@wardby/cli 0.1.0

package/dist/core/scheduler.js

@@ -0,0 +1,121 @@
+/**
+ * The scheduler: a lease loop (only one process ticks at a time) and a tick
+ * loop (the holder claims due agents and hands them to the `Executor`).
+ * At-most-once firing is enforced by `claimDueRun`'s row lock + the
+ * `lastScheduledAt` advance happening in the same transaction as the `Run`
+ * create — never by the lease alone (the lease only prevents concurrent
+ * *ticking*, not a race within a single tick against a future one).
+ */
+import { randomUUID } from "node:crypto";
+import { dueWindow } from "./cron.js";
+import { dispatchRun } from "./dispatch.js";
+import { tryAcquireLease } from "./lease.js";
+import { prisma as defaultDb } from "./db.js";
+import { LEASE_RENEW_INTERVAL_MS, LEASE_TTL_MS, TICK_INTERVAL_MS } from "./timing.js";
+import { logger } from "./logger.js";
+const schedulerLog = logger.child({ module: "scheduler" });
+/**
+ * Per spec: "Executor throws synchronously on start → the run is marked
+ * failed with the error." A guarded `updateMany` (only `pending`/`running`)
+ * rather than an unconditional `update`, so this can never clobber a run
+ * that already reached a terminal state through some other path.
+ */
+export { markRunFailedFromExecutorError } from "./dispatch.js";
+/** Cheap, lock-free pass: which enabled+scheduled agents look due right now. */
+export async function findDueCandidates(db, now) {
+    const candidates = await db.agent.findMany({
+        where: { scheduleEnabled: true, schedule: { not: null } },
+    });
+    return candidates.filter((agent) => dueWindow({
+        schedule: agent.schedule,
+        timezone: agent.timezone,
+        lastScheduledAt: agent.lastScheduledAt,
+        now,
+    }) !== null);
+}
+/**
+ * Re-checks due-ness under `FOR UPDATE SKIP LOCKED` and, if still due,
+ * advances `lastScheduledAt` and creates the `Run` in the same transaction.
+ * Returns the new run's id, or null if the agent wasn't (or is no longer)
+ * due, or another tick already holds its row lock.
+ */
+export async function claimDueRun(db, executor, agentId, now) {
+    const dispatched = await dispatchRun({
+        db,
+        executor,
+        agentId,
+        trigger: "scheduled",
+        now,
+        lockAgent: true,
+        beforePersist: async (tx, agent) => {
+            if (!agent.scheduleEnabled || !agent.schedule)
+                return false;
+            const window = dueWindow({
+                schedule: agent.schedule,
+                timezone: agent.timezone,
+                lastScheduledAt: agent.lastScheduledAt,
+                now,
+            });
+            if (!window)
+                return false;
+            await tx.agent.update({ where: { id: agentId }, data: { lastScheduledAt: window } });
+            return true;
+        },
+    });
+    return dispatched?.run.id ?? null;
+}
+export function startScheduler(options) {
+    const db = options.db ?? defaultDb;
+    const scope = options.scope ?? "default";
+    const instanceId = options.instanceId ?? randomUUID();
+    const now = options.now ?? (() => new Date());
+    const log = options.onLog ?? ((message) => schedulerLog.info(message));
+    let leader = false;
+    async function leaseTick() {
+        const acquired = await tryAcquireLease(db, scope, instanceId, LEASE_TTL_MS);
+        if (acquired && !leader) {
+            log(`acquired leadership for scope "${scope}" as ${instanceId}`);
+        }
+        else if (!acquired && leader) {
+            log(`lost leadership for scope "${scope}"`);
+        }
+        leader = acquired;
+    }
+    async function tick() {
+        if (!leader) {
+            return;
+        }
+        const due = await findDueCandidates(db, now());
+        for (const agent of due) {
+            try {
+                const runId = await claimDueRun(db, options.executor, agent.id, now());
+                if (runId) {
+                    log(`firing agent "${agent.name}" -> run ${runId}`);
+                }
+            }
+            catch (err) {
+                schedulerLog.error({ err, agentName: agent.name }, "error claiming a due run");
+            }
+        }
+        if (options.onLeaderTick) {
+            await options.onLeaderTick().catch((err) => schedulerLog.error({ err }, "leader tick hook failed"));
+        }
+    }
+    const leaseTimer = setInterval(() => {
+        leaseTick().catch((err) => schedulerLog.error({ err }, "lease error"));
+    }, LEASE_RENEW_INTERVAL_MS);
+    const tickTimer = setInterval(() => {
+        tick().catch((err) => schedulerLog.error({ err }, "tick error"));
+    }, TICK_INTERVAL_MS);
+    // Acquire immediately rather than waiting a full renew interval to start.
+    leaseTick().catch((err) => schedulerLog.error({ err }, "lease error"));
+    return {
+        stop() {
+            clearInterval(leaseTimer);
+            clearInterval(tickTimer);
+        },
+        isLeader() {
+            return leader;
+        },
+    };
+}

package/dist/core/secrets.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Secrets: encrypted-at-rest values, attached to an agent by name, readable
+ * only inside the sandbox at point-of-use (never by any read/list tool).
+ * `Secret.name` is unique per owner (`@@unique([ownerId, name])`), so two
+ * owners can each have their own "API_KEY" without collision — attach/get
+ * always resolve a name within one owner's (or, at get-time, one agent's)
+ * scope, never globally.
+ */
+import type { PrismaClient, Secret } from "@prisma/client";
+import type { SecretCipher } from "../providers/secrets/types.js";
+export type SecretMetadata = Pick<Secret, "id" | "name" | "keyId" | "ownerId" | "createdAt" | "updatedAt">;
+export interface SecretsAccessor {
+    get(name: string): Promise<string | undefined>;
+}
+/**
+ * Encrypts and stores a secret value. Upserts on (ownerId, name) — calling
+ * this again for a name the owner already has rotates its value in place
+ * (same id) rather than failing on the unique constraint. The plaintext is
+ * never logged or returned.
+ */
+export declare function createSecret(name: string, value: string, ownerId: string, cipher: SecretCipher, db: PrismaClient): Promise<Secret>;
+/** Names/metadata only — never a value or ciphertext. */
+export declare function listSecrets(ownerId: string, db: PrismaClient): Promise<SecretMetadata[]>;
+/** Attaches one of the owner's own secrets (by canonical name) to an agent,
+ *  under `boundName` — the point-of-use name the agent's tools resolve
+ *  (`secrets.get(boundName)`). Defaults to the secret's own name. */
+export declare function attachSecret(agentId: string, name: string, ownerId: string, db: PrismaClient, boundName?: string): Promise<void>;
+/** Detaches by point-of-use name — the pair (agentId, boundName) uniquely
+ *  identifies the edge; agent ownership is enforced by the caller. */
+export declare function detachSecret(agentId: string, boundName: string, db: PrismaClient): Promise<void>;
+export declare function deleteSecret(secretId: string, db: PrismaClient): Promise<void>;
+/**
+ * Decrypt-on-demand: only the ONE secret actually requested by name is
+ * decrypted, never the agent's whole attached set eagerly — a lookup
+ * that returns nothing (unattached name) is indistinguishable from one
+ * that was never created, both `undefined`.
+ */
+export declare function buildSecretsAccessor(agentId: string, cipher: SecretCipher, db: Pick<PrismaClient, "agentSecret"> & Partial<Pick<PrismaClient, "$queryRaw">>): SecretsAccessor;
+/**
+ * Wraps a `SecretsAccessor` so `get()` only ever resolves a name the caller
+ * has declared this specific tool attachment may read — every other name
+ * behaves exactly like one that was never attached (`undefined`), never a
+ * throw, matching the existing "unattached name" convention. The underlying
+ * accessor is never even called for a disallowed name.
+ */
+export declare function scopeSecretsAccessor(accessor: SecretsAccessor, allowedNames: readonly string[]): SecretsAccessor;

package/dist/core/secrets.js

@@ -0,0 +1,100 @@
+import { boundedString } from "../sandbox/bounded-json.js";
+/**
+ * Encrypts and stores a secret value. Upserts on (ownerId, name) — calling
+ * this again for a name the owner already has rotates its value in place
+ * (same id) rather than failing on the unique constraint. The plaintext is
+ * never logged or returned.
+ */
+export async function createSecret(name, value, ownerId, cipher, db) {
+    boundedString(name, 1024);
+    boundedString(value, 65_536);
+    const ciphertext = await cipher.encrypt(value);
+    const keyId = cipher.keyId();
+    return db.secret.upsert({
+        where: { ownerId_name: { ownerId, name } },
+        create: { name, ciphertext, keyId, ownerId },
+        update: { ciphertext, keyId },
+    });
+}
+/** Names/metadata only — never a value or ciphertext. */
+export async function listSecrets(ownerId, db) {
+    const secrets = await db.secret.findMany({ where: { ownerId } });
+    return secrets.map(({ id, name, keyId, ownerId: owner, createdAt, updatedAt }) => ({
+        id,
+        name,
+        keyId,
+        ownerId: owner,
+        createdAt,
+        updatedAt,
+    }));
+}
+async function findOwnedSecretByName(db, ownerId, name) {
+    return db.secret.findUnique({ where: { ownerId_name: { ownerId, name } } });
+}
+/** Attaches one of the owner's own secrets (by canonical name) to an agent,
+ *  under `boundName` — the point-of-use name the agent's tools resolve
+ *  (`secrets.get(boundName)`). Defaults to the secret's own name. */
+export async function attachSecret(agentId, name, ownerId, db, boundName = name) {
+    const secret = await findOwnedSecretByName(db, ownerId, name);
+    if (!secret)
+        throw new Error(`No secret named "${name}" owned by this caller.`);
+    await db.agentSecret.create({ data: { agentId, secretId: secret.id, boundName } });
+}
+/** Detaches by point-of-use name — the pair (agentId, boundName) uniquely
+ *  identifies the edge; agent ownership is enforced by the caller. */
+export async function detachSecret(agentId, boundName, db) {
+    await db.agentSecret.deleteMany({ where: { agentId, boundName } });
+}
+export async function deleteSecret(secretId, db) {
+    await db.secret.delete({ where: { id: secretId } });
+}
+/**
+ * Decrypt-on-demand: only the ONE secret actually requested by name is
+ * decrypted, never the agent's whole attached set eagerly — a lookup
+ * that returns nothing (unattached name) is indistinguishable from one
+ * that was never created, both `undefined`.
+ */
+export function buildSecretsAccessor(agentId, cipher, db) {
+    return {
+        async get(name) {
+            boundedString(name, 1024);
+            if (db.$queryRaw) {
+                const rows = await db.$queryRaw `
+          SELECT CASE WHEN octet_length(s."ciphertext") <= 262144 THEN s."ciphertext" ELSE NULL END AS "ciphertext"
+          FROM "Secret" s JOIN "AgentSecret" a ON a."secretId" = s."id"
+          WHERE a."agentId" = ${agentId} AND a."boundName" = ${name} LIMIT 1`;
+                if (!rows.length)
+                    return undefined;
+                if (rows[0].ciphertext === null)
+                    throw new Error("secret_value_limit");
+                return cipher.decrypt(rows[0].ciphertext);
+            }
+            // Lightweight provider doubles use the same post-read bound; production Prisma filters in SQL.
+            const attachment = await db.agentSecret.findFirst({
+                where: { agentId, boundName: name },
+                include: { secret: true },
+            });
+            if (!attachment)
+                return undefined;
+            boundedString(attachment.secret.ciphertext, 256 * 1024);
+            return cipher.decrypt(attachment.secret.ciphertext);
+        },
+    };
+}
+/**
+ * Wraps a `SecretsAccessor` so `get()` only ever resolves a name the caller
+ * has declared this specific tool attachment may read — every other name
+ * behaves exactly like one that was never attached (`undefined`), never a
+ * throw, matching the existing "unattached name" convention. The underlying
+ * accessor is never even called for a disallowed name.
+ */
+export function scopeSecretsAccessor(accessor, allowedNames) {
+    const allowed = new Set(allowedNames);
+    return {
+        async get(name) {
+            if (!allowed.has(name))
+                return undefined;
+            return accessor.get(name);
+        },
+    };
+}

package/dist/core/subagent-memory-tools.d.ts

@@ -0,0 +1,18 @@
+import type { PrismaClient } from "@prisma/client";
+import type { LoadedTool } from "../providers/engine/types.js";
+import type { AgentMemoryStore } from "../providers/memory/types.js";
+export declare const SUBAGENT_MEMORY_TOOL_NAMES: ReadonlySet<string>;
+export declare const SUBAGENT_MEMORY_GET_TOOL: LoadedTool;
+export declare const PARENT_MEMORY_GET_TOOL: LoadedTool;
+type SubAgentMemoryDb = Pick<PrismaClient, "agentSubAgent" | "run">;
+/** `subagent_memory_get` — callable by a parent, gated by the AgentSubAgent edge itself. */
+export declare function handleSubAgentMemoryGet(argsJson: string, callingAgentId: string, db: SubAgentMemoryDb, memory: AgentMemoryStore): Promise<string>;
+/**
+ * `parent_memory_get` — callable by a dispatched child, gated by this exact
+ * run's ephemeral grant. `currentRunId` is the run making the call, not the
+ * parent — its own `parentRunId`/`grantedParentMemoryKeys` are looked up
+ * fresh rather than threaded through the caller, so this stays correct even
+ * if called from deep inside a multi-turn engine loop.
+ */
+export declare function handleParentMemoryGet(argsJson: string, currentRunId: string, db: SubAgentMemoryDb, memory: AgentMemoryStore): Promise<string>;
+export {};

package/dist/core/subagent-memory-tools.js

@@ -0,0 +1,121 @@
+/**
+ * Cross-agent memory reads for sub-agent dispatch. Two deliberately
+ * asymmetric built-ins, recognized by name and never
+ * sandboxed, the same treatment memory-tools.ts gives the own-memory
+ * built-ins:
+ *
+ * - subagent_memory_get: a parent can always read a declared child's
+ *   memory. The AgentSubAgent edge itself is the grant -- no reference
+ *   needed each time.
+ * - parent_memory_get: a child can read a specific key of its dispatching
+ *   parent's memory ONLY when that exact run was handed a grant for that
+ *   key at dispatch time (Run.grantedParentMemoryKeys) -- never a standing
+ *   allowlist, never the parent's memory in general.
+ *
+ * Both fail closed: a missing edge or an ungranted key is an error result,
+ * never a silent empty read (same discipline as scopeDatastore's shared
+ * methods).
+ */
+import { z } from "zod";
+export const SUBAGENT_MEMORY_TOOL_NAMES = new Set(["subagent_memory_get", "parent_memory_get"]);
+export const SUBAGENT_MEMORY_GET_TOOL = {
+    name: "subagent_memory_get",
+    description: "Reads one persistent memory entry belonging to one of your declared sub-agents (by its bound name). Returns null if the key doesn't exist.",
+    jsonSchema: {
+        type: "object",
+        properties: { boundName: { type: "string" }, key: { type: "string" } },
+        required: ["boundName", "key"],
+        additionalProperties: false,
+    },
+};
+export const PARENT_MEMORY_GET_TOOL = {
+    name: "parent_memory_get",
+    description: "Reads one memory entry from the agent that dispatched you, but only for a key it explicitly granted you access to for this run. Returns an error for any other key.",
+    jsonSchema: {
+        type: "object",
+        properties: { key: { type: "string" } },
+        required: ["key"],
+        additionalProperties: false,
+    },
+};
+const SubAgentGetArgs = z.object({ boundName: z.string(), key: z.string() }).strict();
+const ParentGetArgs = z.object({ key: z.string() }).strict();
+function zodErrorResult(err) {
+    return JSON.stringify({
+        error: "validation_failed",
+        message: err.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`).join("; "),
+    });
+}
+/** `subagent_memory_get` — callable by a parent, gated by the AgentSubAgent edge itself. */
+export async function handleSubAgentMemoryGet(argsJson, callingAgentId, db, memory) {
+    let parsed;
+    try {
+        parsed = JSON.parse(argsJson || "{}");
+    }
+    catch (err) {
+        return JSON.stringify({
+            error: "invalid_arguments_json",
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+    let args;
+    try {
+        args = SubAgentGetArgs.parse(parsed);
+    }
+    catch (err) {
+        return zodErrorResult(err);
+    }
+    const edge = await db.agentSubAgent.findUnique({
+        where: { parentAgentId_boundName: { parentAgentId: callingAgentId, boundName: args.boundName } },
+    });
+    if (!edge) {
+        return JSON.stringify({
+            error: "no_such_subagent",
+            message: `No sub-agent is bound to name "${args.boundName}".`,
+        });
+    }
+    const content = await memory.get(edge.childAgentId, args.key);
+    return JSON.stringify({ content: content ?? null });
+}
+/**
+ * `parent_memory_get` — callable by a dispatched child, gated by this exact
+ * run's ephemeral grant. `currentRunId` is the run making the call, not the
+ * parent — its own `parentRunId`/`grantedParentMemoryKeys` are looked up
+ * fresh rather than threaded through the caller, so this stays correct even
+ * if called from deep inside a multi-turn engine loop.
+ */
+export async function handleParentMemoryGet(argsJson, currentRunId, db, memory) {
+    let parsed;
+    try {
+        parsed = JSON.parse(argsJson || "{}");
+    }
+    catch (err) {
+        return JSON.stringify({
+            error: "invalid_arguments_json",
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+    let args;
+    try {
+        args = ParentGetArgs.parse(parsed);
+    }
+    catch (err) {
+        return zodErrorResult(err);
+    }
+    const run = await db.run.findUniqueOrThrow({
+        where: { id: currentRunId },
+        select: { parentRunId: true, grantedParentMemoryKeys: true },
+    });
+    if (!run.parentRunId) {
+        return JSON.stringify({ error: "no_parent_run", message: "This run was not dispatched by a parent." });
+    }
+    if (!run.grantedParentMemoryKeys.includes(args.key)) {
+        return JSON.stringify({
+            error: "key_not_granted",
+            message: `Key "${args.key}" was not granted to this run by its parent.`,
+        });
+    }
+    const parentRun = await db.run.findUniqueOrThrow({ where: { id: run.parentRunId }, select: { agentId: true } });
+    const content = await memory.get(parentRun.agentId, args.key);
+    return JSON.stringify({ content: content ?? null });
+}

package/dist/core/timing.d.ts

@@ -0,0 +1,7 @@
+/** Scheduler/executor/reconciler timing constants — one module, tunable. */
+export declare const TICK_INTERVAL_MS = 10000;
+export declare const LEASE_TTL_MS = 30000;
+export declare const LEASE_RENEW_INTERVAL_MS = 10000;
+export declare const HEARTBEAT_INTERVAL_MS = 10000;
+export declare const HEARTBEAT_TIMEOUT_MS = 45000;
+export declare const RECONCILE_INTERVAL_MS = 15000;

package/dist/core/timing.js

@@ -0,0 +1,7 @@
+/** Scheduler/executor/reconciler timing constants — one module, tunable. */
+export const TICK_INTERVAL_MS = 10_000;
+export const LEASE_TTL_MS = 30_000;
+export const LEASE_RENEW_INTERVAL_MS = 10_000;
+export const HEARTBEAT_INTERVAL_MS = 10_000;
+export const HEARTBEAT_TIMEOUT_MS = 45_000;
+export const RECONCILE_INTERVAL_MS = 15_000;

package/dist/core/webhooks.d.ts

@@ -0,0 +1,23 @@
+import type { PrismaClient, Webhook } from "@prisma/client";
+import type { Executor } from "../providers/executor/types.js";
+export type WebhookMetadata = Pick<Webhook, "id" | "agentId" | "status" | "ownerId" | "createdAt" | "lastFiredAt">;
+/** Creates a webhook and returns the raw secret ONCE — only its hash is ever stored. */
+export declare function createWebhook(agentId: string, ownerId: string, db: PrismaClient): Promise<{
+    id: string;
+    secret: string;
+}>;
+export declare function listWebhooks(ownerId: string, db: PrismaClient): Promise<WebhookMetadata[]>;
+export declare function deleteWebhook(id: string, db: PrismaClient): Promise<void>;
+export type ResolveWebhookRunResult = {
+    ok: true;
+    runId: string;
+} | {
+    ok: false;
+    reason: "not_found" | "invalid_secret" | "disabled";
+};
+/**
+ * Validates the presented secret and, if valid + enabled, enqueues a run via
+ * the exact same `createRun` path `trigger_agent`/the scheduler use — the
+ * budget guardrail applies identically regardless of what triggered the run.
+ */
+export declare function resolveWebhookRun(id: string, presentedSecret: string, db: PrismaClient, executor: Executor, codingTask?: string): Promise<ResolveWebhookRunResult>;

package/dist/core/webhooks.js

@@ -0,0 +1,113 @@
+/**
+ * Webhooks: an inbound trigger for an agent, authenticated by a per-webhook
+ * secret (not OAuth — see ingress.ts). The secret is high-entropy
+ * (32 random bytes), so a plain SHA-256 hash is sufficient — unlike a
+ * user-chosen password, there's no low-entropy guessing surface a pepper/
+ * HMAC key would meaningfully defend against; this mirrors how GitHub/
+ * Stripe-style API tokens are stored (hash of a random token, no extra key).
+ * Comparison is constant-time (`timingSafeEqual` over the raw digest, which
+ * is always 32 bytes, so there's no length-mismatch case to special-case).
+ */
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { dispatchRun } from "./dispatch.js";
+function hashSecret(secret) {
+    return createHash("sha256").update(secret).digest("hex");
+}
+/**
+ * Whether a webhook is allowed to hand this agent per-run task text.
+ * Coding agents keep the existing explicit opt-in (allowWebhookTaskOverride)
+ * since the text can drive real repository changes. A native agent has no
+ * per-run input at all otherwise (its systemPrompt is fixed) and the
+ * resulting run is sandboxed, so accepting task text needs no separate
+ * opt-in — always allowed once the caller already holds the webhook secret.
+ */
+function taskAllowed(kind, codingProfile) {
+    if (kind === "native")
+        return true;
+    return kind === "coding" && (codingProfile?.allowWebhookTaskOverride ?? false);
+}
+function secretMatches(presented, storedHash) {
+    const presentedHash = Buffer.from(hashSecret(presented), "hex");
+    const stored = Buffer.from(storedHash, "hex");
+    if (presentedHash.length !== stored.length)
+        return false;
+    return timingSafeEqual(presentedHash, stored);
+}
+/** Creates a webhook and returns the raw secret ONCE — only its hash is ever stored. */
+export async function createWebhook(agentId, ownerId, db) {
+    const secret = randomBytes(32).toString("base64url");
+    const webhook = await db.webhook.create({ data: { agentId, ownerId, secretHash: hashSecret(secret) } });
+    return { id: webhook.id, secret };
+}
+export async function listWebhooks(ownerId, db) {
+    const webhooks = await db.webhook.findMany({ where: { ownerId } });
+    return webhooks.map(({ id, agentId, status, ownerId: owner, createdAt, lastFiredAt }) => ({
+        id,
+        agentId,
+        status,
+        ownerId: owner,
+        createdAt,
+        lastFiredAt,
+    }));
+}
+export async function deleteWebhook(id, db) {
+    await db.webhook.delete({ where: { id } });
+}
+/**
+ * Validates the presented secret and, if valid + enabled, enqueues a run via
+ * the exact same `createRun` path `trigger_agent`/the scheduler use — the
+ * budget guardrail applies identically regardless of what triggered the run.
+ */
+export async function resolveWebhookRun(id, presentedSecret, db, executor, codingTask) {
+    const webhook = await db.webhook.findUnique({ where: { id } });
+    if (!webhook)
+        return { ok: false, reason: "not_found" };
+    if (!secretMatches(presentedSecret, webhook.secretHash))
+        return { ok: false, reason: "invalid_secret" };
+    if (webhook.status !== "enabled")
+        return { ok: false, reason: "disabled" };
+    const agent = await db.agent.findUnique({ where: { id: webhook.agentId }, include: { codingProfile: true } });
+    if (!agent)
+        return { ok: false, reason: "not_found" };
+    if (codingTask !== undefined && !taskAllowed(agent.kind, agent.codingProfile)) {
+        return { ok: false, reason: "disabled" };
+    }
+    let rejected = "disabled";
+    const dispatched = await dispatchRun({
+        db,
+        executor,
+        agentId: agent.id,
+        trigger: "webhook",
+        // Coding agents keep the existing per-agent opt-in (allowWebhookTaskOverride);
+        // a native agent's system prompt has no per-run input at all otherwise, so
+        // accepting task text over an authenticated webhook call needs no separate
+        // opt-in — it's a much lower-risk capability than a coding agent being told
+        // to modify a real repository.
+        codingTask: agent.kind === "coding" ? codingTask : undefined,
+        taskOverride: agent.kind === "native" ? codingTask : undefined,
+        beforePersist: async (tx, currentAgent) => {
+            const current = await tx.webhook.findUnique({ where: { id } });
+            if (!current) {
+                rejected = "not_found";
+                return false;
+            }
+            if (!secretMatches(presentedSecret, current.secretHash)) {
+                rejected = "invalid_secret";
+                return false;
+            }
+            if (current.status !== "enabled") {
+                rejected = "disabled";
+                return false;
+            }
+            if (codingTask !== undefined && !taskAllowed(currentAgent.kind, currentAgent.codingProfile)) {
+                rejected = "disabled";
+                return false;
+            }
+            await tx.webhook.update({ where: { id }, data: { lastFiredAt: new Date() } });
+            return true;
+        },
+    });
+    if (!dispatched)
+        return { ok: false, reason: rejected };
+    return { ok: true, runId: dispatched.run.id };
+}

package/dist/env.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Single runtime load point for environment configuration. dotenv-flow uses
+ * its standard environment cascade; Vitest has a separate explicit cascade in
+ * vitest.setup.ts because dotenv-flow normally omits .env.local in test mode.
+ * Imported for its side effect only, before any module reads process.env.
+ *
+ * It is also where the process's HTTP runtime is installed (see
+ * core/http-runtime.ts): same contract — it has to happen before any other
+ * module does anything — and every entry point already imports this file first.
+ */
+import "./core/http-runtime.js";

package/dist/env.js

@@ -0,0 +1,13 @@
+/**
+ * Single runtime load point for environment configuration. dotenv-flow uses
+ * its standard environment cascade; Vitest has a separate explicit cascade in
+ * vitest.setup.ts because dotenv-flow normally omits .env.local in test mode.
+ * Imported for its side effect only, before any module reads process.env.
+ *
+ * It is also where the process's HTTP runtime is installed (see
+ * core/http-runtime.ts): same contract — it has to happen before any other
+ * module does anything — and every entry point already imports this file first.
+ */
+import "./core/http-runtime.js";
+import dotenvFlow from "dotenv-flow";
+dotenvFlow.config();

package/dist/import/budgets.d.ts

@@ -0,0 +1,16 @@
+import type { NeutralBudget } from "./neutral-schema.js";
+export interface BudgetGroupData {
+    name: string;
+    dailyBudgetUsd: string | null;
+    weeklyBudgetUsd: string | null;
+    monthlyBudgetUsd: string | null;
+    warnThresholdRatio: string;
+}
+export declare function mapBudget(b: NeutralBudget): {
+    ok: true;
+    group: BudgetGroupData;
+    agentNames: string[];
+} | {
+    ok: false;
+    reason: string;
+};

package/dist/import/budgets.js

@@ -0,0 +1,21 @@
+function warnRatio(alert, block) {
+    const a = Number(alert), b = Number(block);
+    if (!Number.isFinite(a) || !Number.isFinite(b) || b <= 0)
+        return "0.8";
+    const r = a / b;
+    if (!Number.isFinite(r) || r <= 0)
+        return "0.8";
+    return Math.min(r, 1).toFixed(2);
+}
+export function mapBudget(b) {
+    if (!b.enabled)
+        return { ok: false, reason: "disabled" };
+    const group = {
+        name: b.name,
+        dailyBudgetUsd: b.period === "daily" ? b.blockThreshold : null,
+        weeklyBudgetUsd: b.period === "weekly" ? b.blockThreshold : null,
+        monthlyBudgetUsd: b.period === "monthly" ? b.blockThreshold : null,
+        warnThresholdRatio: warnRatio(b.alertThreshold, b.blockThreshold),
+    };
+    return { ok: true, group, agentNames: b.attachedAgentNames };
+}

package/dist/import/bundle.d.ts

@@ -0,0 +1,16 @@
+import { type Manifest, type NeutralAgent, type NeutralTool, type NeutralAgentTool, type NeutralSecret, type NeutralAgentSecret, type NeutralSingleDatastore, type NeutralSharedDatastore, type NeutralWebhook, type NeutralBudget } from "./neutral-schema.js";
+export declare class BundleError extends Error {
+}
+export interface Bundle {
+    manifest: Manifest;
+    readAgents(): NeutralAgent[];
+    readTools(): NeutralTool[];
+    readAgentTools(): NeutralAgentTool[];
+    readSecrets(): NeutralSecret[];
+    readAgentSecrets(): NeutralAgentSecret[];
+    readSingleDatastores(): NeutralSingleDatastore[];
+    readSharedDatastores(): NeutralSharedDatastore[];
+    readWebhooks(): NeutralWebhook[];
+    readBudgets(): NeutralBudget[];
+}
+export declare function openBundle(dir: string): Bundle;