run_id if found, null otherwise
+   * Returns the brain_run_id and token if found, null otherwise
    */ key: "findWaitingBrain",
             value: function findWaitingBrain(slug, identifier) {
-                var results = this.storage.exec("\n      SELECT brain_run_id as brainRunId\n      FROM webhook_registrations\n      WHERE slug = ? AND identifier = ?\n      LIMIT 1\n    ", slug, identifier).toArray();
-                return results.length > 0 ? results[0].brainRunId : null;
+                var results = this.storage.exec("\n      SELECT brain_run_id as brainRunId, token\n      FROM webhook_registrations\n      WHERE slug = ? AND identifier = ?\n      LIMIT 1\n    ", slug, identifier).toArray();
+                if (results.length === 0) return null;
+                var row = results[0];
+                var _row_token;
+                return {
+                    brainRunId: row.brainRunId,
+                    token: (_row_token = row.token) !== null && _row_token !== void 0 ? _row_token : null
+                };
             }
         },
         {

package/dist/src/timeout-adapter.js

@@ -0,0 +1,205 @@
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    if (staticProps) _defineProperties(Constructor, staticProps);
+    return Constructor;
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+import { BRAIN_EVENTS } from '@positronic/core';
+/**
+ * Adapter that handles WEBHOOK events with a timeout by storing the
+ * timeout and scheduling a DO alarm. When the alarm fires and the
+ * brain is still waiting, it queues a KILL signal to cancel the brain.
+ */ export var TimeoutAdapter = /*#__PURE__*/ function() {
+    "use strict";
+    function TimeoutAdapter(storeTimeout, setAlarm) {
+        _class_call_check(this, TimeoutAdapter);
+        _define_property(this, "storeTimeout", void 0);
+        _define_property(this, "setAlarm", void 0);
+        this.storeTimeout = storeTimeout;
+        this.setAlarm = setAlarm;
+    }
+    _create_class(TimeoutAdapter, [
+        {
+            key: "dispatch",
+            value: function dispatch(event) {
+                return _async_to_generator(function() {
+                    var timeout, timeoutAt;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                if (event.type !== BRAIN_EVENTS.WEBHOOK) {
+                                    return [
+                                        2
+                                    ];
+                                }
+                                timeout = event.timeout;
+                                if (timeout === undefined) {
+                                    return [
+                                        2
+                                    ];
+                                }
+                                timeoutAt = Date.now() + timeout;
+                                this.storeTimeout(event.brainRunId, timeoutAt);
+                                return [
+                                    4,
+                                    this.setAlarm(timeoutAt)
+                                ];
+                            case 1:
+                                _state.sent();
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return TimeoutAdapter;
+}();

package/dist/src/webhook-adapter.js

@@ -195,7 +195,7 @@ import { BRAIN_EVENTS } from '@positronic/core';
                                 registration = _step.value;
                                 return [
                                     4,
-                                    this.monitorStub.registerWebhook(registration.slug, registration.identifier, event.brainRunId)
+                                    this.monitorStub.registerWebhook(registration.slug, registration.identifier, event.brainRunId, registration.token)
                                 ];
                             case 3:
                                 _state.sent();

package/dist/types/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAU3C,QAAA,MAAM,GAAG;cAAwB,QAAQ;yCAAK,CAAC;AA4D/C,eAAe,GAAG,CAAC;AAGnB,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAU3C,QAAA,MAAM,GAAG;cAAwB,QAAQ;yCAAK,CAAC;AAiE/C,eAAe,GAAG,CAAC;AAGnB,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC"}

package/dist/types/api/webhooks/coordination.d.ts

@@ -18,7 +18,7 @@ export type WebhookHandlerResult = {
  * This is the signal-based approach: webhook response data flows through the signal queue
  * rather than being passed directly to the resume method.
  */
-export declare function queueWebhookAndWakeUp(context: Context, slug: string, identifier: string, response: Record<string, unknown>): Promise<{
+export declare function queueWebhookAndWakeUp(context: Context, slug: string, identifier: string, response: Record<string, unknown>, submittedToken?: string | null): Promise<{
     received: boolean;
     action: 'resumed' | 'not_found' | 'queued' | 'ignored';
     identifier: string;
@@ -26,11 +26,5 @@ export declare function queueWebhookAndWakeUp(context: Context, slug: string, id
     message?: string;
     reason?: string;
 }>;
-/**
- * Parse form data into a plain object, handling array fields.
- * Supports:
- * - name[] syntax for explicit arrays
- * - Multiple values with same key (converted to array)
- */
-export declare function parseFormData(formData: FormData): Record<string, unknown>;
+export { parseFormData } from '@positronic/core';
 //# sourceMappingURL=coordination.d.ts.map

package/dist/types/api/webhooks/coordination.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coordination.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/coordination.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEhF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;IACT,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CA6CD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBzE"}
+{"version":3,"file":"coordination.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/coordination.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEhF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC;IACT,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAoED;AAGD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/types/api/webhooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,QAAA,MAAM,QAAQ;cAAwB,QAAQ;yCAAK,CAAC;AAgEpD,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,QAAA,MAAM,QAAQ;cAAwB,QAAQ;yCAAK,CAAC;AAiFpD,eAAe,QAAQ,CAAC"}

package/dist/types/api/webhooks/system.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/system.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,QAAA,MAAM,MAAM;cAAwB,QAAQ;yCAAK,CAAC;AAqClD,eAAe,MAAM,CAAC"}
+{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../../../../src/api/webhooks/system.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,QAAA,MAAM,MAAM;cAAwB,QAAQ;yCAAK,CAAC;AAoDlD,eAAe,MAAM,CAAC"}

package/dist/types/brain-runner-do.d.ts

@@ -23,8 +23,16 @@ export declare class BrainRunnerDO extends DurableObject<Env> {
     private abortController;
     private pageAdapter;
     private signalsTableInitialized;
+    private waitTimeoutTableInitialized;
     constructor(state: DurableObjectState, env: Env);
     private initializeSignalsTable;
+    private initializeWaitTimeoutTable;
+    storeWaitTimeout(brainRunId: string, timeoutAt: number): void;
+    clearWaitTimeout(brainRunId: string): void;
+    getWaitTimeout(): {
+        brainRunId: string;
+        timeoutAt: number;
+    } | null;
     /**
      * Queue a signal for this brain run.
      * Returns the queued signal with timestamp.

package/dist/types/brain-runner-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"brain-runner-do.d.ts","sourceRoot":"","sources":["../../src/brain-runner-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAiG,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChK,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AASnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,wBAAgB,WAAW,CAAC,iBAAiB,EAAE,kBAAkB,QAEhE;AAED,wBAAgB,WAAW,IAAI,kBAAkB,GAAG,IAAI,CAEvD;AAGD,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,QAEjD;AAGD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAE/D;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAExD;AAED,MAAM,WAAW,GAAG;IAClB,eAAe,EAAE,sBAAsB,CAAC;IACxC,UAAU,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC9C,WAAW,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAChD,gBAAgB,EAAE,QAAQ,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA8FD,qBAAa,aAAc,SAAQ,aAAa,CAAC,GAAG,CAAC;IACnD,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,kBAAkB,CAA4B;IACtD,OAAO,CAAC,eAAe,CAAgC;IACvD,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,uBAAuB,CAAS;gBAE5B,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG;IAO/C,OAAO,CAAC,sBAAsB;IAO9B;;;;OAIG;IACG,WAAW,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB9I;;;;OAIG;IACH,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,WAAW,EAAE;YA+C5D,mBAAmB;IAqEjC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;;;OAQG;IACG,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA0E9F,KAAK;IAIL,KAAK,CACT,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAmHnC;;;;OAIG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM;IA0IzB,KAAK,CAAC,OAAO,EAAE,OAAO;CAkE7B"}
+{"version":3,"file":"brain-runner-do.d.ts","sourceRoot":"","sources":["../../src/brain-runner-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAiG,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChK,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAUnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,wBAAgB,WAAW,CAAC,iBAAiB,EAAE,kBAAkB,QAEhE;AAED,wBAAgB,WAAW,IAAI,kBAAkB,GAAG,IAAI,CAEvD;AAGD,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,QAEjD;AAGD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAE/D;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAExD;AAED,MAAM,WAAW,GAAG;IAClB,eAAe,EAAE,sBAAsB,CAAC;IACxC,UAAU,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC9C,WAAW,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAChD,gBAAgB,EAAE,QAAQ,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAsGD,qBAAa,aAAc,SAAQ,aAAa,CAAC,GAAG,CAAC;IACnD,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,kBAAkB,CAA4B;IACtD,OAAO,CAAC,eAAe,CAAgC;IACvD,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,2BAA2B,CAAS;gBAEhC,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG;IAO/C,OAAO,CAAC,sBAAsB;IAO9B,OAAO,CAAC,0BAA0B;IAOlC,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAStD,gBAAgB,CAAC,UAAU,EAAE,MAAM;IAQnC,cAAc,IAAI;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAWlE;;;;OAIG;IACG,WAAW,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB9I;;;;OAIG;IACH,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,WAAW,EAAE;YA+C5D,mBAAmB;IAqEjC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;;;OAQG;IACG,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA0E9F,KAAK;IASL,KAAK,CACT,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAyHnC;;;;OAIG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM;IAyJzB,KAAK,CAAC,OAAO,EAAE,OAAO;CAkE7B"}

package/dist/types/monitor-do.d.ts

@@ -22,12 +22,15 @@ export declare class MonitorDO extends DurableObject<Env> {
      * Register a webhook to wait for
      * Called when a brain emits a WEBHOOK event
      */
-    registerWebhook(slug: string, identifier: string, brainRunId: string): void;
+    registerWebhook(slug: string, identifier: string, brainRunId: string, token?: string): void;
     /**
      * Find a brain waiting for this webhook
-     * Returns the brain_run_id if found, null otherwise
+     * Returns the brain_run_id and token if found, null otherwise
      */
-    findWaitingBrain(slug: string, identifier: string): string | null;
+    findWaitingBrain(slug: string, identifier: string): {
+        brainRunId: string;
+        token: string | null;
+    } | null;
     /**
      * Clear all webhook registrations for a brain run
      * Called when brain completes, errors, or is cancelled

package/dist/types/monitor-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"monitor-do.d.ts","sourceRoot":"","sources":["../../src/monitor-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAQnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,GAAG;CAEnB;AAED,qBAAa,SAAU,SAAQ,aAAa,CAAC,GAAG,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,kBAAkB,CAA4B;IAEtD,OAAO,CAAC,QAAQ,CAAwC;gBAE5C,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG;IAkE/C,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;YAmHzB,sBAAsB;IA4B9B,KAAK,CAAC,OAAO,EAAE,OAAO;IAmE5B,YAAY,CAAC,UAAU,EAAE,MAAM;IAa/B;;;OAGG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM;IAqCzB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW;IA6B9C,UAAU,CAAC,UAAU,EAAE,MAAM;IA2B7B;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAapE;;;OAGG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiBjE;;;OAGG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM;IAU5C;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAgB/D;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM;IAU3B;;;OAGG;IACH,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAezD;;;OAGG;IACH,sBAAsB,CAAC,UAAU,EAAE,MAAM;CAU1C"}
+{"version":3,"file":"monitor-do.d.ts","sourceRoot":"","sources":["../../src/monitor-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAQnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,GAAG;CAEnB;AAED,qBAAa,SAAU,SAAQ,aAAa,CAAC,GAAG,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,kBAAkB,CAA4B;IAEtD,OAAO,CAAC,QAAQ,CAAwC;gBAE5C,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG;IAyE/C,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;YAmHzB,sBAAsB;IA4B9B,KAAK,CAAC,OAAO,EAAE,OAAO;IAmE5B,YAAY,CAAC,UAAU,EAAE,MAAM;IAa/B;;;OAGG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM;IAqCzB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW;IA6B9C,UAAU,CAAC,UAAU,EAAE,MAAM;IA2B7B;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;IAcpF;;;OAGG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAmBvG;;;OAGG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM;IAU5C;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAgB/D;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM;IAU3B;;;OAGG;IACH,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAezD;;;OAGG;IACH,sBAAsB,CAAC,UAAU,EAAE,MAAM;CAU1C"}

package/dist/types/timeout-adapter.d.ts

@@ -0,0 +1,13 @@
+import type { Adapter, BrainEvent } from '@positronic/core';
+/**
+ * Adapter that handles WEBHOOK events with a timeout by storing the
+ * timeout and scheduling a DO alarm. When the alarm fires and the
+ * brain is still waiting, it queues a KILL signal to cancel the brain.
+ */
+export declare class TimeoutAdapter implements Adapter {
+    private storeTimeout;
+    private setAlarm;
+    constructor(storeTimeout: (brainRunId: string, timeoutAt: number) => void, setAlarm: (time: number) => Promise<void>);
+    dispatch(event: BrainEvent): Promise<void>;
+}
+//# sourceMappingURL=timeout-adapter.d.ts.map

package/dist/types/timeout-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeout-adapter.d.ts","sourceRoot":"","sources":["../../src/timeout-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG5D;;;;GAIG;AACH,qBAAa,cAAe,YAAW,OAAO;IAE1C,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,QAAQ;gBADR,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,EAC7D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC;IAG7C,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAcjD"}

package/dist/types/webhook-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-adapter.d.ts","sourceRoot":"","sources":["../../src/webhook-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;GAGG;AACH,qBAAa,cAAe,YAAW,OAAO;IAChC,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE;QAAE,eAAe,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAA;KAAE;IAE5E,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAejD"}
+{"version":3,"file":"webhook-adapter.d.ts","sourceRoot":"","sources":["../../src/webhook-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;GAGG;AACH,qBAAa,cAAe,YAAW,OAAO;IAChC,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE;QAAE,eAAe,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAA;KAAE;IAE5E,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBjD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@positronic/cloudflare",
-  "version": "0.0.63",
+  "version": "0.0.65",
   "publishConfig": {
     "access": "public"
   },
@@ -31,9 +31,9 @@
     "clean": "rm -rf tsconfig.tsbuildinfo dist"
   },
   "dependencies": {
-    "@positronic/core": "^0.0.63",
-    "@positronic/spec": "^0.0.63",
-    "@positronic/template-new-project": "^0.0.63",
+    "@positronic/core": "^0.0.65",
+    "@positronic/spec": "^0.0.65",
+    "@positronic/template-new-project": "^0.0.65",
     "aws4fetch": "^1.0.18",
     "caz": "^2.0.0",
     "cron-schedule": "^5.0.4",