@agentproto/workspace 0.1.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 agentproto contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,23 @@
+# @agentproto/workspace
+
+AIP-34 `WORKSPACE.md` reference implementation. A markdown + frontmatter format for declaring a workspace's identity — globally addressable id, owner, storage choice, defaults, publish posture. The root manifest of every AIP-organized workspace; pairs with STORAGE.md (AIP-35) for the storage policy block.
+
+> **Status: 0.1.0-alpha.** Generated by `scripts/scaffold-aip.mjs` — `build()` and `validate()` bodies are TODOs.
+
+Spec: <https://agentproto.sh/docs/aip-34>
+
+## Usage
+
+```ts
+import { defineWorkspace } from "@agentproto/workspace"
+
+const x = defineWorkspace({
+  id: "my-workspace",
+  description: "Short purpose.",
+  // ...
+})
+```
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/chunk-O7MX54WR.mjs

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import { createDoctype } from '@agentproto/define-doctype';
+
+/**
+ * @agentproto/workspace v0.1.0-alpha
+ * AIP-34 WORKSPACE.md `defineWorkspace` reference implementation.
+ */
+
+var workspaceFrontmatterSchema = z.object({ "schema": z.literal("workspace/v1"), "id": z.string().regex(new RegExp("^@[a-z0-9][a-z0-9-]*/[a-z0-9][a-z0-9-]*$")).describe("Globally addressable id `@<owner-slug>/<workspace-slug>`. Lowercase kebab-case, immutable across the workspace's lifetime."), "version": z.string().regex(new RegExp("^\\d+\\.\\d+\\.\\d+(?:[-+][\\w.\\-]+)?$")).describe("Spec version of THIS file. Bump on breaking shape change."), "name": z.string().min(1).max(80).describe("Human-readable display name."), "description": z.string().max(2e3).describe("One-paragraph purpose.").optional(), "owner": z.object({ "type": z.enum(["guild", "user", "org"]), "id": z.string().min(1), "slug": z.string().regex(new RegExp("^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$")).min(1).describe("Owner-side slug. MUST match the slug suffix of the workspace `id`.") }).strict(), "storage": z.any().describe("AIP-35 STORAGE block. Required. Inline / ref / file."), "sandbox": z.any().describe("AIP-36 SANDBOX block. Optional \u2014 when absent, command-execution tools MUST be unavailable.").optional(), "code": z.any().describe("AIP-26 CODE block. Optional \u2014 when present, the workspace IS a code-workspace / repo (codespace pattern).").optional(), "identity": z.any().describe("AIP-23 identity-ref \u2014 default identity for sub-blocks. Sub-blocks (storage, sandbox, code) may override.").optional(), "defaults": z.object({ "read_only": z.boolean().optional() }).catchall(z.any()).optional(), "publish": z.object({ "template": z.boolean().default(false), "registry": z.string().optional(), "visibility": z.enum(["private", "unlisted", "public"]).default("private") }).strict().optional(), "tags": z.array(z.string()).default([]), "created_at": z.string().datetime({ offset: true }).optional(), "metadata": z.record(z.string(), z.any()).optional() }).strict().describe("Validates the YAML frontmatter portion of an AIP-34 WORKSPACE.md manifest. Composes the AIP-35 STORAGE block (required), AIP-36 SANDBOX block (optional), AIP-26 CODE block (optional), AIP-23 identity-ref block (optional).");
+var defineWorkspace = createDoctype({
+  aip: 34,
+  name: "workspace",
+  readDescription: (def) => def.name,
+  validate(def) {
+    const result = workspaceFrontmatterSchema.safeParse(def);
+    if (!result.success) {
+      throw new Error(
+        `defineWorkspace (AIP-34): ${result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`
+      );
+    }
+  },
+  build(def) {
+    return { ...def };
+  }
+});
+
+export { defineWorkspace, workspaceFrontmatterSchema };
+//# sourceMappingURL=chunk-O7MX54WR.mjs.map
+//# sourceMappingURL=chunk-O7MX54WR.mjs.map

package/dist/chunk-O7MX54WR.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schema.ts","../src/define-workspace.ts"],"names":[],"mappings":";;;;;;;;AAeO,IAAM,0BAAA,GAA6B,CAAA,CAAE,MAAA,CAAO,EAAE,QAAA,EAAU,EAAE,OAAA,CAAQ,cAAc,CAAA,EAAG,IAAA,EAAM,CAAA,CAAE,MAAA,GAAS,KAAA,CAAM,IAAI,MAAA,CAAO,0CAA0C,CAAC,CAAA,CAAE,QAAA,CAAS,4HAA4H,CAAA,EAAG,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,CAAM,IAAI,MAAA,CAAO,yCAAyC,CAAC,CAAA,CAAE,QAAA,CAAS,2DAA2D,GAAG,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,GAAA,CAAI,EAAE,CAAA,CAAE,QAAA,CAAS,8BAA8B,CAAA,EAAG,aAAA,EAAe,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAI,CAAA,CAAE,QAAA,CAAS,wBAAwB,CAAA,CAAE,QAAA,EAAS,EAAG,OAAA,EAAS,CAAA,CAAE,MAAA,CAAO,EAAE,MAAA,EAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAQ,MAAA,EAAO,KAAK,CAAC,CAAA,EAAG,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,EAAG,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,CAAM,IAAI,MAAA,CAAO,yCAAyC,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,EAAE,QAAA,CAAS,oEAAoE,CAAA,EAAG,CAAA,CAAE,MAAA,IAAU,SAAA,EAAW,CAAA,CAAE,GAAA,EAAI,CAAE,QAAA,CAAS,sDAAsD,CAAA,EAAG,SAAA,EAAW,CAAA,CAAE,GAAA,EAAI,CAAE,QAAA,CAAS,iGAA4F,CAAA,CAAE,UAAS,EAAG,MAAA,EAAQ,CAAA,CAAE,GAAA,EAAI,CAAE,QAAA,CAAS,gHAA2G,CAAA,CAAE,QAAA,EAAS,EAAG,UAAA,EAAY,CAAA,CAAE,GAAA,GAAM,QAAA,CAAS,+GAA0G,CAAA,CAAE,QAAA,EAAS,EAAG,UAAA,EAAY,CAAA,CAAE,MAAA,CAAO,EAAE,WAAA,EAAa,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,IAAY,CAAA,CAAE,QAAA,CAAS,CAAA,CAAE,GAAA,EAAK,EAAE,QAAA,EAAS,EAAG,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,EAAE,YAAY,CAAA,CAAE,OAAA,EAAQ,CAAE,OAAA,CAAQ,KAAK,CAAA,EAAG,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS,EAAG,YAAA,EAAc,CAAA,CAAE,KAAK,CAAC,SAAA,EAAU,UAAA,EAAW,QAAQ,CAAC,CAAA,CAAE,QAAQ,SAAS,CAAA,EAAG,CAAA,CAAE,MAAA,EAAO,CAAE,UAAS,EAAG,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,EAAW,CAAA,EAAG,YAAA,EAAc,CAAA,CAAE,QAAO,CAAE,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,EAAE,QAAA,EAAS,EAAG,UAAA,EAAY,CAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAO,EAAG,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,QAAA,EAAS,EAAG,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,CAAS,+NAA+N;ACMtiE,IAAM,kBAAkB,aAAA,CAAoD;AAAA,EACjF,GAAA,EAAK,EAAA;AAAA,EACL,IAAA,EAAM,WAAA;AAAA,EACN,eAAA,EAAiB,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAA;AAAA,EAC9B,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAA,GAAS,0BAAA,CAA2B,SAAA,CAAU,GAAG,CAAA;AACvD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,0BAAA,EAA6B,OAAO,KAAA,CAAM,MAAA,CACvC,IAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,KAAK,CAAA,CAAE,OAAO,EAAE,CAAA,CAC9C,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OACf;AAAA,IACF;AAAA,EAIF,CAAA;AAAA,EACA,MAAM,GAAA,EAAK;AAKT,IAAA,OAAO,EAAE,GAAG,GAAA,EAAI;AAAA,EAClB;AACF,CAAC","file":"chunk-O7MX54WR.mjs","sourcesContent":["/**\n * AIP-34 WORKSPACE.md frontmatter zod schema.\n *\n * Generated from `resources/aip-34/draft/WORKSPACE.schema.json` via\n * json-schema-to-zod. Imported by both `define-workspace.ts` (TS path\n * validation) and `manifest/index.ts` (.md path validation) so every\n * field-level constraint runs in both authoring paths from a single\n * source of truth — re-run scaffold-aip to refresh after spec changes.\n *\n * Cross-field rules (if/then/allOf in JSON Schema) don't translate\n * cleanly and live in `define-workspace.ts`'s `validate(def)` instead.\n */\n\nimport { z } from \"zod\"\n\nexport const workspaceFrontmatterSchema = z.object({ \"schema\": z.literal(\"workspace/v1\"), \"id\": z.string().regex(new RegExp(\"^@[a-z0-9][a-z0-9-]*/[a-z0-9][a-z0-9-]*$\")).describe(\"Globally addressable id `@<owner-slug>/<workspace-slug>`. Lowercase kebab-case, immutable across the workspace's lifetime.\"), \"version\": z.string().regex(new RegExp(\"^\\\\d+\\\\.\\\\d+\\\\.\\\\d+(?:[-+][\\\\w.\\\\-]+)?$\")).describe(\"Spec version of THIS file. Bump on breaking shape change.\"), \"name\": z.string().min(1).max(80).describe(\"Human-readable display name.\"), \"description\": z.string().max(2000).describe(\"One-paragraph purpose.\").optional(), \"owner\": z.object({ \"type\": z.enum([\"guild\",\"user\",\"org\"]), \"id\": z.string().min(1), \"slug\": z.string().regex(new RegExp(\"^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$\")).min(1).describe(\"Owner-side slug. MUST match the slug suffix of the workspace `id`.\") }).strict(), \"storage\": z.any().describe(\"AIP-35 STORAGE block. Required. Inline / ref / file.\"), \"sandbox\": z.any().describe(\"AIP-36 SANDBOX block. Optional — when absent, command-execution tools MUST be unavailable.\").optional(), \"code\": z.any().describe(\"AIP-26 CODE block. Optional — when present, the workspace IS a code-workspace / repo (codespace pattern).\").optional(), \"identity\": z.any().describe(\"AIP-23 identity-ref — default identity for sub-blocks. Sub-blocks (storage, sandbox, code) may override.\").optional(), \"defaults\": z.object({ \"read_only\": z.boolean().optional() }).catchall(z.any()).optional(), \"publish\": z.object({ \"template\": z.boolean().default(false), \"registry\": z.string().optional(), \"visibility\": z.enum([\"private\",\"unlisted\",\"public\"]).default(\"private\") }).strict().optional(), \"tags\": z.array(z.string()).default([] as never), \"created_at\": z.string().datetime({ offset: true }).optional(), \"metadata\": z.record(z.string(), z.any()).optional() }).strict().describe(\"Validates the YAML frontmatter portion of an AIP-34 WORKSPACE.md manifest. Composes the AIP-35 STORAGE block (required), AIP-36 SANDBOX block (optional), AIP-26 CODE block (optional), AIP-23 identity-ref block (optional).\")\n\nexport type WorkspaceFrontmatter = z.infer<typeof workspaceFrontmatterSchema>\n","import { createDoctype } from \"@agentproto/define-doctype\"\nimport { workspaceFrontmatterSchema } from \"./schema.js\"\nimport type { WorkspaceDefinition, WorkspaceHandle } from \"./types.js\"\n\n/**\n * AIP-34 reference implementation of `defineWorkspace`.\n *\n * Built on `createDoctype` so the cross-AIP invariants (id pattern,\n * description length, top-level freeze, \"defineWorkspace (AIP-34): …\"\n * error prefix) run uniformly with every other AIP defineX.\n *\n * Field-level validation runs the schema-derived zod from\n * `./schema.ts` against the input. Same source of truth as the .md\n * path uses (`parseWorkspaceManifest`), so a malformed TS-authored\n * definition fails with the same diagnostic as a malformed manifest.\n * Cross-field rules go in `validate(def)` after the zod check.\n *\n * Identity / description extractors detected from the JSON Schema:\n *   readIdentity: def.id\n *   readDescription: def.name.\n */\nexport const defineWorkspace = createDoctype<WorkspaceDefinition, WorkspaceHandle>({\n  aip: 34,\n  name: \"workspace\",\n  readDescription: (def) => def.name,\n  validate(def) {\n    const result = workspaceFrontmatterSchema.safeParse(def)\n    if (!result.success) {\n      throw new Error(\n        `defineWorkspace (AIP-34): ${result.error.issues\n          .map((i) => `${i.path.join(\".\")}: ${i.message}`)\n          .join(\"; \")}`,\n      )\n    }\n    // TODO: spec-34-specific cross-field rules (if/then/allOf in\n    // the JSON Schema) — those don't translate to zod cleanly and\n    // belong here. See @agentproto/operator's autonomy=gated rule.\n  },\n  build(def) {\n    // Default build: spread the validated definition into a fresh object.\n    // Hand-tune for nested freezing (Object.freeze on arrays/objects) and\n    // for fields that need defaults applied — see @agentproto/operator\n    // for a reference shape.\n    return { ...def } as WorkspaceHandle\n  },\n})\n"]}

package/dist/index.d.ts

@@ -0,0 +1,37 @@
+import { W as WorkspaceDefinition } from './types-fudFG_yV.js';
+export { a as WorkspaceHandle } from './types-fudFG_yV.js';
+
+/**
+ * AIP-34 reference implementation of `defineWorkspace`.
+ *
+ * Built on `createDoctype` so the cross-AIP invariants (id pattern,
+ * description length, top-level freeze, "defineWorkspace (AIP-34): …"
+ * error prefix) run uniformly with every other AIP defineX.
+ *
+ * Field-level validation runs the schema-derived zod from
+ * `./schema.ts` against the input. Same source of truth as the .md
+ * path uses (`parseWorkspaceManifest`), so a malformed TS-authored
+ * definition fails with the same diagnostic as a malformed manifest.
+ * Cross-field rules go in `validate(def)` after the zod check.
+ *
+ * Identity / description extractors detected from the JSON Schema:
+ *   readIdentity: def.id
+ *   readDescription: def.name.
+ */
+declare const defineWorkspace: (def: WorkspaceDefinition) => Readonly<WorkspaceDefinition>;
+
+/**
+ * @agentproto/workspace — AIP-34 WORKSPACE.md `defineWorkspace` reference impl.
+ *
+ * A markdown + frontmatter format for declaring a workspace's identity — globally addressable id, owner, storage choice, defaults, publish posture. The root manifest of every AIP-organized workspace; pairs with STORAGE.md (AIP-35) for the storage policy block.
+ *
+ * Spec: https://agentproto.sh/docs/aip-34
+ *
+ * Authoring paths:
+ *   - TS:  `defineWorkspace({...})` → `WorkspaceHandle`
+ *   - MD:  `parseWorkspaceManifest(src) → workspaceFromManifest({...})` → `WorkspaceHandle`
+ */
+declare const SPEC_NAME: "agentworkspace/v1";
+declare const SPEC_VERSION: "1.0.0-alpha";
+
+export { SPEC_NAME, SPEC_VERSION, WorkspaceDefinition, defineWorkspace };

package/dist/index.mjs

@@ -0,0 +1,14 @@
+export { defineWorkspace } from './chunk-O7MX54WR.mjs';
+
+/**
+ * @agentproto/workspace v0.1.0-alpha
+ * AIP-34 WORKSPACE.md `defineWorkspace` reference implementation.
+ */
+
+// src/index.ts
+var SPEC_NAME = "agentworkspace/v1";
+var SPEC_VERSION = "1.0.0-alpha";
+
+export { SPEC_NAME, SPEC_VERSION };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;AAYO,IAAM,SAAA,GAAY;AAClB,IAAM,YAAA,GAAe","file":"index.mjs","sourcesContent":["/**\n * @agentproto/workspace — AIP-34 WORKSPACE.md `defineWorkspace` reference impl.\n *\n * A markdown + frontmatter format for declaring a workspace's identity — globally addressable id, owner, storage choice, defaults, publish posture. The root manifest of every AIP-organized workspace; pairs with STORAGE.md (AIP-35) for the storage policy block.\n *\n * Spec: https://agentproto.sh/docs/aip-34\n *\n * Authoring paths:\n *   - TS:  `defineWorkspace({...})` → `WorkspaceHandle`\n *   - MD:  `parseWorkspaceManifest(src) → workspaceFromManifest({...})` → `WorkspaceHandle`\n */\n\nexport const SPEC_NAME = \"agentworkspace/v1\" as const\nexport const SPEC_VERSION = \"1.0.0-alpha\" as const\n\nexport { defineWorkspace } from \"./define-workspace.js\"\nexport type { WorkspaceDefinition, WorkspaceHandle } from \"./types.js\"\n"]}

package/dist/manifest/index.d.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod';
+import { a as WorkspaceHandle } from '../types-fudFG_yV.js';
+
+/**
+ * AIP-34 WORKSPACE.md frontmatter zod schema.
+ *
+ * Generated from `resources/aip-34/draft/WORKSPACE.schema.json` via
+ * json-schema-to-zod. Imported by both `define-workspace.ts` (TS path
+ * validation) and `manifest/index.ts` (.md path validation) so every
+ * field-level constraint runs in both authoring paths from a single
+ * source of truth — re-run scaffold-aip to refresh after spec changes.
+ *
+ * Cross-field rules (if/then/allOf in JSON Schema) don't translate
+ * cleanly and live in `define-workspace.ts`'s `validate(def)` instead.
+ */
+
+declare const workspaceFrontmatterSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"workspace/v1">;
+    id: z.ZodString;
+    version: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    owner: z.ZodObject<{
+        type: z.ZodEnum<{
+            guild: "guild";
+            user: "user";
+            org: "org";
+        }>;
+        id: z.ZodString;
+        slug: z.ZodString;
+    }, z.core.$strict>;
+    storage: z.ZodAny;
+    sandbox: z.ZodOptional<z.ZodAny>;
+    code: z.ZodOptional<z.ZodAny>;
+    identity: z.ZodOptional<z.ZodAny>;
+    defaults: z.ZodOptional<z.ZodObject<{
+        read_only: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$catchall<z.ZodAny>>>;
+    publish: z.ZodOptional<z.ZodObject<{
+        template: z.ZodDefault<z.ZodBoolean>;
+        registry: z.ZodOptional<z.ZodString>;
+        visibility: z.ZodDefault<z.ZodEnum<{
+            private: "private";
+            unlisted: "unlisted";
+            public: "public";
+        }>>;
+    }, z.core.$strict>>;
+    tags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    created_at: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+}, z.core.$strict>;
+type WorkspaceFrontmatter = z.infer<typeof workspaceFrontmatterSchema>;
+
+/**
+ * AIP-34 WORKSPACE.md sidecar parser + manifest-to-handle constructor.
+ *
+ * Mirror of `@agentproto/tool/manifest` and `@agentproto/driver/manifest`:
+ * the .md provides metadata; the TS module supplies any spec-specific
+ * runtime bits (schemas, execute bodies, …) that can't live in
+ * frontmatter. Both inputs end up in `defineWorkspace` so the cross-AIP
+ * invariants run uniformly.
+ *
+ *
+ * The frontmatter zod schema below was generated from
+ * `resources/aip-34/draft/WORKSPACE.schema.json` via json-schema-to-zod.
+ * Re-run scaffold-aip to refresh after spec changes (or hand-tune
+ * any constraint the converter doesn't capture cleanly).
+ */
+
+interface WorkspaceManifest {
+    frontmatter: WorkspaceFrontmatter;
+    body: string;
+}
+declare function parseWorkspaceManifest(source: string): WorkspaceManifest;
+declare function workspaceFromManifest(manifest: WorkspaceManifest): WorkspaceHandle;
+
+export { type WorkspaceFrontmatter, type WorkspaceManifest, parseWorkspaceManifest, workspaceFromManifest, workspaceFrontmatterSchema };

package/dist/manifest/index.mjs

@@ -0,0 +1,28 @@
+import { workspaceFrontmatterSchema, defineWorkspace } from '../chunk-O7MX54WR.mjs';
+export { workspaceFrontmatterSchema } from '../chunk-O7MX54WR.mjs';
+import matter from 'gray-matter';
+
+/**
+ * @agentproto/workspace v0.1.0-alpha
+ * AIP-34 WORKSPACE.md `defineWorkspace` reference implementation.
+ */
+function parseWorkspaceManifest(source) {
+  const parsed = matter(source);
+  if (Object.keys(parsed.data).length === 0) {
+    throw new Error("parseWorkspaceManifest: missing or empty frontmatter");
+  }
+  const result = workspaceFrontmatterSchema.safeParse(parsed.data);
+  if (!result.success) {
+    throw new Error(
+      `parseWorkspaceManifest: invalid frontmatter \u2014 ${result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`
+    );
+  }
+  return { frontmatter: result.data, body: parsed.content };
+}
+function workspaceFromManifest(manifest) {
+  return defineWorkspace(manifest.frontmatter);
+}
+
+export { parseWorkspaceManifest, workspaceFromManifest };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/manifest/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/manifest/index.ts"],"names":[],"mappings":";;;;;;;;AA8BO,SAAS,uBAAuB,MAAA,EAAmC;AACxE,EAAA,MAAM,MAAA,GAAS,OAAO,MAAM,CAAA;AAC5B,EAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA,CAAE,WAAW,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,EACxE;AACA,EAAA,MAAM,MAAA,GAAS,0BAAA,CAA2B,SAAA,CAAU,MAAA,CAAO,IAAI,CAAA;AAC/D,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mDAAA,EAAiD,OAAO,KAAA,CAAM,MAAA,CAC3D,IAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,KAAK,CAAA,CAAE,OAAO,EAAE,CAAA,CAC9C,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KACf;AAAA,EACF;AACA,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,OAAO,OAAA,EAAQ;AAC1D;AAEO,SAAS,sBAAsB,QAAA,EAA8C;AAKlF,EAAA,OAAO,eAAA,CAAgB,SAAS,WAA6C,CAAA;AAC/E","file":"index.mjs","sourcesContent":["/**\n * AIP-34 WORKSPACE.md sidecar parser + manifest-to-handle constructor.\n *\n * Mirror of `@agentproto/tool/manifest` and `@agentproto/driver/manifest`:\n * the .md provides metadata; the TS module supplies any spec-specific\n * runtime bits (schemas, execute bodies, …) that can't live in\n * frontmatter. Both inputs end up in `defineWorkspace` so the cross-AIP\n * invariants run uniformly.\n *\n *\n * The frontmatter zod schema below was generated from\n * `resources/aip-34/draft/WORKSPACE.schema.json` via json-schema-to-zod.\n * Re-run scaffold-aip to refresh after spec changes (or hand-tune\n * any constraint the converter doesn't capture cleanly).\n */\n\nimport matter from \"gray-matter\"\nimport { workspaceFrontmatterSchema, type WorkspaceFrontmatter } from \"../schema.js\"\nimport { defineWorkspace } from \"../define-workspace.js\"\nimport type { WorkspaceDefinition, WorkspaceHandle } from \"../types.js\"\n\n// Re-export so consumers can import the schema + inferred type either\n// from \"@@agentproto/workspace/manifest\" or directly from \"@@agentproto/workspace/schema\".\nexport { workspaceFrontmatterSchema, type WorkspaceFrontmatter }\n\nexport interface WorkspaceManifest {\n  frontmatter: WorkspaceFrontmatter\n  body: string\n}\n\nexport function parseWorkspaceManifest(source: string): WorkspaceManifest {\n  const parsed = matter(source)\n  if (Object.keys(parsed.data).length === 0) {\n    throw new Error(\"parseWorkspaceManifest: missing or empty frontmatter\")\n  }\n  const result = workspaceFrontmatterSchema.safeParse(parsed.data)\n  if (!result.success) {\n    throw new Error(\n      `parseWorkspaceManifest: invalid frontmatter — ${result.error.issues\n        .map((i) => `${i.path.join(\".\")}: ${i.message}`)\n        .join(\"; \")}`,\n    )\n  }\n  return { frontmatter: result.data, body: parsed.content }\n}\n\nexport function workspaceFromManifest(manifest: WorkspaceManifest): WorkspaceHandle {\n  // The zod-validated frontmatter is structurally compatible with\n  // WorkspaceDefinition; the cast pins the typing once the manifest\n  // schema and the TS interface diverge (e.g. handle has frozen fields\n  // a literal config doesn't carry yet).\n  return defineWorkspace(manifest.frontmatter as unknown as WorkspaceDefinition)\n}\n"]}

package/dist/types-fudFG_yV.d.ts

@@ -0,0 +1,412 @@
+/**
+ * AIP-34 WorkspaceDefinition + WorkspaceHandle.
+ *
+ * `WorkspaceDefinition` was generated from
+ * `resources/aip-34/draft/WORKSPACE.schema.json` via json-schema-to-typescript.
+ * `WorkspaceHandle` is the readonly view of the same shape; tighten it
+ * by hand for fields that get defaults applied in build().
+ */
+type IdentityRefEntry = {
+    name: string;
+    email: string;
+    avatar?: string;
+    gpg_key?: string;
+    role?: string;
+    metadata?: {};
+    [k: string]: unknown;
+} | {
+    ref: string;
+    role?: string;
+    [k: string]: unknown;
+} | {
+    file: string;
+    role?: string;
+    [k: string]: unknown;
+};
+/**
+ * Validates the YAML frontmatter portion of an AIP-34 WORKSPACE.md manifest. Composes the AIP-35 STORAGE block (required), AIP-36 SANDBOX block (optional), AIP-26 CODE block (optional), AIP-23 identity-ref block (optional).
+ */
+interface WorkspaceDefinition {
+    schema: "workspace/v1";
+    /**
+     * Globally addressable id `@<owner-slug>/<workspace-slug>`. Lowercase kebab-case, immutable across the workspace's lifetime.
+     */
+    id: string;
+    /**
+     * Spec version of THIS file. Bump on breaking shape change.
+     */
+    version: string;
+    /**
+     * Human-readable display name.
+     */
+    name: string;
+    /**
+     * One-paragraph purpose.
+     */
+    description?: string;
+    owner: {
+        type: "guild" | "user" | "org";
+        id: string;
+        /**
+         * Owner-side slug. MUST match the slug suffix of the workspace `id`.
+         */
+        slug: string;
+    };
+    /**
+     * AIP-35 STORAGE block. Required. Inline / ref / file.
+     */
+    storage: {
+        inline: STORAGEMdFrontmatterAgentstorageV1FilesystemPolicyBlock;
+    } | {
+        ref: string;
+    } | {
+        file: string;
+    };
+    /**
+     * AIP-36 SANDBOX block. Optional — when absent, command-execution tools MUST be unavailable.
+     */
+    sandbox?: {
+        inline: SANDBOXMdFrontmatterAgentsandboxV1ComputeEnvironmentPolicy;
+    } | {
+        ref: string;
+    } | {
+        file: string;
+    };
+    /**
+     * AIP-26 CODE block. Optional — when present, the workspace IS a code-workspace / repo (codespace pattern).
+     */
+    code?: {
+        inline: {};
+    } | {
+        ref: string;
+    } | {
+        file: string;
+    };
+    /**
+     * AIP-23 identity-ref — default identity for sub-blocks. Sub-blocks (storage, sandbox, code) may override.
+     */
+    identity?: IdentityRefEntry | [IdentityRefEntry, ...IdentityRefEntry[]];
+    defaults?: {
+        read_only?: boolean;
+        [k: string]: unknown;
+    };
+    publish?: {
+        template?: boolean;
+        registry?: string;
+        visibility?: "private" | "unlisted" | "public";
+    };
+    tags?: string[];
+    created_at?: string;
+    metadata?: {
+        [k: string]: unknown;
+    };
+}
+/**
+ * Validates the YAML frontmatter portion of an AIP-35 STORAGE.md manifest, OR the inline form embedded in any other manifest's `storage:` block. Filesystem-only — sandbox-shaped backends (e2b/modal/...) live in AIP-36 SANDBOX.md.
+ */
+interface STORAGEMdFrontmatterAgentstorageV1FilesystemPolicyBlock {
+    /**
+     * Standalone-only. Identifies the doctype + version. Absent when the block is inlined in another manifest.
+     */
+    schema?: "storage/v1";
+    /**
+     * Standalone-only. Globally addressable id `@<owner-slug>/<storage-slug>`.
+     */
+    id?: string;
+    /**
+     * Standalone-only. Spec version of THIS file. Bump on breaking shape change.
+     */
+    version?: string;
+    /**
+     * Backend kind. Day-1 enumerated set: cloud-bucket | self-bucket | github | local-fs | dev-local | mastra-s3 | mastra-azure. Hosts MAY register additional ids; the schema accepts any non-empty string and host-side validation narrows.
+     */
+    provider: string;
+    /**
+     * Provider-specific connection fields. Shape varies per provider (see AIP-35 §Provider config shapes).
+     */
+    config: {};
+    sync?: SyncBlock;
+    auth?: AuthBlock;
+    /**
+     * AIP-23 identity-ref block — commit author(s) for syncing providers (github). Supports multi-attribution (primary + co-authors).
+     */
+    identity?: ({
+        name: string;
+        email: string;
+        avatar?: string;
+        gpg_key?: string;
+        role?: string;
+        metadata?: {};
+        [k: string]: unknown;
+    } | {
+        ref: string;
+        role?: string;
+        [k: string]: unknown;
+    } | {
+        file: string;
+        role?: string;
+        [k: string]: unknown;
+    }) | [
+        ({
+            name: string;
+            email: string;
+            avatar?: string;
+            gpg_key?: string;
+            role?: string;
+            metadata?: {};
+            [k: string]: unknown;
+        } | {
+            ref: string;
+            role?: string;
+            [k: string]: unknown;
+        } | {
+            file: string;
+            role?: string;
+            [k: string]: unknown;
+        }),
+        ...({
+            name: string;
+            email: string;
+            avatar?: string;
+            gpg_key?: string;
+            role?: string;
+            metadata?: {};
+            [k: string]: unknown;
+        } | {
+            ref: string;
+            role?: string;
+            [k: string]: unknown;
+        } | {
+            file: string;
+            role?: string;
+            [k: string]: unknown;
+        })[]
+    ];
+    /**
+     * Paths NOT mirrored to the backing store. Glob-ish, prefix-matched.
+     */
+    exclude?: string[];
+    /**
+     * Reject writes at the storage layer.
+     */
+    read_only?: boolean;
+    /**
+     * Free-form, namespaced. Authors MAY stash adapter-specific hints under namespaced keys.
+     */
+    metadata?: {
+        [k: string]: unknown;
+    };
+}
+/**
+ * Sync semantics. Lifecycle triggers reference AIP-37 event names.
+ */
+interface SyncBlock {
+    mode?: "canonical" | "pull-push" | "watch";
+    pull?: {
+        /**
+         * AIP-37 lifecycle event name. Standard: workspace-open | turn-start | manual. Aliases (per-turn, each-write) resolve via AIP-37.
+         */
+        on?: string;
+        /**
+         * Cache validity for pull-push providers (e.g. github clone).
+         */
+        ttl_seconds?: number;
+    };
+    commit?: {
+        /**
+         * AIP-37 event name. Common: each-write | per-turn | per-conversation | manual.
+         */
+        on?: string;
+        /**
+         * Debounce window for each-write commit mode.
+         */
+        batch_window_ms?: number;
+        /**
+         * Template for commit message. Provider-specific tokens (e.g. {{operator}}, {{summary}}).
+         */
+        message_template?: string;
+    };
+    push?: {
+        /**
+         * AIP-37 event name. Common: per-commit | per-turn | per-conversation | manual.
+         */
+        on?: string;
+        /**
+         * Github only. Where commits land.
+         */
+        branch_policy?: "main" | "per-conversation" | "per-turn";
+        /**
+         * Github only. Whether to open PRs automatically.
+         */
+        pr_policy?: "none" | "auto" | "manual";
+    };
+    conflict?: {
+        policy?: "rebase" | "merge" | "abort" | "manual" | "last-writer-wins" | "split-conflicts";
+    };
+}
+/**
+ * Reference to AIP-19 SECRETS.md (or future ENV.md) for credentials.
+ */
+interface AuthBlock {
+    /**
+     * Path or registry slug pointing to a SECRETS.md (or future ENV.md) inventory.
+     */
+    ref?: string;
+    state?: {
+        /**
+         * Env-var names this consumer expects to be revealed from the referenced inventory.
+         */
+        env?: string[];
+    };
+}
+/**
+ * Validates the YAML frontmatter portion of an AIP-36 SANDBOX.md manifest, OR the inline form embedded in any other manifest's `sandbox:` block. Compute-only — durable filesystem backings live in AIP-35 STORAGE.md.
+ */
+interface SANDBOXMdFrontmatterAgentsandboxV1ComputeEnvironmentPolicy {
+    /**
+     * Standalone-only. Identifies the doctype + version. Absent when the block is inlined.
+     */
+    schema?: "sandbox/v1";
+    /**
+     * Standalone-only. Globally addressable id `@<owner-slug>/<sandbox-slug>`.
+     */
+    id?: string;
+    /**
+     * Standalone-only. Spec version of THIS file.
+     */
+    version?: string;
+    /**
+     * Backend kind. Day-1 enumerated set: local | mastra-e2b | mastra-modal | mastra-daytona | mastra-blaxel | node-permission. Hosts MAY register additional ids.
+     */
+    provider: string;
+    /**
+     * Provider-specific connection fields. Shape varies per provider (see AIP-36 §Provider config shapes).
+     */
+    config: {};
+    /**
+     * Resource caps per command.
+     */
+    limits?: {
+        timeout_ms?: number;
+        memory_mb?: number;
+        cpu_ms?: number;
+    };
+    env?: {
+        auth?: AuthBlock1;
+        /**
+         * Static host env-var names to forward into the sandbox.
+         */
+        passthrough?: string[];
+    };
+    network?: {
+        /**
+         * Hostnames the sandbox MAY reach. Empty / missing = no egress.
+         */
+        egress?: string[];
+    };
+    /**
+     * Filesystems mounted inside the sandbox at declared paths. Maps to Mastra Workspace.mounts.
+     */
+    mounts?: MountEntry[];
+    /**
+     * AIP-23 identity-ref — owner of the sandbox processes.
+     */
+    identity?: ({
+        name: string;
+        email: string;
+        avatar?: string;
+        gpg_key?: string;
+        role?: string;
+        metadata?: {};
+        [k: string]: unknown;
+    } | {
+        ref: string;
+        role?: string;
+        [k: string]: unknown;
+    } | {
+        file: string;
+        role?: string;
+        [k: string]: unknown;
+    }) | [
+        ({
+            name: string;
+            email: string;
+            avatar?: string;
+            gpg_key?: string;
+            role?: string;
+            metadata?: {};
+            [k: string]: unknown;
+        } | {
+            ref: string;
+            role?: string;
+            [k: string]: unknown;
+        } | {
+            file: string;
+            role?: string;
+            [k: string]: unknown;
+        }),
+        ...({
+            name: string;
+            email: string;
+            avatar?: string;
+            gpg_key?: string;
+            role?: string;
+            metadata?: {};
+            [k: string]: unknown;
+        } | {
+            ref: string;
+            role?: string;
+            [k: string]: unknown;
+        } | {
+            file: string;
+            role?: string;
+            [k: string]: unknown;
+        })[]
+    ];
+    lifecycle?: {
+        /**
+         * AIP-37 event name (e.g. `idle-600` for 10 min). Provider-supported only (modal, daytona).
+         */
+        pause_after_idle?: string;
+        /**
+         * AIP-37 event name (e.g. `workspace-close`).
+         */
+        destroy_on?: string;
+    };
+    /**
+     * Reject command execution at the sandbox layer. Read-only sandbox calls fail with `sandbox_read_only`.
+     */
+    read_only?: boolean;
+    /**
+     * Free-form, namespaced. Adapter hints under `metadata.<adapter>.*`.
+     */
+    metadata?: {
+        [k: string]: unknown;
+    };
+}
+interface AuthBlock1 {
+    ref?: string;
+    state?: {
+        env?: string[];
+    };
+}
+interface MountEntry {
+    /**
+     * What to mount. `"workspace"` shortcut for the parent workspace storage.
+     */
+    source: "workspace" | {
+        ref: string;
+    } | {
+        inline: STORAGEMdFrontmatterAgentstorageV1FilesystemPolicyBlock;
+    } | {
+        file: string;
+    };
+    /**
+     * Absolute path inside the sandbox where the mount appears.
+     */
+    at: string;
+    mode?: "read-write" | "read-only";
+}
+type WorkspaceHandle = Readonly<WorkspaceDefinition>;
+
+export type { WorkspaceDefinition as W, WorkspaceHandle as a };

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@agentproto/workspace",
+  "version": "0.1.0-alpha.0",
+  "description": "@agentproto/workspace — AIP-34 WORKSPACE.md reference implementation. A markdown + frontmatter format for declaring a workspace's identity — globally addressable id, owner, storage choice, defaults, publish posture. The root manifest of every AIP-organized workspace; pairs with STORAGE.md (AIP-35) for the storage policy block.",
+  "keywords": [
+    "agentproto",
+    "aip-34",
+    "workspace",
+    "defineWorkspace",
+    "open-standard",
+    "agentic"
+  ],
+  "homepage": "https://agentproto.sh/docs/aip-34",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/agentproto/ts",
+    "directory": "packages/workspace"
+  },
+  "bugs": {
+    "url": "https://github.com/agentproto/ts/issues"
+  },
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.mjs",
+  "module": "dist/index.mjs",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "default": "./dist/index.mjs"
+    },
+    "./manifest": {
+      "types": "./dist/manifest/index.d.ts",
+      "import": "./dist/manifest/index.mjs",
+      "default": "./dist/manifest/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "gray-matter": "^4.0.3",
+    "zod": "^4.4.3",
+    "@agentproto/define-doctype": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.6.2",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.4",
+    "@agentproto/tooling": "0.1.0-alpha.0"
+  },
+  "scripts": {
+    "dev": "tsup --watch",
+    "build": "tsup",
+    "clean": "rm -rf dist",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest"
+  }
+}