@agentshouse/mdruntime 0.1.0-cacb4c3f6734e → 0.1.0-cb0eb0d87ff49

package/AGENTS.md

@@ -1,25 +1,24 @@
 # Instructions for the App Creator's agent
 
-These instructions address an agent in an environment with Git. Obtain the
-App Repository, change it, build, and push. They are documentation, not
-enforcement.
+These instructions address an agent in an environment with Git. Obtain the App
+Repository, change it, build, and push. They are documentation, not enforcement.
 
 ## The MD Runtime API
 
 App code reaches the MD Runtime through the remote client. The surfaces are
-Rooms, Query, Search, Observe, Types, Room Draft, Save, History, Call, Reached, Log,
-the reported persistence answer, reauthorization, conversation, the chat draft,
-and Presentation State. Sync Status, the Service Mode, the storage-loss
-statement and the deployment facts are observations only.
+Rooms, Query, Search, Observe, Types, Room Draft, Save, History, the binary file
+reads, Call, Reached, Log, the reported persistence answer, reauthorization,
+conversation, the chat draft, and Presentation State. Sync Status, the Service
+Mode, the storage-loss statement, the deployment facts and the signed-in member
+are observations only.
 
 The host attaches each port with its reach, and every member and observation
 answers within it: a Room outside it answers as one the replica does not hold,
 Rooms lists only the Rooms reached whole, a Room reached for single Documents
 shows only those Documents and the Types of the models that govern them, and
 without conversations the conversation members, the chat draft and the
-conversation observation hold none.
-A change of the reach reaches every open observation as its new value, a query
-keeping every unchanged Document the same object.
+conversation observation hold none. A change of the reach reaches every open
+observation as its new value, a query keeping unchanged Documents the same objects.
 
 Every `observe` resolves, once its first value has arrived, to a handle:
 `current()` is the latest complete value, `subscribe(listener)` hears each later
@@ -27,31 +26,45 @@ value whole and returns its unsubscribe, and `close()` ends the observation.
 Closing the port ends every handle and rejects every pending call and
 observation; a client that reconnects observes again.
 
-Each conversation the Provider's conversation list names is held complete in the
-browser. `conversation.list()` and `observe('conversations')` answer each with its
-Agent's identity and name, its name, created and finished times, last outcome and live
-`state`: `asking` while a question waits, `working` while a turn runs, else `idle`,
-and `started`, when the running turn began, or `null`.
-Observe one with `observe('conversation', id, { limit })`: the view
-holds its latest `limit` messages, or all of them, oldest first, its chat
-draft, and what the Provider streams for it whether or not anything views it:
-the running `turn` with its message parts and its context in use and window, the
-open questions, the process state, and the CLI's commands and options. These live
-only in memory: the message accepted under the turn's id replaces the running turn,
-and none of them is stored or searchable.
-`chatDraft.write` and `chatDraft.discard` keep what the App Creator composes;
-sending it is a Provider Action that needs the Provider reachable and is never
-queued.
-
-Each Room in Rooms lists its `attachments`, the files the Provider holds for it
-that its Documents link by the Provider's reference, ordered by `reference`,
-each with `name`, `byteLength`, `mediaType` and the Provider's own entry as
-`entry`. They are as the Provider last declared them and hold no bytes;
-open one through the Provider Action that serves it.
+`observe('agents')` answers every Agent a new conversation can go to, each
+`{ identity, name }`, whether or not it has a conversation yet. Each conversation
+the Provider's conversation list names is held complete in the browser.
+`conversation.list()` and `observe('conversations')` answer each with its Agent's
+identity and name, its name, created and finished times, last outcome and live
+`state`: `asking` while a question waits, `working` while a turn runs, else
+`idle`, and `started`, when the running turn began, or `null`. Observe one with
+`observe('conversation', id, { limit })`: the view holds a window of its latest
+`limit` messages, or all of them, oldest first, its chat draft, and what the Provider
+streams for it whether or not anything views it: the running `turn` with its
+message parts and its context in use and window, the open questions, the process
+state, and the CLI's commands and options. These live only in memory: the
+message accepted under the turn's id replaces the running turn, and none of them
+is stored or searchable. `chatDraft.write` and `chatDraft.discard` keep what the
+App Creator composes; sending it is a Provider Action that needs the Provider
+reachable and is never queued.
+
+A binary file at a Path is a binary Path entry. Query lists it by `path`, and
+History each of its revisions, with its `binaryFile` record and never its bytes:
+`{ state: 'accepted', revision, path, fileRef, byteLength, mediaType, sha256 }`,
+or, from a Save until the Provider accepts it, `{ state: 'pending', localId,
+path, byteLength, mediaType, sha256 }`. Write one with a Room Draft whose only
+part is `file: { blob }`, the `Blob`'s `type` its media type: Save keeps the
+bytes in its Pending Change, offline too, and acceptance gives the record the
+Provider's revision. Move or remove one as a Document, a pending one before or
+after Save too, its bytes following; once its Pending Change has gone to the
+Provider, Save refuses that as `unknown-revision` until it is accepted.
+`binaryFile.read(room, path, revision?)` answers a pending record's saved bytes,
+or asks the Provider again on every read of an accepted one or of a History
+revision, a removed file's last included, keeping nothing. Text, a Record
+attachment or a conversation message may name a file by its `fileRef`; read it
+with `binaryFile.readReference({ fileRef, referrer })`, the referrer being the
+`referrer` the Provider gave beside it, or `{ room, path }` of the document whose
+text names it. Both answer `{ kind: 'binary', blob }` or a refusal or failure.
 
 Rooms, Query, Search, Observe, Types, Room Draft, Save, and Reached never
-touch the network.
-History and Call go to the Provider through the Adapter. A Call result whose
+touch the network. History, the binary file reads and Call go to the Provider
+through the Adapter. Call takes the Action names the Adapter declares; any other
+name answers `undeclared` without reaching the Provider. A Call result whose
 effect the Provider places in a Room carries `at`, that Room and Room Version;
 `reached(room, roomVersion)` answers whether the Room's confirmed state has
 reached it, and the MD Runtime keeps refreshing that Room until it has;
@@ -60,24 +73,37 @@ that document was written at a later Room Version. Each History revision
 names its author, `{ kind: 'user', id }` or `{ kind: 'site', id, name }`.
 History of a Path no current document holds answers the removed document's
 revisions with `deleted: true`, newest first; that revision is what a link to
-the Path opens. Every
-member of the
-client is asynchronous. Results are detached snapshots. Nothing in this
-surface returns the authorization, performs a request the App's code
-composes, or exposes the browser store.
-
-Read the deployment facts with `observe('deployment-facts')`. Interpret the
-opaque value using the host's contract.
-
-The in-memory Adapter at `@agentshouse/mdruntime/memory` is for tests and
-ships in no bundle.
+the Path opens. Every member of the client is asynchronous. Results are
+detached snapshots. Nothing in this surface returns the authorization, performs
+a request the App's code composes, or exposes the browser store.
+
+Every refusal and failure carries `code` and `retryable`: each Call and History
+answer other than its result, a refused Save or Room Draft write, a returned Room
+Draft's reason, a Room's refusal and the Connection Refusal, and every error a
+member rejects with, beside its message. A Provider refusal carries the
+Provider's own `retryable`. Every code and every value the API answers is open:
+handle one you do not know by its `code` and `retryable`.
+
+Read the deployment facts with `observe('deployment-facts')`, an opaque value
+the host's contract interprets. `observe('member')` answers who uses the App:
+the User the Provider signed in, `{ kind: 'user', id, name }` in the shape of a
+change's `author`, so a Document whose `change.author.id` equals its `id` is that
+User's own. It is `null` until the Provider first names one, and where it names
+none, such as a Site. The MD Runtime keeps it with the Local Replicas, so it
+answers offline once known, and every port hears the next member the Provider
+names; signing out answers `null`, then ends the observation with the
+authorization. It is the only way App code learns who uses it.
 
 ## Local Query rules
 
 `query(q)` answers once from local state; `observe('query', q)` holds the whole
 result and hears it again only when it changes, keeping every unchanged Document
-the same object, so a component can tell what changed by identity. A query is
-data:
+the same object, so a component can tell what changed by identity. An answer is
+complete or pending: `{ documents, coverage }` or `{ groups, coverage }` is
+complete for the Rooms its `coverage` names, and `{ pending }` names each Room
+not yet acquired or prepared, `[{ room, awaits }]`. Never read a pending answer as
+empty: draw it as loading, and observe the query to hear the complete one. A
+query is data:
 
 - **Filter.** `rooms` names Room locators and defaults to every Room. `types`
   names MD Types, and `any` names untyped Markdown Documents. `pathPrefix` is a
@@ -88,13 +114,12 @@ data:
   pointers, ANDs them, and nests `$and` and `$or`; a pointer through a list holds
   when any item satisfies it. A bare value is equality; the operators are `$eq`,
   `$ne`, `$in`, `$nin`, `$gt`, `$gte`, `$lt`, `$lte`, `$all`, `$size` and
-  `$exists`. Equality on a list asks whether it contains the value. Missing, null and empty differ:
-  `$exists: false` keeps a missing field, `null` an explicit null, `''` empty
-  text and `$size: 0` an empty list. A date compares in calendar order and never
-  with a date-time. A reference compares by the Room Path it resolves to.
-  Untyped frontmatter, and a value under `oneOf` or a conditional, is plain
-  values. There is no text containment or regular
-  expression.
+  `$exists`. Equality on a list asks whether it contains the value. Missing,
+  null and empty differ: `$exists: false` keeps a missing field, `null` an
+  explicit null, `''` empty text and `$size: 0` an empty list. A date compares
+  in calendar order and never with a date-time. A reference compares by the Room
+  Path it resolves to. Untyped frontmatter, and a value under `oneOf` or a
+  conditional, is plain values. There is no text containment or regular expression.
 - **Relations.** `hop: { field, types, where, pathPrefix }` keeps Documents whose
   reference at pointer `field`, at any depth, points to a matching Document of the
   same Room. `backlinks: { field, types, where, pathPrefix }` keeps Documents that a
@@ -104,15 +129,16 @@ data:
   list of pointers and `sections` `'all'` or a list of names. Selected pointers
   return the frontmatter holding only them, nested as written. A backlink names
   the referring Path, MD Type and the pointer it came from as `field`. Room and Path always return; a Markdown
-  Document also returns its MD Type. A non-Markdown Document or binary link
-  target returns only Room and Path. An unselected part is absent. Select only
+  Document also returns its MD Type. A non-Markdown Document returns only Room
+  and Path, and a binary Path entry Room, Path and its `binaryFile` record,
+  whatever is selected. An unselected part is absent. Select only
   what a screen shows: a list that selects the Markdown hears every edit of it.
 - **Change.** `change` is `{ author, time }` of the Document's head revision as
   the Provider last delivered it: `author` is `{ kind: 'user' | 'site', id, name }`
   or `null` for a write the Provider made itself, and `time` is the Provider's
   ISO 8601 change time. It is `null` where the Provider delivered no time, as at
   a Site. An unsent edit or move keeps it, an unsent creation has none, and a
-  saved write takes the Provider's own once it is Accepted and refreshed. A
+  saved write takes the Provider's own once it is Accepted. A
   Room's last change is its Document with the latest `time`.
 - **Order and groups.** `orderBy` sorts by `room`, `path`, `type` or `{ field }`
   with TanStack DB's own options, and ties end with Room, then Path. `groupBy` by
@@ -120,15 +146,17 @@ data:
   over every match and ordered by `count` or a key. A sort or group takes only a
   pointer that holds one value. `limit` bounds the Documents or the groups.
 - **Results and errors.** A result carries no Room Version: read freshness from
-  Rooms and Sync Status. An invalid query fails with `invalid-query`,
-  `unknown-type`, `unknown-field` or `wrong-kind`, naming where, and never
-  answers an empty result in its place.
+  Rooms and Sync Status. `coverage` names each Room read as `{ room, generation,
+current }`, `current` false while a newer copy of that Room is being fetched,
+  and the queued changes it includes as `overlay`; a Save in a Room changes the
+  `overlay` of every query over it. An invalid query fails with the `code`
+  `invalid-query`, `unknown-type`, `unknown-field` or `wrong-kind`, naming where,
+  and never answers an empty result in its place.
 
 ## Local Search rules
 
 `search({ text, documents, conversations, limit })` answers once, by words, from
-local state, with MiniSearch at its default configuration. There is no observed
-search.
+local state, with MiniSearch's defaults. There is no observed search.
 
 - **What is found.** A Document by its field values, its sections' headings and
   text, its preamble and its Path; a message by its text. Frontmatter keys, Room
@@ -137,7 +165,10 @@ search.
 - **Narrowing.** `documents` is a Local Query filter: `rooms`, `types`, `where`,
   `pathPrefix`, `hop` and `backlinks`. `conversations` names conversations. Both
   apply before `limit`, which bounds each list; without it every hit returns.
-- **Results.** `{ documents, messages }`, each ranked by `score`, which compares
+- **Results.** `{ documents, messages, coverage }`, or `{ pending }` naming each
+  Room or conversation the search waits for while its index is prepared: ask
+  again, and never read pending as no hits. `coverage` names the Rooms and
+  conversations searched. Each list is ranked by `score`, which compares
   hits of one list of one search. A Document hit names its `room`, `path` and
   `type`, a message hit its `conversation` and `identity`, and `matches` maps each
   matched word to the parts it matched in: `fields`, `sections`, `preamble` or
@@ -146,25 +177,24 @@ search.
 
 ## Room Draft, Save, and outcome rules
 
-The MD Runtime owns one Room Draft per Room and Path, shared by every App and
-tab. It is durable: it survives reload and navigation. A Room that Discovery
-stops listing takes its Room Drafts and its queue with it.
-Write a Room Draft with `roomDraft.write(room, path, revision, parts)`, naming
-the revision you read, or `null` when there was none, and every part it should
-now change: fields, sections and the preamble, or the whole Markdown, a
-creation, a move, or a removal. A part new to the Room Draft names its base,
-the value you showed when it was opened; the MD Runtime keeps a part's first
-base. A binary link target has a Room Draft too, for a move or a removal, with
-`null` as its base. A write or a discard from an older revision is refused as `stale` with
-the current Room Draft; read it and write again.
+The MD Runtime owns one Room Draft per Room and Path, shared by every App and tab.
+It is durable: it survives reload and navigation. A Room that Discovery stops
+listing takes its Room Drafts and its queue with it. Write a Room Draft with
+`roomDraft.write(room, path, revision, parts)`, naming the revision you read, or
+`null` when there was none, and every part it should now change: fields, sections
+and the preamble, or the whole Markdown, a creation, a move, or a removal. A part
+new to the Room Draft names its base, the value you showed when it was opened; the
+MD Runtime keeps a part's first base; a binary Path entry's move or removal takes
+`null` as its base. A write or a discard from an older revision is refused as
+`stale` with the current Room Draft; read it and write again.
 
 Save takes one Room and the Room Drafts of it to save, each with its revision,
 validates locally, and on success appends one Change Batch to that Room's
-queue and removes those Room Drafts. It is refused as `stale`, as
+queue and removes those Room Drafts. It is refused with the `code` `stale`,
 `changed-underneath` naming each part whose base no longer matches the visible
-state, or by a local validation rule, and then creates nothing and leaves every
+state, or a local validation rule, and then creates nothing and leaves every
 Room Draft in place. A directory move or removal is a move or removal part on
-each Document and binary link target beneath it, saved together.
+each Document and binary Path entry beneath it, saved together.
 
 Outcomes follow the Provider's answer. An Accepted Change Batch stays in the
 queue, drawn over the confirmed layer, until the confirmed layer reaches the
@@ -182,12 +212,17 @@ it names; the MD Runtime retries the same Change Batch identity and payload and
 never infers an outcome from transport uncertainty. The MD Runtime never
 combines, reorders, or rebases.
 
-`observe('service-mode')` answers the Provider's Service
-Mode, `open` or `write-halted`. While writes are halted, Save still succeeds,
-its Change Batch waits unsent, and the queue is submitted in order once the
-Provider reopens writes. An Action is never held: a write the Provider refuses
-for the halt returns that refusal to its caller. Show the Provider as read-only
-instead of retrying.
+On a Site, every Save stays in the visitor's browser. Write grants and revisions
+do not refuse it, and its Pending Change shows in every query and across reloads
+until the browser's storage is cleared. It is never sent: `observe('queue', room)`
+shows it `local`, and Sync Status never waits on it. Once the Room changes so that
+it no longer applies, it leaves the queue and returns no Room Draft.
+
+`observe('service-mode')` answers the Provider's Service Mode, `open` or
+`write-halted`. While writes are halted, Save still succeeds, its Change Batch
+waits unsent, and the queue is submitted in order once the Provider reopens
+writes. An Action is never held: a write the Provider refuses for the halt returns
+that refusal to its caller. Show the Provider as read-only instead of retrying.
 
 ## The neutrality rule
 
@@ -217,26 +252,56 @@ the network. Data lives only in the App Creator's browser and with the Provider.
 
 ## App code takes the client its host hands it and never constructs a Runtime
 
-App code takes the client its host hands it: in House,
-`connectHouseBridge().runtime` from `@agentshouse/app-bridge` resolves to the
-client House built into the page. It never constructs a Runtime or a client.
-It imports only types from `@agentshouse/mdruntime/client`, does not call
-`connectMdRuntime` or `serveMdRuntime`, and does not import the package main,
-the host entry, or the Adapter package. Hosts and tests use those entries; the
-served App does not.
+App code takes the client its host hands it: in House, `houseBridge().runtime`
+from `@agentshouse/app-bridge` resolves to the client House built into the page.
+It imports only types from `@agentshouse/mdruntime/client`, never calls
+`connectMdRuntime` or `serveMdRuntime`, and never imports the package main, the
+host entry or the Adapter package, which hosts and tests use. The in-memory
+Adapter at `@agentshouse/mdruntime/memory` is for tests and ships in no bundle.
+A Site's page fills its Entry Data Contract's `{"$param": name}` arguments with
+`boundQuery` from `@agentshouse/mdruntime/entry`, as House did for its HTML.
 
 A React App may observe and save through `@agentshouse/mdruntime/react`, which
 names React as a peer dependency. `useObserve(client, topic, ...input)` takes
-the arguments of `observe` and returns the topic's current value, `undefined`
-until it arrives, re-rendering on each change; a `null` client observes
-nothing. `useSave(client)` returns `busy`, the last `outcome` or `failure`, and
-`save(room, roomDrafts)`, which writes each Path's parts onto the Room Draft
-already there, keeping the bases its parts have, or onto a new one, and saves
-them together. A refused Save leaves the Room Drafts for the App to save again
-or discard; a failure is recorded and rejects. `saveRoomDrafts(client, room,
-roomDrafts)` is that save outside a component. A react-admin or Refine App
-reads and writes its Rooms through the data providers of
-`@agentshouse/mdruntime-families`.
+the arguments of `observe` and returns `{ state: 'loading' }` until the topic's
+first value arrives, then `{ state: 'ready', value }`, re-rendering on each
+change; a `null` client observes nothing and stays loading. `useSave(client)`
+returns `busy`, the last `outcome` or `failure`, and `save(room, roomDrafts)`,
+which writes each Path's parts onto the Room Draft already there, keeping the
+bases its parts have, or onto a new one, and saves them together. A refused
+Save leaves the Room Drafts for the App to save again or discard; a failure is
+recorded and rejects. `saveRoomDrafts(client, room, roomDrafts)` is that save
+outside a component. A react-admin or Refine App reads and writes its Rooms
+through the data providers of `@agentshouse/mdruntime-families`.
+
+## The Chat
+
+`@agentshouse/mdruntime/chat` holds the Chat, one data layer for every App; add
+React as a dependency in any App, with React DOM and `@assistant-ui/react`.
+
+Place the ready chat with `<Chat client={runtime} conversation={id}
+agent={agent} width="1/3" showChats />`: `conversation` opens one, `null` for a
+new chat, `agent` is the Agent a new chat goes to, `onOpen` hears each one it
+opens, and `width` is `full` (the place you give it), or `3/4`, `1/2` or `1/3`
+of the window docked at its right edge, whole on a narrow window. `showChats`
+adds its conversation list; or draw your own inside a `ChatProvider` around a
+`<Chat />` with no `client`. It carries its own styles; theme it with CSS custom
+properties on it or an ancestor: `--chat-background`, `--chat-surface`,
+`--chat-text`, `--chat-text-muted`, `--chat-accent`, `--chat-line`,
+`--chat-attention`, `--chat-danger`, `--chat-font`, `--chat-font-mono`,
+`--chat-font-size`, `--chat-radius` and `--chat-density` (a factor for spacing);
+an unset one keeps House's light or dark look. `mountChat(element, { client })`
+places it outside React and returns `update(props)` and `unmount()`.
+
+Mix `ChatMessageList` (`components` takes your `UserMessage` and
+`AssistantMessage`), `ChatInput` and `ChatQuestionCard` with your own design
+inside a `ChatProvider`, or compose assistant-ui's primitives there; `useChat()`
+gives `send`, the conversations, the Agents, questions to `answer`, `options`
+to `choose`, `commands`, the queue to `edit` or `unqueue`, `stop`, `kill` and
+outcomes; never replace its messages, sending or store. A secret question is
+never answered here; typed answers live in Presentation State's `typed` key:
+keep it, and change Presentation State only inside `inTurn(client, work)` from
+`@agentshouse/mdruntime/client`. `Markdown` draws Markdown safely.
 
 ## What an agent must never do
 

package/README.md

@@ -19,15 +19,16 @@ npm install @agentshouse/mdruntime
 | `@agentshouse/mdruntime`        | Shared types                                                     |
 | `@agentshouse/mdruntime/memory` | Tests: `createMemoryAdapter`, an in-memory Adapter               |
 | `@agentshouse/mdruntime/react`  | React over the client: `useObserve`, `useSave`, `saveRoomDrafts` |
+| `@agentshouse/mdruntime/chat`   | The Chat: `Chat`, `mountChat`, its parts and `ChatProvider`      |
 
 ## Usage
 
 App code takes the client its host hands it; in House the App bridge hands it:
 
 ```ts
-import { connectHouseBridge } from '@agentshouse/app-bridge';
+import { houseBridge } from '@agentshouse/app-bridge';
 
-const runtime = await connectHouseBridge().runtime;
+const runtime = await houseBridge().runtime;
 const rooms = await runtime.rooms();
 const notes = await runtime.query({ types: ['note'], select: 'all', limit: 20 });
 ```
@@ -36,8 +37,17 @@ const notes = await runtime.query({ types: ['note'], select: 'all', limit: 20 })
 `storage-loss` when unsynchronized Room Drafts and Pending Changes were lost.
 The host supplies the user-facing wording.
 
+Place the ready chat, themed by CSS custom properties, docked at a third of the
+window; outside React, `mountChat(element, { client: runtime })` places the same:
+
+```tsx
+import { Chat } from '@agentshouse/mdruntime/chat';
+
+<Chat client={runtime} width="1/3" showChats style={{ '--chat-accent': '#2a6cf0' }} />;
+```
+
 The rules an App's agent follows, including Local Query, Local Search, Room
-Draft and Save, are in [`AGENTS.md`](AGENTS.md).
+Draft, Save and the Chat, are in [`AGENTS.md`](AGENTS.md).
 
 ## License
 

package/dist/adapter.d.ts

@@ -1,4 +1,5 @@
 import type { ModelResult } from './model.js';
+import type { Open } from './open.js';
 import type { ChangeBatch } from './change.js';
 export type Authorization = object;
 export type MdModelIdentity = {
@@ -16,7 +17,7 @@ export type OperationScopes = {
 };
 export type ReplicaAdmission = {
     selection: string;
-    admission: 'admitted' | 'unavailable';
+    admission: Open<'admitted' | 'unavailable'>;
 };
 export type DiscoveredRoom = {
     name: string;
@@ -39,6 +40,7 @@ export type ConversationAgents = {
     type: string;
     identity: string;
     name: string;
+    retired?: string;
 };
 export type ListedConversation = {
     conversation: string;
@@ -207,6 +209,7 @@ export type Discovery = {
     capabilities: readonly Capability[];
     providerLimits: readonly ProviderLimit[];
     retention: Retention;
+    member?: Member;
 };
 export type TransportUncertainty = {
     kind: 'transport-uncertainty';
@@ -221,11 +224,12 @@ export type RevokedAuthorization = {
 export type ProviderRefusal = {
     code: string;
     fields: Readonly<Record<string, unknown>>;
+    retryable: boolean;
 };
 export type ScopedRefusal = ProviderRefusal & {
     kind: 'scoped-refusal';
     locator: string;
-    scope: 'content' | 'sync' | 'model' | 'operation' | 'undisclosed';
+    scope: Open<'content' | 'sync' | 'model' | 'operation' | 'undisclosed'>;
 };
 export type AdapterFailure = TransportUncertainty | RoomNotReadable | RevokedAuthorization | ScopedRefusal;
 export type ContractUnavailable = ProviderRefusal & {
@@ -242,21 +246,28 @@ export type ChangeAuthor = {
     id: string;
     name: string;
 };
+export type Member = Extract<ChangeAuthor, {
+    kind: 'user';
+}>;
 export type HeadChange = {
     author: ChangeAuthor | null;
     time: string;
 };
-export type RoomAttachment = {
-    reference: string;
-    name: string;
+export type BinaryFile = {
+    fileRef: string;
     byteLength: number;
-    mediaType: string | null;
-    entry: unknown;
+    mediaType: string;
+    sha256: string;
+};
+export type HeldContent = {
+    documents: Readonly<Record<string, string>>;
+    revisions: Readonly<Record<string, string>>;
 };
 export type BootstrapRequest = {
     locator: string;
     selection: string;
     pageToken?: PageToken;
+    held?: HeldContent;
 };
 export type RoomModels = {
     collection?: ModelResult;
@@ -269,11 +280,12 @@ export type BootstrapPage = {
     documents: Readonly<Record<string, string>>;
     revisions: Readonly<Record<string, string>>;
     changes: Readonly<Record<string, HeadChange>>;
-    binaryTargets: readonly string[];
-    attachments?: readonly RoomAttachment[];
+    binaryFiles: Readonly<Record<string, BinaryFile>>;
     pageToken?: PageToken;
 };
-export type BootstrapResult = BootstrapPage | AdapterFailure;
+export type BootstrapResult = BootstrapPage | {
+    kind: 'beyond-horizon';
+} | AdapterFailure;
 export type RefreshRequest = {
     locator: string;
     selection: string;
@@ -287,9 +299,8 @@ export type RefreshPage = {
     documents: Readonly<Record<string, string>>;
     revisions: Readonly<Record<string, string>>;
     changes: Readonly<Record<string, HeadChange>>;
-    binaryTargets: readonly string[];
+    binaryFiles: Readonly<Record<string, BinaryFile>>;
     removals: readonly string[];
-    attachments?: readonly RoomAttachment[];
     pageToken?: PageToken;
 };
 export type RefreshResult = {
@@ -306,7 +317,7 @@ export type RetryableRefusal = ProviderRefusal & {
     kind: 'retryable-refusal';
     reset?: string;
 };
-export type ServiceMode = 'open' | 'write-halted';
+export type ServiceMode = Open<'open' | 'write-halted'>;
 export type ServiceModeSignal = {
     observe(notify: (mode: ServiceMode) => void): () => void;
 };
@@ -315,8 +326,9 @@ export type MutationResult = {
     roomVersion: string;
     documents: Readonly<Record<string, string>>;
     revisions: Readonly<Record<string, string>>;
+    changes: Readonly<Record<string, HeadChange>>;
     removals: readonly string[];
-    attachments?: readonly RoomAttachment[];
+    binaryFiles?: Readonly<Record<string, BinaryFile>>;
     author?: string;
     time?: string;
 } | (ProviderRefusal & {
@@ -330,6 +342,7 @@ export type MutationResult = {
     kind: 'write-halted';
 } | {
     kind: 'expired';
+    restored?: true;
 } | AdapterFailure;
 export type HistoryAuthor = {
     kind: 'user';
@@ -343,6 +356,7 @@ export type HistoryRevision = {
     revision: string;
     author: HistoryAuthor;
     time: string;
+    binaryFile?: BinaryFile;
 };
 export type HistoryRequest = {
     locator: string;
@@ -361,6 +375,30 @@ export type HistoryResult = {
 } | {
     kind: 'no-history';
 } | AdapterFailure;
+export type BinaryRequest = {
+    kind: 'path';
+    locator: string;
+    path: string;
+    revision: string;
+    fileRef?: string;
+} | {
+    kind: 'reference';
+    fileRef: string;
+    referrer: unknown;
+};
+export type ReferrerScope = {
+    kind: 'room';
+    locator: string;
+    path?: string;
+} | {
+    kind: 'conversations';
+};
+export type BinaryResult = {
+    kind: 'binary';
+    blob: Blob;
+} | (ProviderRefusal & {
+    kind: 'rejected';
+}) | AdapterFailure;
 export type ActionRequest = {
     name: string;
     input: unknown;
@@ -381,7 +419,6 @@ export type HeldRoom = {
     roomVersion: string;
     documents: Readonly<Record<string, string>>;
     revisions: Readonly<Record<string, string>>;
-    attachments: readonly RoomAttachment[];
 };
 export type RoomStreamEvent = {
     kind: 'opened';
@@ -396,17 +433,36 @@ export type RoomStreamEvent = {
     locator: string;
     roomVersion: string;
 };
+export type KeptReceipt = {
+    key: string;
+    head: unknown;
+};
+export type StreamReceipts = {
+    heads(): Promise<readonly KeptReceipt[]>;
+    parts(key: string, count: number): Promise<readonly unknown[]>;
+    keep(key: string, head: unknown, part?: {
+        index: number;
+        value: unknown;
+    }): Promise<void>;
+    drop(keys: readonly string[]): Promise<void>;
+};
 export type RoomStream = {
     hold(rooms: readonly HeldRoom[]): void;
-    observe(notify: (event: RoomStreamEvent) => void): () => void;
+    reopen(): void;
+    published(locator: string, roomVersion: string): void;
+    observe(notify: (event: RoomStreamEvent) => void, receipts: StreamReceipts): () => void;
 };
 export type Adapter = {
+    readonly localSaves?: true;
+    readonly exhaustiveDiscovery?: true;
     authorize(): Promise<Authorization>;
     discover(authorization: Authorization): Promise<DiscoverResult>;
     bootstrap(authorization: Authorization, request: BootstrapRequest): Promise<BootstrapResult>;
     refresh(authorization: Authorization, request: RefreshRequest): Promise<RefreshResult>;
     mutate(authorization: Authorization, request: MutationRequest, keep: (upload: unknown) => Promise<void>): Promise<MutationResult>;
     history(authorization: Authorization, request: HistoryRequest): Promise<HistoryResult>;
+    binary(authorization: Authorization, request: BinaryRequest): Promise<BinaryResult>;
+    referrerScope(referrer: unknown): ReferrerScope | null;
     action(authorization: Authorization, request: ActionRequest): Promise<ActionResult>;
     reached(locator: string, roomVersion: string, target: string): boolean;
     follows(locator: string, roomVersion: string, next: string): boolean;