@relaycast/engine 8.6.0 → 8.7.0

package/dist/db/migrations/0045_workspace_create_idempotency.sql

@@ -1,7 +1,5 @@
--- relaycast#371/#379: bind delegated and anonymous bootstrap workspace
--- creation to a scoped, request-digested idempotency key. Owner scopes are
--- the hash of the authenticated owner key; bootstrap scopes are the hash of
--- `bootstrap:<idempotency-key>`. The child bearer key is derived at replay
+-- relaycast#371: bind delegated workspace creation to an owner-scoped,
+-- request-digested idempotency key. The child bearer key is derived at replay
 -- time and is never persisted in plaintext.
 CREATE TABLE workspace_create_idempotency (
   owner_scope_hash TEXT NOT NULL,

package/dist/engine/action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../src/engine/action.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAW,iBAAiB,EAAoE,MAAM,iBAAiB,CAAC;AAQ/H,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMrF,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAEnC,KAAK,aAAa,GAAG,OAAO,iBAAiB,CAAC,YAAY,CAAC;AAC3D,KAAK,sBAAsB,GAAG,IAAI,CAChC,aAAa,EACb,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,YAAY,GAAG,kBAAkB,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,kBAAkB,GAAG,yBAAyB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CACvN,CAAC;AAIF,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,SAAU,CAAC;AACzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,QAAsB,CAAC;AACjE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAIrD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,0DAA0D;IAC1D,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,4DAA4D;IAC5D,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,2EAA2E;IAC3E,cAAc,CAAC,EAAE,wBAAwB,CAAC;CAC3C;AAkOD,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,EACD,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,wBAAwB,CAAA;CAAO;;;;;;;;;;;;;;;GAoJ5D;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;;;;;;;;;;;;KAuBjF;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;;;;;;;;;;;;UA4B7F;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,wBAAwB,CAAA;CAAO,oBAyB5D;AAqPD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAsrBD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,cAAc,CAAC,EAAE,wBAAwB,CAAC;CACtC;;;;;;;;;GASP;AAwJD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5G,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,sBAAsB,CAAA;CAAO;;;;;;;;;GAU3D;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,sBAAsB,CAAA;CAAO;;;;;;;;;GAgE3D;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;yEACqE;IACrE,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACxB;;;;;;;;;GA+SP;AAgsBD;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAYlB;AAuUD,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CA6IjB;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,UAAU,EAAE,sBAAsB,EAClC,IAAI,GAAE;IAAE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAO,oBAyL5E;AAED,wBAAsB,gCAAgC,CACpD,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,mBAiCf;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE;IACJ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;;;;;;;;;;;;;;UA2DF;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE;IACJ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACD,IAAI,CAAC,EAAE,wBAAwB;;;;;;;;;;;;;;UAsGhC;AAiKD,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,IAAI,GAAE,+BAA+B,GAAG,MAAM,GAAG,IAAS,mBAiD3D;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;;;;;;;;;;;;;;UAcxG"}
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../src/engine/action.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAW,iBAAiB,EAAoE,MAAM,iBAAiB,CAAC;AAQ/H,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMrF,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAEnC,KAAK,aAAa,GAAG,OAAO,iBAAiB,CAAC,YAAY,CAAC;AAC3D,KAAK,sBAAsB,GAAG,IAAI,CAChC,aAAa,EACb,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,YAAY,GAAG,kBAAkB,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,kBAAkB,GAAG,yBAAyB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CACvN,CAAC;AAIF,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,SAAU,CAAC;AACzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,QAAsB,CAAC;AACjE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAIrD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,0DAA0D;IAC1D,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,4DAA4D;IAC5D,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,2EAA2E;IAC3E,cAAc,CAAC,EAAE,wBAAwB,CAAC;CAC3C;AAkOD,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,EACD,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,wBAAwB,CAAA;CAAO;;;;;;;;;;;;;;;GAoJ5D;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;;;;;;;;;;;;KAuBjF;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;;;;;;;;;;;;UA4B7F;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,wBAAwB,CAAA;CAAO,oBAyB5D;AAqPD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAsrBD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,cAAc,CAAC,EAAE,wBAAwB,CAAC;CACtC;;;;;;;;;GASP;AA6JD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5G,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,sBAAsB,CAAA;CAAO;;;;;;;;;GAU3D;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,sBAAsB,CAAA;CAAO;;;;;;;;;GAgE3D;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;yEACqE;IACrE,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACxB;;;;;;;;;GAkTP;AAgsBD;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAYlB;AAuUD,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CA6IjB;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,UAAU,EAAE,sBAAsB,EAClC,IAAI,GAAE;IAAE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAO,oBAyL5E;AAED,wBAAsB,gCAAgC,CACpD,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,mBAiCf;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE;IACJ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;;;;;;;;;;;;;;UA2DF;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE;IACJ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACD,IAAI,CAAC,EAAE,wBAAwB;;;;;;;;;;;;;;UAsGhC;AAiKD,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,IAAI,GAAE,+BAA+B,GAAG,MAAM,GAAG,IAAS,mBAiD3D;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;;;;;;;;;;;;;;UAcxG"}

package/dist/engine/action.js

@@ -1108,6 +1108,14 @@ async function dispatchSpawn(args) {
         throw error;
     }
     const nodeId = placement.node.id;
+    const shadow = args.bypassShadow ? null : await fetchNodeAction(args.db, args.workspaceId, nodeId, capability);
+    const capProvider = (await capacityProviderName(args.db, args.workspaceId, nodeId, capability)) ?? DEFAULT_PROVIDER_NAME;
+    if (input.verify_ready === true && (placement.queued || !await isNodeProviderLive(args.db, args.registry, args.workspaceId, nodeId, shadow?.handlerProvider ?? capProvider))) {
+        await failNeverDispatchedInvocation(args.db, args.workspaceId, invocation.id, 'spawn_target_unavailable');
+        if (!placement.queued)
+            await releaseNodeCapacity(args.db, args.workspaceId, nodeId);
+        throw codedError('Verified spawn target is not connected and ready to accept work; retry when it is available', 'spawn_target_unavailable', 503);
+    }
     // Placement and the durable idempotency claim are separate writes on D1.
     // Publish the selected response target immediately; a concurrent replay in
     // this narrow interval waits for this snapshot instead of returning null.
@@ -1120,7 +1128,6 @@ async function dispatchSpawn(args) {
     // Capacity-direct delegation (ctx.spawnAgent) bypasses the shadow so a handler
     // that delegates cannot re-enter itself.
     if (!args.bypassShadow) {
-        const shadow = await fetchNodeAction(args.db, args.workspaceId, nodeId, capability);
         if (shadow && shadow.handlerProvider) {
             const bound = await bindInvocationToRegisteredNodeAction(args.db, {
                 workspaceId: args.workspaceId,
@@ -1158,7 +1165,6 @@ async function dispatchSpawn(args) {
             // stale shadow snapshot must never receive an unbound invocation.
         }
     }
-    const capProvider = (await capacityProviderName(args.db, args.workspaceId, nodeId, capability)) ?? DEFAULT_PROVIDER_NAME;
     const dispatched = await dispatchNodeInvocation({
         db: args.db,
         registry: args.registry,
@@ -1275,7 +1281,17 @@ export async function invokeAction(db, workspaceId, actionName, data, options =
             return markInvocationReplay(invocationAck(replay, { actionName }));
         }
     }
-    if (!action && actionName === 'spawn') {
+    // Check availableTo access control — deny if caller is absent OR not in the list
+    if (action?.availableTo && action.availableTo.length > 0) {
+        if (!data.caller_name || !action.availableTo.includes(data.caller_name)) {
+            const who = data.caller_name ? `Agent "${data.caller_name}"` : 'Caller';
+            throw codedError(`${who} is not authorized to invoke action "${actionName}"`, 'action_denied', 403);
+        }
+    }
+    // Legacy workspace-global broker aliases must not swallow an explicit
+    // target_node. Capacity placement validates that target and its live provider.
+    // Keep the alias ACL above this branch; explicit targeting is not an ACL bypass.
+    if (actionName === 'spawn' && (!action || (action.handlerNodeId && typeof data.input?.target_node === 'string' && data.input.target_node.trim().length > 0))) {
         return dispatchSpawn({
             db,
             registry: options.nodeConnections,
@@ -1297,13 +1313,6 @@ export async function invokeAction(db, workspaceId, actionName, data, options =
     if (!action) {
         throw codedError(`Action "${actionName}" not found`, 'action_not_found', 404);
     }
-    // Check availableTo access control — deny if caller is absent OR not in the list
-    if (action.availableTo && action.availableTo.length > 0) {
-        if (!data.caller_name || !action.availableTo.includes(data.caller_name)) {
-            const who = data.caller_name ? `Agent "${data.caller_name}"` : 'Caller';
-            throw codedError(`${who} is not authorized to invoke action "${actionName}"`, 'action_denied', 403);
-        }
-    }
     if (action.handlerNodeId) {
         if (!options.nodeConnections) {
             throw codedError('Node dispatch is not available', 'node_dispatch_unavailable', 503);