@frockbot/plugin-shell 0.0.0 → 0.1.0

package/src/shared.ts

@@ -0,0 +1,338 @@
+export { decodeExternalAuthorizationUrl } from "@frockbot/protocol";
+
+import type {
+  JsonValue,
+  BotNameProvenanceV1,
+  BotNotificationPolicy,
+  BotProfile,
+  BotProfilePatchV1,
+  BotSettingsViewV1,
+  CapabilityAssignmentView,
+  ModelAssignment,
+  UserSettingsViewV1,
+} from "@frockbot/configuration-core";
+import type {
+  CatalogEntryV1,
+  CatalogIndexEntryV1,
+} from "@frockbot/catalog-core";
+import type {
+  SendToUserPayloadV1,
+  SkillRefV1,
+} from "@frockbot/kernel-contracts";
+import type { McpServerStatusViewV1 } from "@frockbot/plugin-mcp/records";
+import type { PackageSettingDefinition } from "@frockbot/kernel-composition";
+import type { ClientSkillCatalogEntryV1 } from "./skill-protocol.js";
+import type { ApprovalCardViewV1 } from "./approvals.js";
+import type { TaskViewV1 } from "@frockbot/plugin-subagents/shared";
+import type { InjectionKey, Ref } from "vue";
+
+export type { CatalogEntryV1, CatalogIndexEntryV1 };
+
+export type WebConnection = "starting" | "ready" | "disconnected" | "error";
+
+/** One binary a tool filed, as the thread draws it: a reference, not bytes. */
+export interface WebToolAttachment {
+  kind: "image";
+  mediaType: string;
+  contentHash: string;
+  /** The encoded `WorkspacePathV1` the Workspace read route takes. */
+  path: string;
+}
+
+export interface WebToolActivity {
+  id: string;
+  name: string;
+  status: "running" | "completed" | "failed";
+  text?: string;
+  attachments?: WebToolAttachment[];
+}
+
+/**
+ * One user-facing send, as the thread draws it. An `unsupported` entry is a
+ * payload this client cannot draw — a newer payload shape, or a malformed one.
+ * The thread says so rather than throwing, because a Turn's history has to
+ * render on a client older than the Bot that produced it.
+ */
+export type WebSendPayload =
+  { kind: "payload"; payload: SendToUserPayloadV1 } | { kind: "unsupported" };
+
+/**
+ * One dispatched subagent, as the thread draws it.
+ *
+ * The chip carries what the durable dispatch said; its live status and summary
+ * are read from {@link FrockBotWebData.tasks}, because a background task
+ * settles long after the Turn that dispatched it and the run's own events
+ * never change again.
+ */
+export interface WebTaskChip {
+  taskId: string;
+  taskType: string;
+  description: string;
+  model: string;
+  background: boolean;
+}
+
+export interface WebChatMessage {
+  id: string;
+  runId: string;
+  /**
+   * `system` is the Session speaking rather than either party: a rename
+   * announcement, for instance. It carries no avatar and no tools.
+   */
+  role: "user" | "assistant" | "system";
+  text: string;
+  /** When the line happened, so system lines sort into the conversation. */
+  at?: string;
+  status:
+    | "streaming"
+    | "completed"
+    | "aborted"
+    | "error"
+    | "interrupted"
+    | "reconciliation-required";
+  tools: WebToolActivity[];
+  /** The typed payloads this Turn sent to the user, oldest first. */
+  sends: WebSendPayload[];
+  /**
+   * The subagents this Turn dispatched, oldest first. Optional so every
+   * existing message literal — and every stored projection — still reads.
+   */
+  tasks?: WebTaskChip[];
+}
+
+export interface WebActiveRun {
+  runId: string;
+  status: "running" | "interrupted" | "reconciliation-required";
+  message: string;
+  canResume: boolean;
+}
+
+export interface SendPromptResult {
+  accepted: boolean;
+  runId?: string;
+  error?: string;
+}
+
+export interface PluginCatalogItem {
+  packageId: string;
+  displayName: string;
+  version: string;
+  capabilities: Array<{
+    id: string;
+    kind: "model" | "tool" | "memory" | "notification" | "computer";
+    connectionTypes: string[];
+  }>;
+  connectionTypes: Array<{
+    id: string;
+    displayName: string;
+    allowMultiple: boolean;
+    authorizationKind: "none" | "api-key" | "ambient-native" | "grant";
+    capabilities: string[];
+  }>;
+  /**
+   * The Package-level settings this Package declares at User scope — the form
+   * the Plugins surface generates for it. Connection-scoped settings are not
+   * here: they belong to one Connection and are edited with it.
+   *
+   * Optional, and read as `[]` when absent: the decoder always fills it, so
+   * absence means a catalog payload projected before this field existed, and a
+   * Package with no declared settings is the same thing as one whose settings
+   * a client cannot see — no form.
+   */
+  settings?: PackageSettingDefinition[];
+}
+
+export interface FrockBotWebData {
+  connection: WebConnection;
+  modelLabel: string;
+  modelReady: boolean;
+  /**
+   * Where the effective model comes from: the Bot's own override, the User's
+   * default, or nothing at all.
+   */
+  modelSource: "bot" | "default" | "none";
+  settingsAvailable: boolean;
+  connectionsAvailable: boolean;
+  activeBotId?: string;
+  composerContext?: unknown;
+  messages: WebChatMessage[];
+  activeRunId?: string;
+  activeRun?: WebActiveRun;
+  error?: string;
+  botSettings?: BotSettingsViewV1;
+  userSettings?: UserSettingsViewV1;
+  pluginCatalog: PluginCatalogItem[];
+  /**
+   * The remote Catalog index, read through `/catalog/v1/index`. Separate from
+   * `pluginCatalog`, which projects the compiled-in application manifest: the
+   * two answer different questions — what this deployment can execute, and what
+   * the Catalog offers to install.
+   */
+  packageCatalog: CatalogIndexEntryV1[];
+  /** The generation `packageCatalog` was read from; every install names it. */
+  packageCatalogGeneration?: string;
+  /**
+   * The Bot's invocable Skills, for the composer's `/` and `@` popover. Refs,
+   * names and descriptions — never a body.
+   */
+  skillCatalog: ClientSkillCatalogEntryV1[];
+  /**
+   * The Bot's approval cards, newest first — pending and already decided
+   * alike, so the card in the transcript can say what was decided rather than
+   * going quiet the moment somebody answers it. Loaded for the selected Bot.
+   */
+  approvals: ApprovalCardViewV1[];
+  /**
+   * The Bot's subagent tasks, newest first. The chip in the transcript is the
+   * durable dispatch; this is what it currently *is* — status, summary, and
+   * failure — so a chip drawn before the child settled says so afterwards
+   * without the run's own events being rewritten.
+   */
+  tasks: TaskViewV1[];
+  /**
+   * The User's MCP servers: state, tool count, last handshake, instructions,
+   * failure, and the durable refusal ledger. Absent until it is loaded, and
+   * absent for a deployment with no MCP route — the Plugins surface then
+   * shows the servers as Connections and nothing more.
+   */
+  mcpServers?: McpServerStatusViewV1;
+  settingsError?: string;
+  selectBot(botId: string): Promise<void>;
+  loadBotSettings(): Promise<void>;
+  saveBotProfile(profile: BotProfile): Promise<void>;
+  /** Partial profile update: only the fields it carries change. */
+  setBotProfile(
+    profile: BotProfilePatchV1,
+    namedBy?: BotNameProvenanceV1,
+  ): Promise<void>;
+  saveBotNotifications(notifications: BotNotificationPolicy): Promise<void>;
+  assignCapability(
+    assignment: Omit<CapabilityAssignmentView, "state">,
+  ): Promise<void>;
+  replaceCapability(
+    assignment: Omit<CapabilityAssignmentView, "state">,
+  ): Promise<void>;
+  unassignCapability(assignmentId: string): Promise<void>;
+  saveBotModel(model: ModelAssignment): Promise<void>;
+  clearBotModel(): Promise<void>;
+  loadUserSettings(): Promise<void>;
+  saveUserProfile(profile: { name: string; email?: string }): Promise<void>;
+  /** The model every Bot uses unless it overrides it. */
+  saveDefaultModel(model: ModelAssignment | undefined): Promise<void>;
+  loadPluginCatalog(): Promise<void>;
+  /** Refreshes {@link FrockBotWebData.mcpServers}. */
+  loadMcpServers(): Promise<void>;
+  /**
+   * The instructions attached to one MCP server, which become the description
+   * its tools carry in the next Turn's model request. An empty string clears
+   * them.
+   */
+  setMcpInstructions(serverId: string, instructions: string): Promise<void>;
+  /**
+   * Restarts one MCP server: its epoch is bumped, so the next admitted Turn
+   * re-handshakes and re-lists its tools.
+   */
+  restartMcpServer(serverId: string): Promise<void>;
+  /**
+   * Connect or reconnect an OAuth MCP server, returning the host-authored
+   * redirect the User is about to follow. `connectionId` reconnects an
+   * existing Connection — the connect card's *Reconnect* — and its absence
+   * creates one from `settings`.
+   */
+  startMcpAuthorization(input: {
+    connectionId?: string;
+    label?: string;
+    settings?: Record<string, unknown>;
+  }): Promise<string | undefined>;
+  loadPackageCatalog(): Promise<void>;
+  /** One entry detail, for the panel a User opens before installing. */
+  loadCatalogEntry(catalogId: string): Promise<CatalogEntryV1 | undefined>;
+  /** Refreshes {@link FrockBotWebData.skillCatalog} for the active Bot. */
+  loadSkillCatalog(): Promise<void>;
+  /** Refreshes {@link FrockBotWebData.approvals} for the active Bot. */
+  loadApprovals(): Promise<void>;
+  /** Refreshes {@link FrockBotWebData.tasks} for the active Bot. */
+  loadTasks(): Promise<void>;
+  /**
+   * Cancels one subagent, explicitly and with the User's authentication. The
+   * backend is the authority: the task this replaces in the list is the record
+   * it answered with, never what the click assumed.
+   */
+  stopTask(taskId: string): Promise<void>;
+  /**
+   * Records one decision on one approval card. The backend is the authority:
+   * this submits the command and re-reads what was recorded, so a card already
+   * answered elsewhere shows that answer rather than this client's guess.
+   */
+  decideApproval(
+    approvalId: string,
+    decision: "approved" | "denied",
+  ): Promise<void>;
+  installPackage(packageId: string, version: string): Promise<void>;
+  /**
+   * Enables or disables one installed Package for this User. Enablement is the
+   * whole of what the Plugins surface does: a disabled Package keeps its
+   * installation, its settings, and its Connections, and stops being available
+   * to any Bot until it is enabled again.
+   */
+  setPackageEnabled(packageId: string, enabled: boolean): Promise<void>;
+  /**
+   * A partial update of one installed Package's setting values. Only the ids
+   * it carries change; the rest keep the values they had.
+   */
+  savePackageSettings(
+    packageId: string,
+    values: Record<string, string | number | boolean>,
+  ): Promise<void>;
+  installCatalogPackage(
+    entry: CatalogIndexEntryV1,
+    /** The entry's `setupFields`, as the User filled them in. */
+    values?: Record<string, JsonValue>,
+  ): Promise<void>;
+  uninstallPackage(packageId: string): Promise<void>;
+  startConnection(
+    packageId: string,
+    connectionTypeId: string,
+  ): Promise<string | undefined>;
+  openConnectionAuthorization(url: string): Promise<void>;
+  revokeConnection(packageId: string, connectionId: string): Promise<void>;
+  createApiKeyConnection(input: {
+    packageId: string;
+    connectionTypeId: string;
+    label: string;
+    apiKey: string;
+    /** Connection-scoped settings the Connection Type's manifest declares. */
+    settings?: Record<string, string | number | boolean | null>;
+  }): Promise<void>;
+  /**
+   * A Connection of a Connection Type whose authorization kind is `none`: it
+   * has no credential, so its settings are the whole of its configuration.
+   */
+  createConnection(input: {
+    packageId: string;
+    connectionTypeId: string;
+    label: string;
+    settings?: Record<string, string | number | boolean | null>;
+  }): Promise<void>;
+  rotateApiKeyConnection(connectionId: string, apiKey: string): Promise<void>;
+  updateConnectionLabel(connectionId: string, label: string): Promise<void>;
+  refreshConnectionModels(connectionId: string): Promise<void>;
+  setConnectionEnabled(connectionId: string, enabled: boolean): Promise<void>;
+  disconnectConnection(
+    connectionId: string,
+    revokeUpstream?: boolean,
+  ): Promise<void>;
+  /** `skills` are the refs the composer attached; absent means none. */
+  sendPrompt(
+    text: string,
+    skills?: readonly SkillRefV1[],
+  ): Promise<SendPromptResult>;
+  resumeRun(runId: string): Promise<void>;
+  /** Sends the durable Stop command for the observed active run. */
+  stopRun(): Promise<void>;
+  /** Detaches the local observer only; admitted work stays durable. */
+  abort(): Promise<void>;
+}
+
+export const frockBotWebDataKey: InjectionKey<Ref<FrockBotWebData>> =
+  Symbol("frockbot-web-data");

package/src/skill-protocol.ts

@@ -0,0 +1,117 @@
+// The Skill catalog the composer's `/` and `@` popover reads.
+//
+// The Bot already loads its catalog once per admitted Turn and records it in
+// `skill/injected`, but a composer needs the list *before* the Turn exists, so
+// this is a read of the same loader over the same instruction root, projected
+// as a DTO. It carries a name, a description and a ref — never a body. A body
+// reaches the model only by invocation or `skill_load`, so the client can show
+// what a Skill is for without ever holding what it says.
+//
+// The hosted client renders backend state and submits commands. It does not
+// become an alternate authority: nothing here is writable, and an entry's
+// `ref` is the only part a turn command may echo back.
+import {
+  decodeSkillRefV1,
+  formatSkillRefV1,
+  type SkillRefV1,
+} from "@frockbot/kernel-contracts";
+
+const MAX_CATALOG_ENTRIES = 200;
+const MAX_NAME_LENGTH = 64;
+const MAX_DESCRIPTION_LENGTH = 1_024;
+const MAX_PATH_LENGTH = 512;
+
+/** One invocable Skill, as a client sees it. */
+export interface ClientSkillCatalogEntryV1 {
+  /** The canonical string form, for display and for stable list keys. */
+  ref: string;
+  /** The structured ref a turn command carries. */
+  skill: SkillRefV1;
+  name: string;
+  description: string;
+  /** Where the Skill lives, so a User can tell two same-named ones apart. */
+  path: string;
+}
+
+export interface ClientSkillCatalogV1 {
+  schemaVersion: 1;
+  skills: ClientSkillCatalogEntryV1[];
+}
+
+/** Builds one entry from a loaded Skill and the ref that names it. */
+export function clientSkillCatalogEntryV1(input: {
+  skill: SkillRefV1;
+  name: string;
+  description: string;
+  path: string;
+}): ClientSkillCatalogEntryV1 {
+  return {
+    ref: formatSkillRefV1(input.skill),
+    skill: input.skill,
+    name: input.name.slice(0, MAX_NAME_LENGTH),
+    description: input.description.slice(0, MAX_DESCRIPTION_LENGTH),
+    path: input.path.slice(0, MAX_PATH_LENGTH),
+  };
+}
+
+function record(value: unknown, label: string): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value as Record<string, unknown>;
+}
+
+function boundedString(value: unknown, maximum: number, label: string): string {
+  if (typeof value !== "string" || value.length > maximum) {
+    throw new Error(`${label} must be a bounded string`);
+  }
+  return value;
+}
+
+/** The strict decoder for the catalog crossing the client seam. */
+export function decodeClientSkillCatalogV1(
+  input: unknown,
+): ClientSkillCatalogV1 {
+  const catalog = record(input, "skill catalog");
+  const allowed = new Set(["schemaVersion", "skills"]);
+  for (const key of Object.keys(catalog)) {
+    if (!allowed.has(key))
+      throw new Error(`skill catalog.${key} is not allowed`);
+  }
+  if (catalog.schemaVersion !== 1) {
+    throw new Error("skill catalog.schemaVersion is invalid");
+  }
+  if (!Array.isArray(catalog.skills)) {
+    throw new Error("skill catalog.skills must be an array");
+  }
+  if (catalog.skills.length > MAX_CATALOG_ENTRIES) {
+    throw new Error("skill catalog.skills is too long");
+  }
+  const skills = catalog.skills.map((value, index) => {
+    const label = `skill catalog.skills[${index}]`;
+    const entry = record(value, label);
+    const keys = new Set(["ref", "skill", "name", "description", "path"]);
+    for (const key of Object.keys(entry)) {
+      if (!keys.has(key)) throw new Error(`${label}.${key} is not allowed`);
+    }
+    const skill = decodeSkillRefV1(entry.skill, `${label}.skill`);
+    const ref = boundedString(entry.ref, 256, `${label}.ref`);
+    if (ref !== formatSkillRefV1(skill)) {
+      // The two forms are one fact. A projection whose halves disagree is a
+      // refusal, not a value the popover renders under the wrong name.
+      throw new Error(`${label}.ref does not match its skill`);
+    }
+    return {
+      ref,
+      skill,
+      name: boundedString(entry.name, MAX_NAME_LENGTH, `${label}.name`),
+      description: boundedString(
+        entry.description,
+        MAX_DESCRIPTION_LENGTH,
+        `${label}.description`,
+      ),
+      path: boundedString(entry.path, MAX_PATH_LENGTH, `${label}.path`),
+    } satisfies ClientSkillCatalogEntryV1;
+  });
+  return { schemaVersion: 1, skills };
+}

package/src/terminal-records.test.ts

@@ -0,0 +1,217 @@
+// The one transaction that settles a Turn, and the three producers sharing it.
+//
+// The property under test is composition, not any producer's own rules: each
+// producer runs exactly once per settlement, and no producer may silently
+// overwrite another. A settlement that ran a producer twice would write two
+// records where the Turn earned one — a firing with two inbox entries — and
+// nobody would notice until they counted.
+import { describe, expect, test } from "bun:test";
+import { shellTerminalRecordsV1 } from "./terminal-records.js";
+import { SIDEBAR_PREVIEW_KEY, UNREAD_STATE_KEY } from "./unread.js";
+import { approvalKeyV1, decodeApprovalRecordV1 } from "./approvals.js";
+import { decodeRoutineInboxEntryV1 } from "@frockbot/plugin-routines/inbox";
+import {
+  ROUTINE_INBOX_PREFIX,
+  ROUTINE_WAKE_PREFIX,
+} from "@frockbot/plugin-routines/storage-keys";
+
+const NOW = "2026-09-01T00:00:00.000Z";
+const CURSOR = "run-index:2026-09-01T00:00:00.000Z:run-1";
+
+/** A durable store the settling transaction reads through. */
+function store(initial: Record<string, unknown> = {}) {
+  const state = new Map(Object.entries(initial));
+  return {
+    state,
+    read: <T>(key: string) => Promise.resolve(state.get(key) as T | undefined),
+    /** Apply what the settlement returned, the way the kernel writes it. */
+    apply(records: Record<string, unknown>) {
+      for (const [key, value] of Object.entries(records)) state.set(key, value);
+    },
+  };
+}
+
+const APPROVAL_SEND = {
+  type: "send/to-user",
+  payload: {
+    type: "approval",
+    approvalId: "ap-1",
+    action: "Delete the staging database",
+    risk: "high",
+  },
+} as const;
+
+function keysUnder(records: Record<string, unknown>, prefix: string): string[] {
+  return Object.keys(records).filter((key) => key.startsWith(prefix));
+}
+
+describe("the settling transaction's records", () => {
+  test("a chat Turn that asked for approval writes unread and the decision, once each", async () => {
+    const durable = store();
+
+    const records = await shellTerminalRecordsV1({
+      run: {
+        runId: "run-1",
+        sessionId: "user-1:bot-1",
+        acceptedAt: NOW,
+        input: "Please delete it",
+        admission: { turnType: "chat" },
+        events: [{ type: "turn/start" }, APPROVAL_SEND],
+      },
+      cursor: CURSOR,
+      now: NOW,
+      read: durable.read,
+    });
+
+    expect(Object.keys(records).sort()).toEqual([
+      approvalKeyV1("ap-1"),
+      SIDEBAR_PREVIEW_KEY,
+      UNREAD_STATE_KEY,
+    ]);
+    expect(
+      decodeApprovalRecordV1(records[approvalKeyV1("ap-1")]),
+    ).toMatchObject({ decision: "pending", runId: "run-1", createdAt: NOW });
+    // One settlement, one instant: the unread record is stamped with the same
+    // `now` the approval is.
+    expect(records[UNREAD_STATE_KEY]).toMatchObject({
+      lastActivityCursor: CURSOR,
+      lastActivityAt: NOW,
+    });
+    expect(records[SIDEBAR_PREVIEW_KEY]).toEqual({
+      schemaVersion: 1,
+      text: "Please delete it",
+      at: NOW,
+      role: "user",
+    });
+  });
+
+  test("one automation Turn contributes exactly one inbox entry and one wake", async () => {
+    const durable = store({
+      "routine:brief": {
+        schemaVersion: 1,
+        routineId: "brief",
+        name: "Morning brief",
+        prompt: "look",
+        timezone: "UTC",
+        enabled: true,
+        createdBy: { kind: "user" },
+        updatedBy: { kind: "user" },
+        createdAt: NOW,
+        updatedAt: NOW,
+        schedule: "* * * * *",
+      },
+    });
+    const run = {
+      runId: "rf-brief-1",
+      sessionId: "user-1:bot-1",
+      acceptedAt: NOW,
+      input: "look",
+      admission: {
+        turnType: "automation",
+        origin: { kind: "routine", routineId: "brief" },
+      },
+      events: [
+        { type: "turn/start" },
+        { type: "wake/parent", message: "Two emails need you." },
+      ],
+    };
+
+    const records = await shellTerminalRecordsV1({
+      run,
+      cursor: CURSOR,
+      now: NOW,
+      read: durable.read,
+    });
+
+    expect(keysUnder(records, ROUTINE_INBOX_PREFIX)).toHaveLength(1);
+    expect(keysUnder(records, ROUTINE_WAKE_PREFIX)).toHaveLength(1);
+    // An automation Turn reaches its User through the inbox, never the badge.
+    expect(records[UNREAD_STATE_KEY]).toBeUndefined();
+    const entry = decodeRoutineInboxEntryV1(
+      records[keysUnder(records, ROUTINE_INBOX_PREFIX)[0]!],
+    );
+    expect(entry).toMatchObject({ entryId: "ri-rf-brief-1", runId: run.runId });
+  });
+
+  test("re-settling the same Turn writes the same records, and no second entry", async () => {
+    const durable = store({
+      "routine:brief": {
+        schemaVersion: 1,
+        routineId: "brief",
+        name: "Morning brief",
+        prompt: "look",
+        timezone: "UTC",
+        enabled: true,
+        createdBy: { kind: "user" },
+        updatedBy: { kind: "user" },
+        createdAt: NOW,
+        updatedAt: NOW,
+        schedule: "* * * * *",
+      },
+    });
+    const run = {
+      runId: "rf-brief-1",
+      sessionId: "user-1:bot-1",
+      acceptedAt: NOW,
+      input: "look",
+      admission: {
+        turnType: "automation",
+        origin: { kind: "routine", routineId: "brief" },
+      },
+      events: [
+        { type: "turn/start" },
+        { type: "wake/parent", message: "Two emails need you." },
+        APPROVAL_SEND,
+      ],
+    };
+    const settle = () =>
+      shellTerminalRecordsV1({
+        run,
+        cursor: CURSOR,
+        now: NOW,
+        read: durable.read,
+      });
+
+    const first = await settle();
+    durable.apply(first);
+    // Recovery re-settles an interrupted Turn through the same seam. The
+    // approval it already wrote is left exactly as it stands — a decision a
+    // person made in between must not be reset to `pending`.
+    const second = await settle();
+
+    expect(keysUnder(first, ROUTINE_INBOX_PREFIX)).toHaveLength(1);
+    expect(second[approvalKeyV1("ap-1")]).toBeUndefined();
+    durable.apply(second);
+    expect(
+      [...durable.state.keys()].filter((key) =>
+        key.startsWith(approvalKeyV1("ap-1")),
+      ),
+    ).toHaveLength(1);
+  });
+
+  test("a producer that would overwrite another's key is a loud failure", async () => {
+    // The unread key is the Shell's own; a Package record landing on it would
+    // be a key-space collision, and picking a winner silently is the one
+    // outcome the composition refuses.
+    const durable = store();
+    const records = await shellTerminalRecordsV1({
+      run: {
+        runId: "run-1",
+        sessionId: "user-1:bot-1",
+        acceptedAt: NOW,
+        input: "Please delete it",
+        admission: { turnType: "chat" },
+        events: [APPROVAL_SEND],
+      },
+      cursor: CURSOR,
+      now: NOW,
+      read: durable.read,
+    });
+
+    // No collision today, and the guard is what keeps that true as producers
+    // are added: every key is written by exactly one of them.
+    expect(new Set(Object.keys(records)).size).toBe(
+      Object.keys(records).length,
+    );
+  });
+});