@fangorn-network/westmarch 2026.10.20-dev → 2026.10.22-dev

package/src/publish/init.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+// A new app from the template: its recipe (app.json, eval/, ci/), no data.
+//   npx @fangorn-network/westmarch init <app> [dir] [--no-install]
+// The app's data is what its members commit; the repo this makes can be public.
+import { cpSync, existsSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "../..");
+const TEMPLATE = join(ROOT, "template");
+// What fangorn.network accepts: a name a shell and a URL need no quoting for.
+const APP_NAME = /^[a-z0-9][a-z0-9._-]{1,62}$/;
+
+export function init(app, dir = app, { install = true, log = console.log } = {}) {
+    if (!APP_NAME.test(app ?? "")) throw new Error(`"${app}": 2-63 characters, lowercase letters, digits, dot, dash or underscore`);
+    dir = resolve(dir);
+    if (existsSync(dir) && readdirSync(dir).length) throw new Error(`${dir} is not empty`);
+    cpSync(TEMPLATE, dir, { recursive: true });
+    renameSync(join(dir, "gitignore"), join(dir, ".gitignore"));   // npm drops a published .gitignore
+
+    const cfg = JSON.parse(readFileSync(join(dir, "app.json"), "utf8"));
+    const tag = `${app}.item.v1`;
+    const type = JSON.parse(JSON.stringify(cfg.types["my-app.item.v1"]).replaceAll("my-app.item.v1", tag));
+    Object.assign(cfg, { app, name: app, types: { [tag]: type } });
+    cfg.site.project = app.replace(/[._]/g, "-");                   // a Worker name: letters, digits, dashes
+    writeFileSync(join(dir, "app.json"), JSON.stringify(cfg, null, 1) + "\n");
+    writeFileSync(join(dir, "README.md"), readFileSync(join(dir, "README.md"), "utf8").replaceAll("my-app", app));
+    const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+    pkg.dependencies["@fangorn-network/westmarch"] = `^${JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")).version}`;
+    writeFileSync(join(dir, "package.json"), JSON.stringify(pkg, null, 2) + "\n");
+
+    if (install) {
+        const sh = (cmd, ...args) => { if (spawnSync(cmd, args, { cwd: dir, stdio: "inherit" }).status !== 0) throw new Error(`${cmd} ${args[0]} failed`); };
+        sh("npm", "install");   // the lock CI installs from
+        sh("git", "init", "-q", "-b", "main");
+        sh("git", "add", "-A");
+        sh("git", "commit", "-q", "-m", `${app}: from the westmarch template`);
+    }
+    log(`${app} is in ${dir}. Next:
+  1. app.json: the description, and the type's fields (role_map)
+  2. gh repo create ${app} --private --source ${dir} --push
+  3. gh secret set ETH_PRIVATE_KEY        # the wallet that claimed ${app}; read from the prompt, never echoed
+     gh secret set PINATA_JWT
+     gh variable set PINATA_GATEWAY --body <your-gateway>.mypinata.cloud
+     gh secret set CLOUDFLARE_API_TOKEN
+     gh secret set CLOUDFLARE_ACCOUNT_ID
+  4. gh workflow run ship                  # deploys the Worker; then publish records (README.md)`);
+    return dir;
+}
+
+if (process.argv[2] === "--selfcheck") {
+    const dir = join(mkdtempSync(join(tmpdir(), "init-")), "app");
+    try {
+        init("my.app_1", dir, { install: false, log: () => {} });
+        const cfg = JSON.parse(readFileSync(join(dir, "app.json"), "utf8"));
+        if (cfg.app !== "my.app_1" || cfg.site.project !== "my-app-1" || !cfg.types["my.app_1.item.v1"]?.presentation.types["my.app_1.item.v1"])
+            throw new Error(`app.json not filled: ${JSON.stringify(cfg)}`);
+        if (!existsSync(join(dir, ".gitignore")) || !existsSync(join(dir, ".github/workflows/ship.yml"))) throw new Error("template files missing");
+        if (readFileSync(join(dir, "README.md"), "utf8").includes("my-app")) throw new Error("README still names my-app");
+        let threw = false;
+        try { init("x", join(dir, "y"), { install: false, log: () => {} }); } catch { threw = true; }
+        if (!threw) throw new Error("a one-letter name must be refused");
+        console.log("init: ok");
+    } finally { rmSync(dirname(dir), { recursive: true, force: true }); }
+} else if (process.argv[2] === "init") {
+    const [app, dir] = process.argv.slice(3).filter((a) => !a.startsWith("--"));
+    try { init(app, dir, { install: !process.argv.includes("--no-install") }); }
+    catch (e) { console.error(e.message); process.exit(1); }
+} else {
+    console.error("usage: westmarch init <app> [dir] [--no-install]");
+    process.exit(2);
+}

package/src/publish/ship.js

@@ -14,16 +14,15 @@
 //
 //   1. claim the app (first run only; the claim block becomes the card's fromBlock).
 //      The claimer is the app's first member, so its own updates are accepted.
-//   2. commit the schema, if the one on chain differs from app.json's `types`
-//   3. run each source, which crawls and publishes straight into the app
-//   4. the stock page, the card and _headers → .ship/site
-//   5. deploy the Worker: its R2 bucket, Workers AI, the cron, CONFIG
-//   6. register the ERC-8004 agent and bind the card, if the chain points elsewhere
+//   2. run each source, which crawls and publishes straight into the app
+//   3. the stock page, the card and _headers → .ship/site
+//   4. deploy the Worker: its R2 bucket, Workers AI, the cron, CONFIG (app.json's schema rides in it)
+//   5. register the ERC-8004 agent and bind the card, if the chain points elsewhere
 //
-// The Worker picks up what 2 and 3 published on its next cron run (every few minutes),
+// The Worker picks up what 2 published on its next cron run (every few minutes),
 // so the view follows the chain with nobody running anything.
 //
-// --register is the fast path, run before there is any data: 1, 4, 5 and 6 binding the card
+// --register is the fast path, run before there is any data: 1, 3, 4 and 5 binding the card
 // without minting. The mint copies the card's skills into its IPFS registration file and is
 // never redone, so it waits for the first full ship, when the card lists what the app does.
 //
@@ -38,7 +37,6 @@ import { createRequire } from "node:module";
 import { dirname, join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { RELATION_TAG, TYPE_TAG } from "./view.js";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 // USDC per x402 network (CAIP-2): its address and EIP-712 domain, as each contract reports them.
@@ -151,16 +149,6 @@ export function loadConfig(path) {
     return { relations: [], tags: [], types: {}, ...c };
 }
 
-/** The schema commit for `types` + `relations`: one fangorn.type.v1 record per type, one
- *  fangorn.relation.v1 record per allowed reference. A file for `fangorn commit --replace`. */
-export function schemaRecords(types, relations = []) {
-    return { records: [
-        ...Object.entries(types).map(([tag, t]) => ({ id: `type:${tag}`, type: TYPE_TAG, payload: {
-            tag, description: t.description ?? "", role_map: t.role_map ?? {}, presentation: t.presentation ?? {} } })),
-        ...relations.map((r) => ({ id: `rel:${r.rel}:${r.from}:${r.to}`, type: RELATION_TAG, payload: { rel: r.rel, from: r.from, to: r.to } })),
-    ] };
-}
-
 /** The Worker's wrangler config: the stock worker, the site as its assets, its bucket, the AI
  *  binding, the cron and CONFIG. `worker` is site/worker.js unless a test points elsewhere. */
 export function wranglerConfig({ name, site, account, cron = "*/5 * * * *", config, url, ipfsGateway, worker = join(HERE, "../../site/worker.js") }) {
@@ -186,13 +174,6 @@ export function wranglerConfig({ name, site, account, cron = "*/5 * * * *", conf
 const stable = (v) => Array.isArray(v) ? v.map(stable)
     : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, stable(v[k])])) : v;
 
-/** Same shape parseSchema returns, so a config and the chain compare directly. */
-const canonical = (types, relations = []) => JSON.stringify(stable({
-    types: Object.fromEntries(Object.entries(types).sort(([a], [b]) => a.localeCompare(b))
-        .map(([tag, t]) => [tag, { description: t.description ?? "", role_map: t.role_map ?? {}, presentation: t.presentation ?? {} }])),
-    relations: [...relations].sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b))),
-}));
-
 // ── processes ─────────────────────────────────────────────────────────────────
 
 /** `${VAR}` and `${VAR:-default}` from the environment, so one app.json runs on a laptop
@@ -240,8 +221,9 @@ function assertSameDeployment(cli) {
 
 export async function ship(configPath, { crawl = true, deploy = true, dry = false, replace = false, only = null, register = false } = {}) {
     const cfg = loadConfig(configPath);
-    if (!register && (!Object.keys(cfg.types).length || !cfg.sources.length))
-        throw new Error(`${configPath}: no types or sources yet, so nothing to build; --register sets up the app alone`);
+    // No sources is fine: the app then presents whatever its members commit (repos: [] = all of them).
+    if (!register && !Object.keys(cfg.types).length)
+        throw new Error(`${configPath}: no types yet, so nothing to build; --register sets up the app alone`);
     // No default: one that changed would claim every app that leaned on it again, elsewhere.
     if (!cfg.network) throw new Error(`${configPath}: "network" is required: "baseSepolia" for a new app, or the network the app was claimed on (before 2026-10-20 the default was "arbitrumSepolia")`);
     CLI = cliArgv(cfg);
@@ -263,7 +245,7 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
 
     // The SDK's network name: view.js reads with it, and the CLI and the sources spawned below sign on it.
     process.env.FANGORN_NETWORK = process.env.CHAIN_NAME = cfg.network;
-    const [{ createPublicClient, http }, view] = await Promise.all([import("viem"), import("./view.js")]);
+    const [{ createPublicClient, http, parseAbiItem }, view] = await Promise.all([import("viem"), import("./view.js")]);
     const FangornConfig = await view.network(cfg.network);
     const fangorn = await view.readOnlyFangorn();
     fangorn.setAppId(cfg.app);
@@ -276,8 +258,9 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     const me = (fangornCli(cfg.app, ["wallet"]).match(/Address:\s+(0x[0-9a-fA-F]{40})/) ?? [])[1]?.toLowerCase();
     if (!me) throw new Error("`fangorn wallet` shows no address; run `fangorn init`");
     let owner = (await registry.getAppOwner()).toLowerCase();
+    const chain = createPublicClient({ transport: http(FangornConfig.rpcUrl) });
     if (/^0x0+$/.test(owner)) {
-        const block = await createPublicClient({ transport: http(FangornConfig.rpcUrl) }).getBlockNumber();
+        const block = await chain.getBlockNumber();
         state.fromBlock = String(block);
         log(`${cfg.app} is unclaimed; claiming it for ${me} (fromBlock ${block})`);
         fangornCli(cfg.app, ["app", "claim"], { dry });
@@ -286,25 +269,20 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     } else if (owner !== me) {
         throw new Error(`${cfg.app} belongs to ${owner}, not this wallet (${me}); pick another name`);
     }
+    // Claimed elsewhere (fangorn.network, the CLI): the view starts at the claim, found once.
+    if (state.fromBlock == null && cfg.fromBlock == null) {
+        const from = BigInt(FangornConfig.appRegistryFromBlock), to = await chain.getBlockNumber(), step = BigInt(FangornConfig.logWindow ?? 10000);
+        const event = parseAbiItem("event AppRegistered(bytes32 indexed app_id, address indexed owner)");
+        for (let a = from; a <= to && state.fromBlock == null; a += step) {
+            const [claimed] = await chain.getLogs({ address: FangornConfig.appRegistryContractAddress, event, args: { app_id: appId },
+                                                    fromBlock: a, toBlock: a + step - 1n < to ? a + step - 1n : to });
+            if (claimed) state.fromBlock = String(claimed.blockNumber);
+        }
+    }
     state.fromBlock ??= String(cfg.fromBlock ?? FangornConfig.appRegistryFromBlock);
     log(`app ${cfg.app} = ${appId}, owner ${owner}, fromBlock ${state.fromBlock}`);
 
-    // 2. schema
-    if (!register) {
-        let onChain = null;
-        try { onChain = view.parseSchema((await fangorn.readRepo(owner, view.SCHEMA_REPO)).contents); } catch { /* none yet */ }
-        if (!onChain || canonical(onChain.types, onChain.relations) !== canonical(cfg.types, cfg.relations)) {
-            const sdir = join(dir, "schema");
-            mkdirSync(sdir, { recursive: true });
-            writeFileSync(join(sdir, "schema.json"), JSON.stringify(schemaRecords(cfg.types, cfg.relations), null, 1));
-            log(`schema ${onChain ? "changed" : "is new"}: committing ${Object.keys(cfg.types).join(", ")}`);
-            fangornCli(cfg.app, ["repo", "init", view.SCHEMA_REPO], { cwd: sdir, dry });
-            fangornCli(cfg.app, ["commit", "schema.json", "-m", "schema", "--replace"], { cwd: sdir, dry });
-            fangornCli(cfg.app, ["push"], { cwd: sdir, dry });
-        } else log("schema unchanged");
-    }
-
-    // 3. sources: crawl + publish straight into the app. One source failing (a site that
+    // 2. sources: crawl + publish straight into the app. One source failing (a site that
     // blocks us, a feed that is down) keeps its last published data and does not stop the
     // others; the ship still exits non-zero at the end, naming it.
     const failed = [];
@@ -322,7 +300,7 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
         }
     }
 
-    // 4. the page, the card, the headers
+    // 3. the page, the card, the headers
     const { site, writeCard } = await buildSite(cfg, base);
     // site.url: the app's own domain, routed to the Worker. Otherwise its workers.dev URL,
     // which is only known once it is deployed: the first deploy learns it and the card follows.
@@ -335,12 +313,8 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     const sale = (u) => {
         if (!cfg.paid) return { paid: null, sale: null };
         const T = terms(cfg.paid), price = units(cfg.paid.price, T.decimals), description = cfg.paid.description ?? "";
-        // A membership (MembershipRegistry, joined and claimed through Barliman) reads for free.
-        const membership = cfg.paid.membership ? { registry: cfg.paid.membership.registry, barliman: cfg.paid.membership.barliman.replace(/\/$/, ""),
-                                                   chainId: cfg.paid.membership.chainId ?? FangornConfig.caip2, appId } : null;
-        const paid = { url: `${u}/paid/{id}`, key_url: `${u}/key`, price, asset: T.asset, network: T.network, decimals: T.decimals, symbol: T.symbol,
-                       description, ...(membership ? { membership } : {}) };
-        return { paid, sale: { ...T, price, description, ...(membership ? { membership } : {}) } };
+        const paid = { url: `${u}/paid/{id}`, price, asset: T.asset, network: T.network, decimals: T.decimals, symbol: T.symbol, description };
+        return { paid, sale: { ...T, price, description } };
     };
     const access = (u) => {
         const X = cfg.private;
@@ -354,13 +328,13 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     const writeSite = (u) => writeCard(u, { fromBlock: state.fromBlock, repos, paid: sale(u).paid, access: access(u).card });
     writeSite(url ?? `https://${cfg.site.project}.workers.dev`);
 
-    // 5. the Worker
+    // 4. the Worker
     const workerConfig = (u) => {
         const path = join(dir, "wrangler.json");
         writeFileSync(path, JSON.stringify(wranglerConfig({
             name: cfg.site.project, site, account: cfg.site.account, cron: cfg.site.cron, url: cfg.site.url, ipfsGateway: view.ipfsGateway(),
             config: { app: cfg.app, name: cfg.name, description: cfg.description, fromBlock: state.fromBlock, network: cfg.network,
-                      repos: register ? [] : repos, paid: sale(u).sale, private: access(u).config },
+                      schema: { types: cfg.types, relations: cfg.relations }, repos: register ? [] : repos, paid: sale(u).sale, private: access(u).config },
         }), null, 1));
         return path;
     };
@@ -384,7 +358,7 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
         else if (cfg.paid) log("paid: set the key secret once with `npx wrangler secret put PAID_SECRET --config .ship/wrangler.json`");
     } else workerConfig(url ?? `https://${cfg.site.project}.workers.dev`);
 
-    // 6. ERC-8004 + the binding
+    // 5. ERC-8004 + the binding
     const cardUrl = `${url}/.well-known/agent-card.json`;
     const bound = await registry.appAgentUri(appId).catch(() => "");
     const mint = () => {
@@ -407,7 +381,7 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     } else if (deploy) log("card already bound");
 
     // A new app has no view until the cron runs, which may be hours off: build the first one now.
-    if (deploy && !dry && !register && !await fetch(`${url}/view/cdn/catalog`).then((r) => r.ok, () => false)) {
+    if (deploy && !dry && !register && cfg.sources.length && !await fetch(`${url}/view/cdn/catalog`).then((r) => r.ok, () => false)) {
         log("no view yet: indexing it here rather than waiting for the cron");
         await indexHere(configPath).catch((e) => log(`✗ first index: ${e.message}; the cron will build it`));
     }
@@ -583,21 +557,18 @@ export function readStage(cfg, base, { crawl = false, only = null, log: say = lo
 }
 
 /**
- * The whole app on this machine (devnet.js): a local chain and IPFS, the app claimed and its
- * schema committed there, what the sources staged published into it, and its Worker under
+ * The whole app on this machine (devnet.js): a local chain and IPFS, the app claimed there, what the sources staged published into it, and its Worker under
  * `wrangler dev` with a local R2 and an encoder on localhost (or Workers AI with ai=true).
  * Runs the indexer once, says where everything is, and stays up until interrupted.
  */
 export async function devnetShip(configPath, { crawl = false, only = null, port = 8787, ai = false } = {}) {
     const cfg = loadConfig(configPath);
     const base = dirname(resolve(configPath));
-    const [{ devnet }, { SCHEMA_REPO }] = await Promise.all([import("./devnet.js"), import("./view.js")]);
+    const { devnet } = await import("./devnet.js");
     const staged = readStage(cfg, base, { crawl, only });
     const net = await devnet({ log });
     const owner = await net.client(cfg.app);
     await owner.getAppRegistry().registerApp();
-    await owner.initRepo(SCHEMA_REPO);
-    await owner.uploadBatch(SCHEMA_REPO, schemaRecords(cfg.types, cfg.relations).records);
     // The claimer publishes the sources, as `fangorn` does in a ship.
     for (const [ns, records] of Object.entries(staged)) {
         if (!records.length) continue;
@@ -611,7 +582,7 @@ export async function devnetShip(configPath, { crawl = false, only = null, port
     const { site, writeCard } = await buildSite(cfg, base);
     writeCard(url, { fromBlock: "0", repos });
     const wcfg = wranglerConfig({ name: cfg.site.project, site, config: { app: cfg.app, name: cfg.name, description: cfg.description,
-        fromBlock: "0", repos, paid: null, deployment: net.deployment } });
+        fromBlock: "0", schema: { types: cfg.types, relations: cfg.relations }, repos, paid: null, deployment: net.deployment } });
     // Its own R2 and state, apart from a deployed app's.
     wcfg.vars.RPC_URL = net.rpcUrl;
     wcfg.vars.IPFS_GATEWAY = net.gatewayUrl;
@@ -705,8 +676,7 @@ export async function buildLocal(configPath, out, { crawl = false, only = null,
     env.cacheDir = `${homedir()}/.cache/fangorn-mcp/models`;
     // Not the app's real id or owner: nothing here is compared with the chain.
     const appId = `0x${createHash("sha256").update(cfg.app).digest("hex")}`, owner = `0x${"10ca1".padStart(40, "0")}`;
-    const chain = { [`${owner}/${view.SCHEMA_REPO}`]: {
-        records: schemaRecords(cfg.types, cfg.relations).records.map((r) => ({ ...r, cid: r.id })) } };
+    const chain = {};
     // Storage addresses a record by its content, and so does this.
     for (const [ns, records] of Object.entries(readStage(cfg, base, { crawl, only, log: say })))
         chain[`${owner}/${ns}`] = { records: records.map((r) => ({ ...r, cid: createHash("sha256").update(JSON.stringify(stable(r.payload))).digest("hex") })) };
@@ -715,7 +685,7 @@ export async function buildLocal(configPath, out, { crawl = false, only = null,
     const embed = view.cachedEmbed(join(base, ".ship/vectors.ndjson"));
     const repos = [...new Set(cfg.sources.map((s) => s.namespace))].filter((n) => !only || only.includes(n));
     const report = await view.publishView({ fangorn: view.localFangorn(chain, { appId, owner }), app: cfg.app,
-        repos, out, embed, log: say });
+        schema: { types: cfg.types, relations: cfg.relations }, repos, out, embed, log: say });
     const rows = Object.values(report).reduce((n, r) => n + r.added, 0);
     say(`local view: ${out}  ·  ${rows} records, ${embed.misses} embedded, ${rows - embed.misses} from the vector cache`);
     return report;
@@ -724,19 +694,6 @@ export async function buildLocal(configPath, out, { crawl = false, only = null,
 // ── cli ───────────────────────────────────────────────────────────────────────
 if (process.argv[1]?.endsWith("ship.js") || process.argv[1]?.endsWith("westmarch-ship")) {
     if (process.argv[2] === "--selfcheck") {
-        // The schema as committed, read back the way the chain returns it, must compare
-        // equal to the config, or every run re-commits an unchanged schema.
-        const { parseSchema } = await import("./view.js");
-        const types = { "t.v1": { description: "d", role_map: { title: "name", text: ["body"] }, presentation: { externalUrl: { "t.v1": "{url}" } } },
-                        "u.v1": { description: "e", role_map: { title: "label" } } };
-        const relations = [{ rel: "cites", from: "t.v1", to: "u.v1" }];
-        const g = schemaRecords(types, relations);
-        // Keys reversed at every depth, as a canonical (sorted) encoding hands them back.
-        const reverse = (v) => Array.isArray(v) ? v.map(reverse)
-            : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).reverse().map((k) => [k, reverse(v[k])])) : v;
-        const readBack = parseSchema({ records: g.records.map((r) => ({ ...r, cid: `cid-${r.id}`, payload: reverse(r.payload) })) });
-        if (canonical(readBack.types, readBack.relations) !== canonical(types, relations)) throw new Error("schema does not round-trip");
-        if (canonical(readBack.types, readBack.relations) === canonical({ ...types, "v.v1": {} }, relations)) throw new Error("a new type must count as a change");
         const row = { city: "Wisconsin Rapids", state: "WI", site: "https://x", args: ["--archive-page", "/569/A"] };
         const cmd = fill(["py", "--site", "{site}", "--city", "{city}", "{args...}", "--ns", "us-{state|lower}-{city|slug}"], row);
         if (JSON.stringify(cmd) !== JSON.stringify(["py", "--site", "https://x", "--city", "Wisconsin Rapids", "--archive-page", "/569/A", "--ns", "us-wi-wisconsin-rapids"]))
@@ -754,7 +711,7 @@ if (process.argv[1]?.endsWith("ship.js") || process.argv[1]?.endsWith("westmarch
             throw new Error(`private discovery: ${JSON.stringify(dp.x402)}`);
         if (units("0.01") !== "10000" || units("5") !== "5000000" || units("1.5", 2) !== "150") throw new Error("units");
         if (USDC["eip155:84532"].name !== "USDC" || USDC["eip155:8453"].name !== "USD Coin") throw new Error("USDC's EIP-712 name differs on Base Sepolia and Base");
-        console.log("ship.js self-check ok — a committed schema reads back equal to its config, a new type counts as a change, a source template fills per row, the Worker config binds its bucket, AI and cron, and the paid route is priced per id in /openapi.json and named in /.well-known/x402");
+        console.log("ship.js self-check ok — a source template fills per row, the Worker config binds its bucket, AI and cron, and the paid route is priced per id in /openapi.json and named in /.well-known/x402");
         process.exit(0);
     }
     const [path, ...flags] = process.argv.slice(2);

package/src/publish/view-cli.js

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 // westmarch-view: publish what an app presents as a view (see view.js).
 //
-//   westmarch-view --app my-app --out site/view [--repo catalog …] [--from-block N] [--rebake]
+//   westmarch-view --app my-app --out site/view [--config app.json] [--repo catalog …] [--from-block N] [--rebake]
 //
+// The schema (types, relations) is read from --config; without it every type is guessed.
 // Reads only; needs no key. Deploy <out> with the site, and put its URL in the card's
 // `views`. An app on the free tier needs none of this: its Worker runs the same code on a
 // cron (site/worker.js).
 
+import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 
 const flags = { repo: [] };
@@ -18,7 +20,7 @@ for (let i = 2; i < process.argv.length; i++) {
     if (m[1] === "repo") flags.repo.push(v); else flags[m[1]] = v;
 }
 if (flags.help || !flags.app || !flags.out) {
-    console.error("usage: westmarch-view --app <name|0xid> --out <dir> [--repo <name> …] [--from-block N] [--rebake]");
+    console.error("usage: westmarch-view --app <name|0xid> --out <dir> [--config app.json] [--repo <name> …] [--from-block N] [--rebake]");
     process.exit(flags.help ? 0 : 2);
 }
 
@@ -31,7 +33,8 @@ const fangorn = await readOnlyFangorn();
 
 const t0 = Date.now();
 const report = await publishView({
-    fangorn, app: flags.app, repos: flags.repo, out: flags.out,
+    fangorn, app: flags.app, repos: flags.repo,
+    schema: flags.config ? JSON.parse(readFileSync(flags.config, "utf8")) : undefined, out: flags.out,
     fromBlock: flags["from-block"], rebake: !!flags.rebake,
     log: (s) => console.error(s),
 });

package/src/publish/view.js

@@ -5,8 +5,8 @@
 //   site/worker.js, on a cron                                          (the free tier)
 //
 // Reads the registry and storage and nothing else: every repo the app presents (its
-// members' repos, less its exclusions, `appRepos`), at their latest heads, and the app
-// owner's schema (`fangorn.schema`, see below). Embeds only records the view does not hold
+// members' repos, less its exclusions, `appRepos`), at their latest heads; the schema
+// (app.json's `types` + `relations`) comes from the caller. Embeds only records the view does not hold
 // yet, drops removed ones, and writes, through a store (a directory or an R2 bucket):
 //
 //   cdn/catalog
@@ -40,15 +40,9 @@ import { dirname } from "node:path";
 import { EMBED_DIM, EMBED_DTYPE, EMBED_MODEL, embedDocumentDirect, packVec, unpackVec } from "../core/embed.js";
 import { coverage as fitCoverage } from "../market/reactions.js";
 
-/** The app owner's repo that declares the app's types: one TYPE_TAG record per type, one
- *  RELATION_TAG record per allowed reference between two of them. */
-export const SCHEMA_REPO = "fangorn.schema";
-export const TYPE_TAG = "fangorn.type.v1";
-export const RELATION_TAG = "fangorn.relation.v1";
 export const EMBEDDER = { runtime: "transformers.js", model: EMBED_MODEL, dtype: EMBED_DTYPE };
 const SINGULAR = ["identity", "title", "subtitle", "temporal", "spatial", "media", "thread"];
 const MULTI = ["tags", "measures", "relations", "text"];
-const ZERO = "0x0000000000000000000000000000000000000000";
 // Refit coverage once a domain has grown this many times over what it was fit on.
 const COVERAGE_REFIT = 2;
 
@@ -75,17 +69,13 @@ export function composeText(fields, rm) {
     return s.slice(0, 1000 - "search_document: ".length);
 }
 
-/** `fangorn.schema` records → { types: {tag: {description, role_map, presentation}}, relations }. */
-export function parseSchema(contents) {
-    const types = {}, relations = [];
-    for (const r of contents?.records ?? []) {
-        const p = r.payload ?? {};
-        if (r.type === TYPE_TAG && typeof p.tag === "string")
-            types[p.tag] = { description: String(p.description ?? ""), role_map: p.role_map ?? {}, presentation: p.presentation ?? {} };
-        else if (r.type === RELATION_TAG && p.rel && p.from && p.to)
-            relations.push({ rel: String(p.rel), from: String(p.from), to: String(p.to) });
-    }
-    return { types, relations };
+/** app.json's `types` + `relations` → { types: {tag: {description, role_map, presentation}}, relations }. */
+export function schemaOf({ types = {}, relations = [] } = {}) {
+    return {
+        types: Object.fromEntries(Object.entries(types).map(([tag, t]) =>
+            [tag, { description: String(t.description ?? ""), role_map: t.role_map ?? {}, presentation: t.presentation ?? {} }])),
+        relations: relations.filter((r) => r.rel && r.from && r.to).map((r) => ({ rel: String(r.rel), from: String(r.from), to: String(r.to) })),
+    };
 }
 
 /** Declared means declared: every role present, left-out ones empty. */
@@ -281,7 +271,7 @@ const sha256 = (s) => createHash("sha256").update(s).digest("hex");
 
 /**
  * Bring the view up to date with what the app presents. `fangorn` is an SDK client (reads
- * only); the view goes to `store`, or the directory `out`. `repos` narrows it to those repo
+ * only); `schema` is app.json's { types, relations } (a type it leaves out is guessed); the view goes to `store`, or the directory `out`. `repos` narrows it to those repo
  * names (every publisher's); without it, every repo the app presents. `fromBlock` must be
  * at or before the first update to a repo the app presents, or a repo the scan misses is left out;
  * left out, the SDK's deployment start. `embedBatch(texts)` embeds many at once where the
@@ -290,25 +280,20 @@ const sha256 = (s) => createHash("sha256").update(s).digest("hex");
  * ([{owner, repo, root}], exclusions already applied), as a Worker does across runs.
  * Returns per-domain counts of what changed.
  */
-export async function publishView({ fangorn, app, repos, out, store = fsStore(out), fromBlock, presented, rebake = false,
+export async function publishView({ fangorn, app, schema, repos, out, store = fsStore(out), fromBlock, presented, rebake = false,
                                     embed = embedDocumentDirect, embedBatch = (ts) => Promise.all(ts.map(embed)),
                                     embedder = EMBEDDER, log = console.log, shardRows = 20000, concurrency = 4, open = (p) => p }) {
     fangorn.setAppId(app);
     const appId = fangorn.getAppId();
-    const owner = (await fangorn.getAppRegistry().getAppOwner()).toLowerCase();
-    let schema = { types: {}, relations: [] };
-    if (owner === ZERO) log(`app ${app} is unclaimed, so it has no schema; every type will be guessed`);
-    else {
-        try { schema = parseSchema((await retry(() => fangorn.readRepo(owner, SCHEMA_REPO))).contents); }
-        catch (e) { log(`schema: none read (${e.message}); every type will be guessed`); }
-    }
+    schema = schemaOf(schema);
     const declared = Object.keys(schema.types);
     log(`schema: ${declared.length ? declared.join(", ") : "no declared types"}`);
     const schemaHash = sha256(JSON.stringify(schema));
 
     // Every repo the app presents, at its accepted head: one log scan, exclusions applied.
     const listed = (presented ?? await retry(() => fangorn.appRepos(fromBlock == null ? {} : { fromBlock: BigInt(fromBlock) })))
-        .filter((t) => t.repo !== SCHEMA_REPO && (!repos?.length || repos.includes(t.repo)));
+        // ponytail: "fangorn.schema" is where apps shipped before 2026-10-22 committed their schema; never data.
+        .filter((t) => t.repo !== "fangorn.schema" && (!repos?.length || repos.includes(t.repo)));
     log(`${listed.length} repo(s) presented${repos?.length ? ` of ${repos.join(", ")}` : ""}`);
 
     const report = {};
@@ -535,10 +520,9 @@ if (typeof process !== "undefined" && import.meta.url === `file://${process.argv
 
     const APP = `0x${"ab".repeat(32)}`, OWNER = `0x${"11".repeat(20)}`, PUB = `0x${"22".repeat(20)}`;
     const TAG = "shop.item.v1";
+    const schema = { types: { [TAG]: { description: "Things for a room.", role_map: { identity: "sku", title: "name", text: "about" },
+        presentation: { externalUrl: { [TAG]: "https://shop.example/{sku}" } } } } };
     const chain = {
-        [`${OWNER}/${SCHEMA_REPO}`]: { records: [rec("t1", TYPE_TAG, {
-            tag: TAG, description: "Things for a room.", role_map: { identity: "sku", title: "name", text: "about" },
-            presentation: { externalUrl: { [TAG]: "https://shop.example/{sku}" } } })] },
         [`${PUB}/shop`]: { records: [
             rec("c1", TAG, { sku: "a1", name: "Oak table", about: "a solid oak dining table", price: 3 }),
             rec("c2", TAG, { sku: "b2", name: "Lamp", about: "brass reading lamp", price: 1 }),
@@ -557,11 +541,11 @@ if (typeof process !== "undefined" && import.meta.url === `file://${process.argv
     appendFileSync(`${out}/vectors.ndjson`, '["cut sho');
     eq(packVec(await cachedEmbed(`${out}/vectors.ndjson`, embed)("Title: Oak")), packVec(v1), "a line cut short by a kill is skipped, not fatal");
     embedded.length = 0; rmSync(`${out}/vectors.ndjson`);
-    const run = () => publishView({ fangorn, app: APP, out, embed, log: () => {} });
+    const run = () => publishView({ fangorn, app: APP, schema, out, embed, log: () => {} });
 
     const d = domainFor(APP, PUB, "shop");
     const split = mkdtempSync(`${tmpdir()}/view-`);
-    await publishView({ fangorn, app: APP, out: split, embed, log: () => {}, shardRows: 2 });
+    await publishView({ fangorn, app: APP, schema, out: split, embed, log: () => {}, shardRows: 2 });
     eq(manifestOf(split, d).shards.map((s) => s.count), [2, 1], "rows past shardRows go to the next shard");
     embedded.length = 0;
     eq((await run())[d], { added: 3, removed: 0 }, "first run embeds everything");
@@ -626,16 +610,16 @@ if (typeof process !== "undefined" && import.meta.url === `file://${process.argv
     let budget = 40;
     const capped = (ts) => (budget -= ts.length) < 0 ? Promise.reject(new Error("daily allowance used")) : Promise.all(ts.map(embed));
     const bd = domainFor(APP, PUB, "big");
-    eq((await publishView({ fangorn, app: APP, out: big, repos: ["big"], embedBatch: capped, log: () => {} }))[bd],
+    eq((await publishView({ fangorn, app: APP, schema, out: big, repos: ["big"], embedBatch: capped, log: () => {} }))[bd],
        { added: 32, removed: 0, partial: true }, "an encoder that gives out keeps what it embedded");
     eq([manifestOf(big, bd).count, manifestOf(big, bd).head], [32, null], "served, and the head not taken");
     budget = 1e9;
-    eq((await publishView({ fangorn, app: APP, out: big, repos: ["big"], embedBatch: capped, log: () => {} }))[bd],
+    eq((await publishView({ fangorn, app: APP, schema, out: big, repos: ["big"], embedBatch: capped, log: () => {} }))[bd],
        { added: 48, removed: 0 }, "the next run embeds only the rest");
     eq(manifestOf(big, bd).count, 80, "and serves all of it");
     delete chain[BIG];
     rmSync(big, { recursive: true, force: true });
-    eq((await publishView({ fangorn, app: APP, out, embed, rebake: true, log: () => {} }))[d],
+    eq((await publishView({ fangorn, app: APP, schema, out, embed, rebake: true, log: () => {} }))[d],
        { added: 2, removed: 0 }, "--rebake starts the domain over");
     eq(readdirSync(`${out}/cdn/domains/${d}/shards`).length, 1, "and leaves no orphaned shards");
     rmSync(out, { recursive: true, force: true });
@@ -644,16 +628,16 @@ if (typeof process !== "undefined" && import.meta.url === `file://${process.argv
     // undeclared one is left alone; a target whose identity moves relinks the row without embedding it.
     {
         const T = "civic.item.v1", M = "civic.matter.v1";
-        const rel = { [`${OWNER}/${SCHEMA_REPO}`]: { records: [
-            rec("ti", TYPE_TAG, { tag: T, role_map: { identity: "item_id", title: "heading", thread: "part_of" } }),
-            rec("tm", TYPE_TAG, { tag: M, role_map: { identity: "matter_id", title: "title" } }),
-            rec("tr", RELATION_TAG, { rel: "part_of", from: T, to: M })] },
+        const relSchema = { types: { [T]: { role_map: { identity: "item_id", title: "heading", thread: "part_of" } },
+                                     [M]: { role_map: { identity: "matter_id", title: "title" } } },
+                            relations: [{ rel: "part_of", from: T, to: M }] };
+        const rel = {
             [`${PUB}/civic`]: { records: [
                 rec("i1", T, { item_id: "a#1", heading: "Rezone, committee", part_of: { local: "m" } }),
                 rec("i2", T, { item_id: "b#4", heading: "Rezone, council", cites: { local: "m" } }),
                 rec("m1", M, { matter_id: "plover:7", title: "Rezone" }, "m")] } };
         const o = mkdtempSync(`${tmpdir()}/view-`), dr = domainFor(APP, PUB, "civic");
-        const go = () => publishView({ fangorn: localFangorn(rel, { appId: APP, owner: OWNER }), app: APP, out: o, embed, log: () => {} });
+        const go = () => publishView({ fangorn: localFangorn(rel, { appId: APP, owner: OWNER }), app: APP, schema: relSchema, out: o, embed, log: () => {} });
         const rows = async () => Object.fromEntries([...(await loadDomain(fsStore(o), `cdn/domains/${dr}`)).rows.values()]
             .map((r) => [r.fields.heading ?? r.fields.title, r.fields.part_of ?? r.fields.cites ?? null]));
         await go();
@@ -682,7 +666,7 @@ if (typeof process !== "undefined" && import.meta.url === `file://${process.argv
             },
         };
         const r2 = r2Store(bucket);
-        const via = await publishView({ fangorn, app: APP, store: r2, embed, log: () => {} });
+        const via = await publishView({ fangorn, app: APP, schema, store: r2, embed, log: () => {} });
         eq(Object.keys(via), [d], "a view builds into a bucket");
         eq(await r2.list("cdn/domains"), [d], "list names a folder's children");
         eq((await liveFields(r2)).length, 2, "and reads back");

package/template/.github/workflows/ship.yml

@@ -0,0 +1,33 @@
+# Ship when app.json changes (or by hand); grade the live view daily. Data never comes
+# through here: publishers commit it to the app, and the Worker indexes it every 5 minutes.
+name: ship
+on:
+  push: { branches: [main], paths: [app.json] }
+  schedule: [{ cron: "17 13 * * *" }]
+  workflow_dispatch:
+concurrency: { group: ship, cancel-in-progress: false }
+permissions: { contents: write }   # to commit .ship/state.json back
+jobs:
+  ship:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      ETH_PRIVATE_KEY: ${{ secrets.ETH_PRIVATE_KEY }}
+      PINATA_JWT: ${{ secrets.PINATA_JWT }}
+      PINATA_GATEWAY: ${{ vars.PINATA_GATEWAY }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: npm }
+      - if: github.event_name != 'schedule'
+        run: ci/ship.sh ship
+      - if: github.event_name != 'schedule'
+        name: keep the claim block, URL and agent id
+        run: |
+          git add .ship/state.json
+          git diff --cached --quiet || { git -c user.name=github-actions -c user.email=41898282+github-actions[bot]@users.noreply.github.com commit -m "ship: state" && git push; }
+      - uses: actions/cache@v4
+        with: { path: ~/.cache/fangorn-mcp/models, key: models-embeddinggemma }
+      - run: ci/ship.sh eval

package/template/README.md

@@ -0,0 +1,38 @@
+# A Fangorn app
+
+This repo holds the app's recipe, not its data: what a record is (`app.json`), what a good
+answer looks like (`eval/`), and how to ship it (`ci/`). It can be public. The data lives
+on chain and IPFS, committed by the app's publishers; the Worker indexes it every 5
+minutes, and serves the site, the view, `/mcp` and the agent card.
+
+## Set up (testnet, your own Cloudflare)
+
+1. Edit `app.json`: `app` (the name you claim, globally unique), `name`, `description`,
+   `site.project` (the Worker's name), and the type: rename `my-app.item.v1` and map your
+   fields in `role_map`.
+2. Add repo secrets (Settings → Secrets and variables → Actions):
+   - `ETH_PRIVATE_KEY`: a Base Sepolia wallet with test ETH; it claims and owns the app
+   - `PINATA_JWT`, and the variable `PINATA_GATEWAY`
+   - `CLOUDFLARE_API_TOKEN` (template "Edit Cloudflare Workers", plus R2 and Workers AI) and `CLOUDFLARE_ACCOUNT_ID`
+3. Push `app.json` to `main`. The `ship` workflow claims the app, deploys the Worker and
+   binds its agent, then commits `.ship/state.json` back. Ship again whenever `app.json` changes.
+
+## Publish data
+
+Any member of the app commits records of its type, from anywhere:
+
+```sh
+echo '{"records":[{"id":"first","type":"my-app.item.v1","payload":{"id":"first","title":"Hello","text":"The first item.","tags":["demo"]}}]}' > items.json
+fangorn --app my-app repo init items
+fangorn --app my-app commit items.json -m "first items"
+fangorn --app my-app push
+```
+
+The view picks it up within 5 minutes at `<url>/view`. A source that crawls something
+on a schedule goes in `app.json` `sources`; see westmarch's docs.
+
+## Keep it good
+
+Write `eval/goals.md` (who it serves) and `eval/golden.jsonl` (one check per line:
+`{"id","q","expect","min","goal"}`). The workflow grades the live view daily, and the run
+goes red when a check fails. `ci/ship.sh` runs the same steps on any CI or a laptop.