okengine 0.21.1 → 0.22.0

package/src/elements/vault/audit.ts

@@ -9,8 +9,10 @@
 
 import { VaultError } from "./errors.ts";
 import type { VaultErrorCode } from "./errors.ts";
-import type { VaultActorType } from "./types.ts";
-import type { VaultAuditSinkKind } from "./types.ts";
+import type { VaultActorType, VaultAuditConfig, VaultAuditSinkKind } from "./types.ts";
+
+/** Bound on a webhook audit POST so a dead receiver cannot stall a write. */
+const AUDIT_WEBHOOK_TIMEOUT_MS = 5_000;
 
 /** Operations recorded in the audit chain. */
 export type AuditAction =
@@ -110,8 +112,10 @@ export interface AuditWriter {
 export interface CreateAuditSinkOptions {
   /** Required for the `db` sink. */
   readonly writer?: AuditWriter;
-  /** Required for the `webhook` sink (not yet implemented). */
+  /** Required for the `webhook` sink. Absolute `http:` or `https:` URL. */
   readonly webhookUrl?: string;
+  /** Fetch implementation for the `webhook` sink (tests). */
+  readonly fetch?: typeof globalThis.fetch;
   /** Line writer for the `stdout` sink (tests). */
   readonly write?: (line: string) => void;
   /** Clock for `stdout` timestamps (tests). */
@@ -169,23 +173,98 @@ export async function computeAuditRowHash(
   return Buffer.from(new Uint8Array(digest)).toString("hex");
 }
 
+/**
+ * Reject a webhook URL that is missing or not an absolute http(s) URL.
+ *
+ * @param webhookUrl - Configured destination
+ * @returns Absolute URL string
+ * @throws VaultError `MISSING_PEER` when the URL is absent or not http(s)
+ */
+function requireWebhookUrl(webhookUrl: string | undefined): string {
+  const raw = webhookUrl?.trim() ?? "";
+  if (raw.length === 0) {
+    throw new VaultError("MISSING_PEER", "vault: webhook audit sink requires webhookUrl");
+  }
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new VaultError(
+      "MISSING_PEER",
+      "vault: webhook audit sink requires an absolute http(s) webhookUrl",
+    );
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new VaultError(
+      "MISSING_PEER",
+      "vault: webhook audit sink requires an absolute http(s) webhookUrl",
+    );
+  }
+  return parsed.href;
+}
+
+/**
+ * JSON body shared by the `stdout` and `webhook` sinks.
+ *
+ * Only normalized metadata is serialized — an entry never holds a value.
+ *
+ * @param entry - Operation to record
+ * @param now - Clock when the entry has no `at`
+ */
+function auditEventJson(entry: AuditEntry, now: () => Date): string {
+  return JSON.stringify({
+    sink: "oke.vault.audit",
+    ...toAuditHashPayload(entry, entry.at ?? now()),
+  });
+}
+
 /**
  * Build an audit sink.
  *
  * - `db` delegates to an {@link AuditWriter} supplied by storage.
  * - `stdout` writes one secret-free JSON line per operation.
- * - `webhook` is not implemented yet and throws `UNSUPPORTED`.
+ * - `webhook` POSTs that same JSON. Delivery failure throws; callers that
+ *   record after a successful operation swallow it.
+ *
+ * Hash-chain verify and purge apply only to the `db` sink.
  *
  * @param kind - Sink kind from `audit.sink`
  * @param opts - Writer / webhook URL / test seams
- * @throws VaultError `UNSUPPORTED` for `webhook`, or `MISSING_PEER` when `db` has no writer
+ * @throws VaultError `MISSING_PEER` when `db` has no writer or `webhook` has no absolute URL
  */
 export function createAuditSink(
   kind: VaultAuditSinkKind,
   opts: CreateAuditSinkOptions = {},
 ): AuditSink {
   if (kind === "webhook") {
-    throw new VaultError("UNSUPPORTED", "vault: webhook audit sink is not implemented");
+    const url = requireWebhookUrl(opts.webhookUrl);
+    const fetchFn = opts.fetch ?? globalThis.fetch;
+    const now = opts.now ?? (() => new Date());
+    return {
+      kind: "webhook",
+      async append(entry) {
+        const body = auditEventJson(entry, now);
+        let response: Response;
+        try {
+          response = await fetchFn(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body,
+            redirect: "error",
+            signal: AbortSignal.timeout(AUDIT_WEBHOOK_TIMEOUT_MS),
+          });
+        } catch (err) {
+          if (err instanceof VaultError) throw err;
+          throw new VaultError("BACKEND_ERROR", "vault: webhook audit sink request failed");
+        }
+        if (!response.ok) {
+          throw new VaultError(
+            "BACKEND_ERROR",
+            `vault: webhook audit sink failed (${response.status})`,
+          );
+        }
+      },
+    };
   }
 
   if (kind === "db") {
@@ -206,17 +285,31 @@ export function createAuditSink(
   return {
     kind: "stdout",
     async append(entry) {
-      // Only normalized metadata is serialized — an entry never holds a value.
-      write(
-        JSON.stringify({
-          sink: "oke.vault.audit",
-          ...toAuditHashPayload(entry, entry.at ?? now()),
-        }),
-      );
+      write(auditEventJson(entry, now));
     },
   };
 }
 
+/**
+ * Pick the sink for a built-in adapter from `vault.audit`.
+ *
+ * `enabled: false` drops every row. Omitted config is the `db` chain.
+ *
+ * @param config - `vault.audit` block, when present
+ * @param opts - SQL writer and optional fetch
+ */
+export function auditSinkForConfig(
+  config: VaultAuditConfig | undefined,
+  opts: { readonly writer: AuditWriter; readonly fetch?: typeof globalThis.fetch },
+): AuditSink {
+  if (config?.enabled === false) return createNullAuditSink();
+  return createAuditSink(config?.sink ?? "db", {
+    writer: opts.writer,
+    ...(config?.webhookUrl === undefined ? {} : { webhookUrl: config.webhookUrl }),
+    ...(opts.fetch === undefined ? {} : { fetch: opts.fetch }),
+  });
+}
+
 /**
  * Sink that drops every entry (`audit.enabled: false`).
  *

package/src/elements/vault/boot-chain.ts

@@ -22,6 +22,7 @@ import {
 import { parseDotenv } from "../../drivers/vault-dotenv-parse.ts";
 import type { VaultDriverId } from "../../drivers/vault-types.ts";
 import { resolveComposeEnvPath } from "./chain.ts";
+import type { VaultAuditConfig } from "./types.ts";
 import type { VaultChainLayer } from "./runtime.ts";
 
 /** Options for {@link buildVaultBootChain}. */
@@ -34,6 +35,10 @@ export interface BuildVaultBootChainOptions {
   readonly env?: ConfigEnv;
   /** Seed secrets for the terminal memory / managed layer. */
   readonly seed?: Readonly<Record<string, string>>;
+  /**
+   * Built-in store audit block. Forwarded only to the `vault` driver layer.
+   */
+  readonly audit?: VaultAuditConfig;
 }
 
 /**
@@ -142,7 +147,10 @@ export function buildVaultBootChain(options: BuildVaultBootChainOptions): VaultC
         {
           driver: builtinVaultDriver,
           source: "driver",
-          options: { secrets: seed },
+          options: {
+            secrets: seed,
+            ...(options.audit === undefined ? {} : { audit: options.audit }),
+          },
         },
         ...envLayers,
       ];

package/src/elements/vault/builtin-adapter.ts

@@ -20,7 +20,7 @@
  * cleartext value ever reaches the log, an error message, or a `VaultError`.
  */
 
-import { createAuditSink, type AuditAction, type AuditSink } from "./audit.ts";
+import { auditSinkForConfig, type AuditAction, type AuditSink } from "./audit.ts";
 import {
   ALGORITHM,
   buildAad,
@@ -66,6 +66,7 @@ import type {
   VaultActor,
   VaultAdapter,
   VaultAlgorithm,
+  VaultAuditConfig,
   VaultGetOptions,
   VaultInitResult,
   VaultListEntry,
@@ -96,8 +97,15 @@ export interface CreateBuiltinVaultOptions {
    * {@link VaultAdapter.unseal} is not required.
    */
   readonly unsealer?: Unsealer;
-  /** Audit destination. Defaults to a `db` sink over `oke_vault_audit`. */
+  /** Audit destination. Wins over {@link audit} when both are set. */
   readonly auditSink?: AuditSink;
+  /**
+   * `vault.audit` from config. Omitted means the `db` hash chain.
+   * Ignored when {@link auditSink} is set.
+   */
+  readonly audit?: VaultAuditConfig;
+  /** Fetch override for the `webhook` audit sink (tests). */
+  readonly fetch?: typeof globalThis.fetch;
   /** DEKs re-wrapped per rotation batch. Defaults to {@link DEFAULT_KEK_REWRAP_BATCH_SIZE}. */
   readonly kekRewrapBatchSize?: number;
   /**
@@ -306,7 +314,25 @@ export function createBuiltinVaultAdapter(opts: CreateBuiltinVaultOptions): Buil
   const db = createResilientSqlExec(rawDb);
   const batchSize = Math.max(1, opts.kekRewrapBatchSize ?? DEFAULT_KEK_REWRAP_BATCH_SIZE);
   const rotateLeaseMs = Math.max(50, opts.rotateLeaseMs ?? DEFAULT_ROTATE_LEASE_MS);
-  const audit = opts.auditSink ?? createAuditSink("db", { writer: createSqlAuditWriter(rawDb) });
+  const audit =
+    opts.auditSink ??
+    auditSinkForConfig(opts.audit, {
+      writer: createSqlAuditWriter(rawDb),
+      ...(opts.fetch === undefined ? {} : { fetch: opts.fetch }),
+    });
+
+  /**
+   * Hash-chain commands only exist for the `db` sink.
+   *
+   * @param op - Command name for the error
+   */
+  function requireDbAudit(op: string): void {
+    if (audit.kind === "db") return;
+    throw new VaultError(
+      "UNSUPPORTED",
+      `vault: ${op} requires audit.sink "db" (got "${audit.kind}")`,
+    );
+  }
 
   let unsealer: Unsealer | null = opts.unsealer ?? null;
   let pending: PendingRotation | null = null;
@@ -1018,6 +1044,7 @@ export function createBuiltinVaultAdapter(opts: CreateBuiltinVaultOptions): Buil
     },
 
     async purgeAuditBefore(before: Date): Promise<number> {
+      requireDbAudit("audit purge");
       await ensureReady();
       const removed = await purgeAuditRows(db, before);
       await record("purge", undefined);
@@ -1043,16 +1070,19 @@ export function createBuiltinVaultAdapter(opts: CreateBuiltinVaultOptions): Buil
     },
 
     async verifyAudit(): Promise<AuditChainResult> {
+      requireDbAudit("audit verify");
       await ensureReady();
       return verifyAuditChain(db);
     },
 
     async listAudit(options?: AuditPageOptions): Promise<readonly VaultAuditRecord[]> {
+      requireDbAudit("audit list");
       await ensureReady();
       return readAuditPage(db, options ?? {});
     },
 
     async readAuditRow(id: string): Promise<VaultAuditRecord | null> {
+      requireDbAudit("audit read");
       await ensureReady();
       return readAuditRow(db, id);
     },

package/src/i18n/catalogs/ar.ts

@@ -86,6 +86,10 @@ export const builtinAr = {
     "DatabaseError.retryable": "قاعدة البيانات مشغولة. حاول بعد قليل.",
     ServiceUnavailable: "الخدمة غير متاحة مؤقتاً.",
     InternalError: "حدث خطأ. حاول مرة أخرى.",
+    IdempotencyKeyMissing: "هذا الاستدعاء يتطلب ترويسة Idempotency-Key.",
+    IdempotencyKeyInvalid: "يجب أن يكون Idempotency-Key من 16 إلى 255 حرفًا ASCII قابلًا للطباعة.",
+    IdempotencyKeyReused: "استُخدم Idempotency-Key هذا من قبل مع طلب مختلف.",
+    IdempotencyInProgress: "ما زال Idempotency-Key هذا قيد التنفيذ. أعد المحاولة بعد المهلة.",
     InvalidQuery: "الاستعلام غير صالح.",
     UnsupportedMediaType: "نوع المحتوى هذا غير مدعوم.",
     AuthFailed: "فشلت المصادقة.",

package/src/i18n/catalogs/en.ts

@@ -86,6 +86,10 @@ export const builtinEn = {
     "DatabaseError.retryable": "The database is busy. Try again shortly.",
     ServiceUnavailable: "The service is temporarily unavailable.",
     InternalError: "Something went wrong. Try again.",
+    IdempotencyKeyMissing: "This call requires an Idempotency-Key header.",
+    IdempotencyKeyInvalid: "Idempotency-Key must be 16–255 printable ASCII characters.",
+    IdempotencyKeyReused: "This Idempotency-Key was already used with a different request.",
+    IdempotencyInProgress: "This Idempotency-Key is still running. Retry after the given delay.",
     InvalidQuery: "The query is not valid.",
     UnsupportedMediaType: "That content type is not supported.",
     AuthFailed: "Authentication failed.",

package/src/kernel/abort-scope.ts

@@ -2,8 +2,8 @@
  * Ambient AbortSignal scope for structured concurrency.
  *
  * Same ALS pattern as dry-run: `fx.all` / `fx.race` enter a child signal so
- * cooperative branches (and future driver plumbing) can observe cancellation
- * without every call site passing a signal argument.
+ * cooperative branches and outbound HTTP can observe cancellation without
+ * every call site passing a signal argument.
  */
 
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -34,6 +34,21 @@ export async function withAbortSignal<T>(
   return storage.run(signal, fn);
 }
 
+/** Never-aborted signal for work that must outlive the caller connection. */
+const DETACHED: AbortSignal = new AbortController().signal;
+
+/**
+ * Run `fn` without the request abort signal.
+ *
+ * A claimed idempotent `do` keeps running when the client times out. The
+ * lease, not the socket, is what detects a crash.
+ *
+ * @param fn - Work to detach
+ */
+export function runDetached<T>(fn: () => T | Promise<T>): Promise<T> {
+  return withAbortSignal(DETACHED, fn);
+}
+
 /**
  * When `parent` aborts, abort `child` with the same reason.
  *
@@ -88,6 +103,22 @@ export function abortError(reason?: unknown): Error {
   return err;
 }
 
+/**
+ * Signal for one outbound request: the ambient scope, the caller's signal, or both.
+ *
+ * Read at request time, not at driver `open`, so an `fx.race` / `fx.all` abort
+ * reaches HTTP that is already in flight.
+ *
+ * @param explicit - Caller-supplied signal, when the API already accepts one
+ */
+export function requestSignal(explicit?: AbortSignal | null): AbortSignal {
+  const ambient = currentAbortSignal();
+  if (explicit == null || explicit === ambient) return ambient;
+  if (ambient.aborted) return ambient;
+  if (explicit.aborted) return explicit;
+  return AbortSignal.any([ambient, explicit]);
+}
+
 /**
  * Sleep that rejects promptly when `signal` aborts.
  *

package/src/kernel/app.ts

@@ -43,7 +43,7 @@ import { parseAcceptLanguage } from "../elements/channel/locale.ts";
 import { runWithLocale } from "../i18n/locale-context.ts";
 import { isFlow, type AnyFlowDef } from "./flow.ts";
 import { failureFromUnknown, runCompensationPhase } from "./compensate.ts";
-import { withAbortSignal } from "./abort-scope.ts";
+import { runDetached, withAbortSignal } from "./abort-scope.ts";
 import { withCdcMutationId } from "../elements/store/sql-session.ts";
 import { MUTATION_ID_HEADER } from "./mutation-id.ts";
 import { fxRetry } from "./concurrency.ts";
@@ -83,6 +83,7 @@ import {
 } from "./hooks.ts";
 import {
   createJournal,
+  createJournalSlot,
   createMemoryJournalStore,
   hasJournalLease,
   isJournalLeaseBusy,
@@ -91,6 +92,7 @@ import {
   type JournalSession,
   type JournalStore,
 } from "./journal.ts";
+import type { IdempotencyAttempt } from "./idempotency.ts";
 import { releaseInstanceLeases } from "./graceful-shutdown.ts";
 import { mintInstanceId } from "./instance-id.ts";
 import type { JournalRuntime } from "./boot-bind/journal.ts";
@@ -181,6 +183,11 @@ function loadFx(): {
   return lazyRequire(import.meta.dir, ["fx", "runtime"].join("-"));
 }
 
+/** Idempotency policy — off the edge graph until a request actually claims. */
+function loadIdempotency(): typeof import("./idempotency.ts") {
+  return lazyRequire(import.meta.dir, ["idem", "potency"].join(""));
+}
+
 /** App-shell tenancy wiring — loaded only when `gate.auth.tenant` is on. */
 function loadAppTenant(): { w: (kind: number, ...args: unknown[]) => unknown } {
   return lazyRequire(import.meta.dir, ["app", "tenant"].join("-"));
@@ -1837,23 +1844,61 @@ export function oke(options: OkeOptions): OkeApp {
       );
 
       capability = booted.capabilities.get(flowDef.name);
-
-      if (flowDef.durable) {
-        const { store, instanceId, leaseMs } = activeJournal();
-        const journal = createJournal({
-          store,
-          now,
-          id: () => runId,
-          // Hold the run lease for the request's lifetime — a crash mid-run
-          // leaves an expired lease another instance can reclaim and resume.
-          ...(hasJournalLease(store) ? { lease: { instanceId, leaseMs } } : {}),
-        });
-        journalSession = await journal.start(flowDef.name, input);
-        inflightRuns.add(journalSession.runId);
-      }
     }
 
     const effects = flowDef.effects ?? capability?.declared;
+    const requestForIdem = extras?.request;
+    const rawIdemHeader = requestForIdem?.headers.get("idempotency-key") ?? null;
+    const idemRequired =
+      flowDef.idempotency === "required" ||
+      (typeof flowDef.idempotency === "object" && flowDef.idempotency.required === true) ||
+      flowDef.resolvedIdempotency?.mode === "required";
+    let idemAttempt: IdempotencyAttempt | undefined;
+    if (requestForIdem && (rawIdemHeader !== null || idemRequired)) {
+      const method = trigger.kind === "http" ? trigger.method : requestForIdem.method;
+      const live =
+        flowDef.live !== undefined || (trigger.kind === "http" && trigger.liveSignal !== undefined);
+      idemAttempt = loadIdempotency().prepareIdempotencyAttempt({
+        hasRequest: true,
+        method,
+        stream: flowDef.stream === true,
+        live,
+        effects,
+        usesRaw: flowDef.usesRaw === true,
+        option: flowDef.idempotency,
+        resolved: flowDef.resolvedIdempotency,
+        header: rawIdemHeader,
+      });
+    }
+    const claiming = idemAttempt?.claiming === true;
+
+    const openJournal = (): ReturnType<typeof createJournal> => {
+      const { store, instanceId, leaseMs } = activeJournal();
+      return createJournal({
+        store,
+        now,
+        id: () => runId,
+        // Hold the run lease for the request's lifetime — a crash mid-run
+        // leaves an expired lease another instance can reclaim and resume.
+        ...(hasJournalLease(store) ? { lease: { instanceId, leaseMs } } : {}),
+      });
+    };
+
+    // A claim starts the journal only after it wins, so a replay or a 409
+    // does not open a run. Auto with no header keeps the start here.
+    if (booted && flowDef.durable && !claiming) {
+      journalSession = await openJournal().start(flowDef.name, input);
+      inflightRuns.add(journalSession.runId);
+    }
+
+    let journalSlot: { session?: JournalSession } | undefined;
+    let journalFacade: JournalSession | undefined;
+    if (booted && flowDef.durable && claiming) {
+      const created = createJournalSlot();
+      journalSlot = created.slot;
+      journalFacade = created.facade;
+    }
+    const journalForFx = journalSession ?? journalFacade;
     const { fx, ledger } = loadFx().createFxContext({
       ...options.fx,
       flow: flowDef.name,
@@ -1906,7 +1951,7 @@ export function oke(options: OkeOptions): OkeApp {
           }
         : {}),
       runsRuntime: booted?.runs ?? (isRunsRuntimeLike(options.runs) ? options.runs : undefined),
-      ...(journalSession ? { journal: journalSession, durable: true } : {}),
+      ...(journalForFx ? { journal: journalForFx, durable: true } : {}),
       callHandler: async (name, callInput) => {
         const target = flowsByName.get(name);
         if (!target) {
@@ -2038,13 +2083,141 @@ export function oke(options: OkeOptions): OkeApp {
             }
             return output;
           };
+          const runClaimed = async (validated: unknown): Promise<unknown> => {
+            if (!claiming || idemAttempt === undefined) return invoke(validated);
+            const policy = loadIdempotency();
+            const classified = policy.classifyIdempotencyKey(rawIdemHeader);
+            if (classified === "missing") {
+              return policy.idempotencyErrorResponse("IdempotencyKeyMissing");
+            }
+            if (classified === "invalid") {
+              return policy.idempotencyErrorResponse("IdempotencyKeyInvalid");
+            }
+            const idemStore = activeJournal().store.idempotency;
+            if (!idemStore) return invoke(validated);
+            const scope = {
+              tenant: fx.tenant.id ?? "",
+              principal: policy.idempotencyPrincipal(fx.auth),
+              flow: flowDef.name,
+              key: classified,
+            };
+            const claimToken = crypto.randomUUID();
+            const leaseMs = activeJournal().leaseMs;
+            const claimed = await idemStore.claim({
+              scope,
+              fingerprint: policy.idempotencyFingerprint(flowDef.name, validated),
+              claimToken,
+              now: now(),
+              leaseMs,
+              ttlMs: idemAttempt.ttlMs,
+            });
+            if (claimed.kind === "mismatch") {
+              return policy.idempotencyErrorResponse("IdempotencyKeyReused");
+            }
+            if (claimed.kind === "in_progress") {
+              return policy.idempotencyErrorResponse(
+                "IdempotencyInProgress",
+                claimed.retryAfterSeconds,
+              );
+            }
+            if (claimed.kind === "replay") return policy.replayResponse(claimed.row);
+
+            if (booted && flowDef.durable) {
+              const journal = openJournal();
+              const resumeId = claimed.kind === "reclaimed" ? claimed.row.runId : undefined;
+              try {
+                const session = resumeId
+                  ? await journal.resume(resumeId)
+                  : await journal.start(flowDef.name, validated);
+                if (journalSlot) journalSlot.session = session;
+                journalSession = session;
+                inflightRuns.add(session.runId);
+                const tenantId = principals?.tenant.id ?? fx.tenant.id;
+                if (tenantId) await session.stampTenant(tenantId);
+                await idemStore.attachRun(scope, claimToken, session.runId);
+              } catch (err) {
+                if (isJournalLeaseBusy(err)) {
+                  await idemStore.forfeit(scope, claimToken);
+                  return policy.idempotencyErrorResponse("IdempotencyInProgress", 1);
+                }
+                await idemStore.remove(scope, claimToken);
+                throw err;
+              }
+            }
+
+            const timer = setInterval(
+              () => {
+                void idemStore.renew(scope, claimToken, now() + leaseMs);
+              },
+              Math.max(5, Math.floor(leaseMs / 3)),
+            );
+            if (typeof timer === "object" && timer !== null && "unref" in timer) timer.unref();
+
+            const storeEncoded = async (encoded: {
+              readonly status: number;
+              readonly headers: { get(name: string): string | null };
+              text(): Promise<string>;
+            }): Promise<void> => {
+              const stored = await policy.storedFromResponse(encoded);
+              if (!stored) {
+                await idemStore.remove(scope, claimToken);
+                return;
+              }
+              await idemStore.complete(scope, claimToken, stored, journalSession?.runId);
+            };
+            try {
+              const output = await runDetached(() => invoke(validated));
+              if (loadFx().isJsonStreamResult(output)) {
+                await idemStore.remove(scope, claimToken);
+                return output;
+              }
+              if (output instanceof Response) {
+                const contentType = output.headers.get("content-type") ?? "";
+                const buffered =
+                  output.status === 204 ||
+                  contentType.includes("json") ||
+                  contentType.startsWith("text/");
+                if (!buffered || contentType.includes("text/event-stream")) {
+                  await idemStore.remove(scope, claimToken);
+                  return output;
+                }
+                await storeEncoded(output.clone());
+                return output;
+              }
+              await storeEncoded(
+                await encodeExecuteResult({
+                  output: isFlowFailure(output) ? undefined : output,
+                  failure: isFlowFailure(output) ? output : undefined,
+                }),
+              );
+              return output;
+            } catch (err) {
+              if (flowDef.durable && isJournalSuspend(err)) {
+                await idemStore.complete(
+                  scope,
+                  claimToken,
+                  { status: 204, body: "" },
+                  journalSession?.runId,
+                );
+                throw err;
+              }
+              if (policy.attemptedMutation(ledger.entries) || idemAttempt.usesRaw) {
+                await storeEncoded(encodeFailure(fail("InternalError", {})));
+              } else {
+                await idemStore.remove(scope, claimToken);
+              }
+              throw err;
+            } finally {
+              clearInterval(timer);
+            }
+          };
           if (!alreadyValidated) {
             const parsed = await validate(flowDef.in, ctx.input);
             if (!parsed.ok) return parsed.failure;
             ctx.input = parsed.value;
-            return await invoke(parsed.value);
+            return await runClaimed(parsed.value);
           }
-          return await invoke(ctx.input);
+          return await runClaimed(ctx.input);
         } catch (err) {
           if (isFlowFailure(err)) return err;
           // A durable sleep that has not yet elapsed suspends the run — this

package/src/kernel/auto-cache.test.ts

@@ -58,7 +58,7 @@ describe("automatic tier-1 cache from effects", () => {
       stores: [db],
       gate: { policies: [gate.public] },
     }).adopt({ list });
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
     const notesApi = requireNotesApi(t);
 
     const first = await notesApi.list({});
@@ -90,7 +90,7 @@ describe("automatic tier-1 cache from effects", () => {
       stores: [db],
       gate: { policies: [gate.public] },
     }).adopt({ list });
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
     const trigger = list.triggers[0];
     if (trigger === undefined) throw new Error("notes.list has no trigger");
 
@@ -128,7 +128,7 @@ describe("automatic tier-1 cache from effects", () => {
       stores: [db],
       gate: { policies: [gate.public] },
     }).adopt({ list });
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
     const notesApi = requireNotesApi(t);
     await notesApi.list({});
     await notesApi.list({});
@@ -158,7 +158,7 @@ describe("automatic tier-1 cache from effects", () => {
       stores: [db],
       gate: { policies: [gate.public] },
     }).adopt({ list });
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
     const notesApi = requireNotesApi(t);
 
     await notesApi.list({});
@@ -209,7 +209,7 @@ describe("automatic tier-1 cache from effects", () => {
       stores: [db],
       gate: { policies: [gate.public] },
     }).adopt({ list, create });
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
     const notesApi = requireNotesApi(t);
 
     await notesApi.list({});
@@ -251,7 +251,7 @@ describe("automatic tier-1 cache from effects", () => {
       stores: [db],
       gate: { policies: [gate.public] },
     }).adopt({ list, create });
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
     const notesApi = requireNotesApi(t);
 
     await notesApi.list({});