@fungi.computer/agar 0.0.0-stage → 0.0.1

package/dist/agent-message-meta.d.ts

@@ -0,0 +1,74 @@
+import * as z from "zod";
+/** Who a Session line came from, as the admitting host authenticated them. */
+export declare const FungiAuthorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strict>;
+/** Who a Session line came from, as the admitting host authenticated them. */
+export type FungiAuthor = z.infer<typeof FungiAuthorSchema>;
+/**
+ * A delegated Agent's reply as the admitting host authenticated it against the
+ * mail it sent. `commandId` is the replying Session's accepted command, the
+ * same id as the sender's `agents.send` receipt.
+ */
+export declare const FungiDelegationReplySchema: z.ZodObject<{
+    agentId: z.ZodString;
+    sessionId: z.ZodString;
+    commandId: z.ZodString;
+    outcome: z.ZodEnum<{
+        completed: "completed";
+        failed: "failed";
+        interrupted: "interrupted";
+        cancelled: "cancelled";
+        outcome_unknown: "outcome_unknown";
+    }>;
+    diagnostic: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** A delegated Agent's reply as the admitting host authenticated it. */
+export type FungiDelegationReply = z.infer<typeof FungiDelegationReplySchema>;
+/**
+ * The metadata the host attaches to every prompt and operator line it admits.
+ * Shiitake stores it opaquely; the host writes it and Apps read it.
+ */
+export declare const FungiMessageMetaSchema: z.ZodObject<{
+    author: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+    delegation: z.ZodOptional<z.ZodObject<{
+        ancestors: z.ZodArray<z.ZodString>;
+        maxDepth: z.ZodNumber;
+        reply: z.ZodOptional<z.ZodObject<{
+            agentId: z.ZodString;
+            sessionId: z.ZodString;
+            commandId: z.ZodString;
+            outcome: z.ZodEnum<{
+                completed: "completed";
+                failed: "failed";
+                interrupted: "interrupted";
+                cancelled: "cancelled";
+                outcome_unknown: "outcome_unknown";
+            }>;
+            diagnostic: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** The metadata the host attaches to every prompt and operator line it admits. */
+export type FungiMessageMeta = z.infer<typeof FungiMessageMetaSchema>;
+/** Any JSON value, as Shiitake returns a message's metadata. */
+export type MessageMetaValue = string | number | boolean | null | readonly MessageMetaValue[] | Readonly<{
+    [key: string]: MessageMetaValue;
+}>;
+/** The author a message's metadata names; none for anything else. */
+export declare function messageAuthor(meta: MessageMetaValue | undefined): FungiAuthor | undefined;
+/**
+ * The authenticated delegation reply a message's metadata carries; none for
+ * any other line, including text that merely looks like a reply.
+ */
+export declare function messageDelegationReply(meta: MessageMetaValue | undefined): FungiDelegationReply | undefined;
+/** The metadata the host attaches for one authenticated author, as JSON. */
+export type AuthorMeta = Readonly<{
+    author: Readonly<FungiAuthor>;
+}>;
+/** The metadata the host attaches for one authenticated author. */
+export declare function authorMeta(author: FungiAuthor): AuthorMeta;

package/dist/agent-message-meta.js

@@ -0,0 +1,63 @@
+import * as z from "zod";
+/** Who a Session line came from, as the admitting host authenticated them. */
+export const FungiAuthorSchema = z.strictObject({
+    id: z.string().min(1).max(256),
+    name: z.string().min(1).max(128),
+});
+const identifier = z.string().min(1).max(256);
+/**
+ * A delegated Agent's reply as the admitting host authenticated it against the
+ * mail it sent. `commandId` is the replying Session's accepted command, the
+ * same id as the sender's `agents.send` receipt.
+ */
+export const FungiDelegationReplySchema = z.strictObject({
+    agentId: identifier,
+    sessionId: identifier,
+    commandId: identifier,
+    /** The exact settlement outcome; failures are never collapsed. */
+    outcome: z.enum([
+        "completed",
+        "failed",
+        "interrupted",
+        "cancelled",
+        "outcome_unknown",
+    ]),
+    /** Bounded, single-line terminal diagnostic for work that did not complete. */
+    diagnostic: z.string().min(1).max(200).optional(),
+});
+/**
+ * The metadata the host attaches to every prompt and operator line it admits.
+ * Shiitake stores it opaquely; the host writes it and Apps read it.
+ */
+export const FungiMessageMetaSchema = z.strictObject({
+    author: FungiAuthorSchema.optional(),
+    /** Host-admitted delegation path and its inherited abuse bound. */
+    delegation: z
+        .strictObject({
+        ancestors: z.array(identifier).max(8),
+        maxDepth: z.number().int().min(1).max(8),
+        /**
+         * Present only on a line the host admitted as an authenticated reply;
+         * a line's text never sets it.
+         */
+        reply: FungiDelegationReplySchema.optional(),
+    })
+        .optional(),
+});
+/** The author a message's metadata names; none for anything else. */
+export function messageAuthor(meta) {
+    const parsed = FungiMessageMetaSchema.safeParse(meta);
+    return parsed.success ? parsed.data.author : undefined;
+}
+/**
+ * The authenticated delegation reply a message's metadata carries; none for
+ * any other line, including text that merely looks like a reply.
+ */
+export function messageDelegationReply(meta) {
+    const parsed = FungiMessageMetaSchema.safeParse(meta);
+    return parsed.success ? parsed.data.delegation?.reply : undefined;
+}
+/** The metadata the host attaches for one authenticated author. */
+export function authorMeta(author) {
+    return { author: { id: author.id, name: author.name } };
+}

package/dist/agents.d.ts

@@ -0,0 +1,170 @@
+export { FungiAuthorSchema, FungiDelegationReplySchema, FungiMessageMetaSchema, messageAuthor, messageDelegationReply, authorMeta, } from "./agent-message-meta.js";
+export type { FungiAuthor, FungiDelegationReply, FungiMessageMeta, MessageMetaValue, AuthorMeta, } from "./agent-message-meta.js";
+import * as z from "zod";
+import * as Schema from "effect/Schema";
+import type { CapabilityContract, CapabilityDirectory } from "./capabilities.js";
+/**
+ * Validates the wire shape of an Agent record: its id, display name,
+ * and which session operations (read, send, manage) this App may
+ * perform on it.
+ */
+export declare const appAgentSchema: Schema.Struct<{
+    readonly agentId: Schema.String;
+    readonly name: Schema.String;
+    readonly sessionOperations: Schema.$Array<Schema.Literals<readonly ["agent.read", "agent.send", "agent.manage"]>>;
+}>;
+/**
+ * An Agent record as decoded from the host: its id, display name, and
+ * which session operations this App is permitted to perform on it.
+ */
+export type AppAgent = Schema.Schema.Type<typeof appAgentSchema>;
+/** The admitted AGENTS.list projection, containing only ids and display names. */
+export declare const appAgentListResultSchema: z.ZodObject<{
+    agents: z.ZodArray<z.ZodObject<{
+        agentId: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Computer provisioning is a Team creation choice, separate from Home policy. */
+export declare const appAgentComputerSchema: Schema.Literals<readonly ["new", "none"]>;
+/** Validates Agent creation input: a name, a caller-chosen request id and an
+ * optional Computer provisioning choice. */
+export declare const appAgentCreateInputSchema: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly requestId: Schema.String;
+    readonly computer: Schema.optionalKey<Schema.Literals<readonly ["new", "none"]>>;
+}>;
+/**
+ * Input for creating a new Agent: its name, a caller-chosen request id
+ * for idempotency, and whether to provision a new Computer for it.
+ */
+export type AppAgentCreateInput = Readonly<Schema.Schema.Type<typeof appAgentCreateInputSchema>>;
+/** Live object-capability shape received from Cap'n Web. */
+export type AppAgentTransportHandle = {
+    /** Send one request to the Agent's session endpoint. */
+    fetch(request: Request): Promise<Response>;
+    /** Release the underlying object capability. */
+    close(): Promise<void>;
+    /** Synchronously release local resources, for `using` disposal. */
+    [Symbol.dispose](): void;
+};
+/** Capability handle for listing the Agents in a directory. */
+export type AppAgentListHandle = {
+    /** List the Agents visible to this App in the directory. */
+    list(): Promise<readonly AppAgent[]>;
+};
+/** Capability handle for creating a new Agent in a directory. */
+export type AppAgentCreateHandle = {
+    /** Create a new Agent with the given name and request id. */
+    create(input: AppAgentCreateInput): Promise<AppAgent>;
+};
+/**
+ * Live capability handle for listing and creating Agents in a Team or
+ * local-project directory, and opening transports to them.
+ */
+export type AppAgentDirectoryHandle = AppAgentListHandle & AppAgentCreateHandle & {
+    /** Open a transport to the Agent identified by `agentId`. */
+    open(input: {
+        agentId: string;
+    }): Promise<AppAgentTransportHandle>;
+    /** The member's inbox feed, limited to Agents this App may read. */
+    openInbox(): Promise<AppAgentTransportHandle>;
+};
+/** Capability to list the Agents visible to this App in read-only form. */
+export declare const agentList: CapabilityContract<AppAgentListHandle>;
+/** Capability to create new Agents and open transports to them. */
+export declare const agentManage: CapabilityContract<Pick<AppAgentDirectoryHandle, "create" | "open">>;
+/** Validates Agent rename input: the target Agent and its new display name. */
+export declare const appAgentRenameInputSchema: Schema.Struct<{
+    readonly agentId: Schema.String;
+    readonly name: Schema.String;
+}>;
+/**
+ * Input for renaming an existing Agent: its id and the owner's chosen
+ * replacement display name.
+ */
+export type AppAgentRenameInput = Readonly<Schema.Schema.Type<typeof appAgentRenameInputSchema>>;
+/** Capability handle for renaming an Agent the owner already created. */
+export type AppAgentRenameHandle = {
+    /** Rename an existing Agent and return its updated record. */
+    rename(input: AppAgentRenameInput): Promise<AppAgent>;
+};
+/** Owner-only capability to rename an existing Agent; not every host grants it. */
+export declare const agentRename: CapabilityContract<AppAgentRenameHandle>;
+/** Rename an Agent through the host-granted owner-only capability. */
+export declare function renameAppAgent(capabilities: CapabilityDirectory, input: AppAgentRenameInput): Promise<AppAgent>;
+/** One Agent's App-tool policy, as the owner-only policy capability reports it. */
+export declare const appAgentToolPolicyStatusSchema: z.ZodUnion<readonly [z.ZodObject<{
+    status: z.ZodLiteral<"pending">;
+    revision: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"approved">;
+    revision: z.ZodString;
+}, z.core.$strip>]>;
+/** Whether an Agent's App tools are still pending the owner's approval. */
+export type AppAgentToolPolicyStatus = z.infer<typeof appAgentToolPolicyStatusSchema>;
+/** The outcome of an owner's direct App-tool approval. */
+export declare const appAgentToolPolicyResultSchema: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+    status: z.ZodLiteral<"pending">;
+    revision: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"approved">;
+    revision: z.ZodString;
+}, z.core.$strip>]>, z.ZodObject<{
+    error: z.ZodString;
+}, z.core.$strip>]>;
+/** The outcome of an owner's direct App-tool approval. */
+export type AppAgentToolPolicyResult = z.infer<typeof appAgentToolPolicyResultSchema>;
+/** Capability handle for reading and approving an Agent's App-tool policy. */
+export type AppAgentToolPolicyHandle = {
+    /** This Agent's current policy status, or `null` for no such Agent. */
+    status(input: {
+        agentId: string;
+    }): Promise<AppAgentToolPolicyStatus | null>;
+    /** Approve (or re-request) this Agent's App tools under a CAS revision. */
+    approve(input: {
+        agentId: string;
+        level: "read" | "write";
+        expectedRevision: string | null;
+    }): Promise<AppAgentToolPolicyResult>;
+};
+/** Owner-only capability to read and approve an Agent's App-tool policy. */
+export declare const agentToolPolicy: CapabilityContract<AppAgentToolPolicyHandle>;
+/**
+ * Capability for read-only Agent sessions: open a transport to an
+ * existing Agent, or read the member's inbox feed.
+ */
+export declare const agentSessionRead: CapabilityContract<Pick<AppAgentDirectoryHandle, "open" | "openInbox">>;
+/**
+ * Capability for read-write Agent sessions: open a transport to an
+ * existing Agent and send to it, including the member's inbox feed.
+ */
+export declare const agentSessionWrite: CapabilityContract<Pick<AppAgentDirectoryHandle, "open" | "openInbox">>;
+/** List the Agents in the host-granted Team or local-project scope. */
+export declare function listAppAgents(capabilities: CapabilityDirectory): Promise<readonly AppAgent[]>;
+/** Create an Agent through the Team directory selected by the host. */
+export declare function createAppAgent(capabilities: CapabilityDirectory, input: AppAgentCreateInput): Promise<AppAgent>;
+/**
+ * A Fetch-based transport to one Agent's session endpoint, scoped to
+ * this App and safe to hand to an HTTP client adapter.
+ */
+export type AppAgentTransport = Readonly<{
+    /** Private location used only by Shiitake's existing HTTP client adapter. */
+    baseUrl: string;
+    /** Send a request to the Agent's session endpoint. */
+    fetch: typeof globalThis.fetch;
+    /** Close the transport and release the underlying Agent connection. */
+    close: () => Promise<void>;
+}>;
+/**
+ * Adapt one live object capability to Fetch without exposing the parent's
+ * authenticated URL or credentials to the isolated App.
+ */
+export declare function openAppAgent(capabilities: CapabilityDirectory, input: {
+    agentId: string;
+}): Promise<AppAgentTransport>;
+/**
+ * Open the member's inbox feed through the host. The Hub owns the feed and
+ * filters it to the Agents this App may read; the App never sees the URL.
+ */
+export declare function openAppInbox(capabilities: CapabilityDirectory): Promise<AppAgentTransport>;

package/dist/agents.js

@@ -0,0 +1,218 @@
+export { FungiAuthorSchema, FungiDelegationReplySchema, FungiMessageMetaSchema, messageAuthor, messageDelegationReply, authorMeta, } from "./agent-message-meta.js";
+import * as z from "zod";
+import { defineCapability } from "./capabilities.js";
+import { rpcDataSchema, rpcHandleSchema, rpcMethod, rpcFetchHandleSchema, } from "./internal/rpc-contract.js";
+import * as Schema from "effect/Schema";
+import { AppError } from "./errors.js";
+import { reportCatchFailure } from "./failure.js";
+const boundedIdentity = Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(256)));
+/**
+ * Validates the wire shape of an Agent record: its id, display name,
+ * and which session operations (read, send, manage) this App may
+ * perform on it.
+ */
+export const appAgentSchema = Schema.Struct({
+    agentId: boundedIdentity,
+    name: boundedIdentity,
+    sessionOperations: Schema.Array(Schema.Literals(["agent.read", "agent.send", "agent.manage"])),
+});
+/** The admitted AGENTS.list projection, containing only ids and display names. */
+export const appAgentListResultSchema = z.strictObject({
+    agents: z.array(z.strictObject({ agentId: z.string(), name: z.string() })),
+});
+/** Computer provisioning is a Team creation choice, separate from Home policy. */
+export const appAgentComputerSchema = Schema.Literals(["new", "none"]);
+/** Validates Agent creation input: a name, a caller-chosen request id and an
+ * optional Computer provisioning choice. */
+export const appAgentCreateInputSchema = Schema.Struct({
+    name: boundedIdentity,
+    requestId: boundedIdentity,
+    computer: Schema.optionalKey(appAgentComputerSchema),
+});
+const appAgentDirectorySchema = Schema.Array(appAgentSchema);
+const decodeAgents = Schema.decodeUnknownSync(appAgentDirectorySchema, {
+    onExcessProperty: "error",
+});
+const decodeAgentId = Schema.decodeUnknownSync(boundedIdentity);
+const decodeResponse = Schema.decodeUnknownSync(Schema.instanceOf(Response));
+/** Capability to list the Agents visible to this App in read-only form. */
+export const agentList = defineCapability("agent.list", 1, rpcHandleSchema({
+    list: rpcMethod(rpcDataSchema(z.unknown().transform((value) => decodeAgents(value)))),
+}));
+/** Capability to create new Agents and open transports to them. */
+export const agentManage = defineCapability("agent.manage", 1, rpcHandleSchema({
+    open: rpcMethod(rpcFetchHandleSchema),
+    create: rpcMethod(rpcDataSchema(z
+        .unknown()
+        .transform((value) => Schema.decodeUnknownSync(appAgentSchema)(value)))),
+}));
+/** Validates Agent rename input: the target Agent and its new display name. */
+export const appAgentRenameInputSchema = Schema.Struct({
+    agentId: boundedIdentity,
+    name: boundedIdentity,
+});
+/** Owner-only capability to rename an existing Agent; not every host grants it. */
+export const agentRename = defineCapability("agent.rename", 1, rpcHandleSchema({
+    rename: rpcMethod(rpcDataSchema(z
+        .unknown()
+        .transform((value) => Schema.decodeUnknownSync(appAgentSchema)(value)))),
+}));
+/** Rename an Agent through the host-granted owner-only capability. */
+export async function renameAppAgent(capabilities, input) {
+    const request = Schema.decodeUnknownSync(appAgentRenameInputSchema)(input);
+    const agent = await capabilities.require(agentRename).rename(request);
+    return Schema.decodeUnknownSync(appAgentSchema)(agent);
+}
+/** One Agent's App-tool policy, as the owner-only policy capability reports it. */
+export const appAgentToolPolicyStatusSchema = z.union([
+    z.object({ status: z.literal("pending"), revision: z.string() }),
+    z.object({ status: z.literal("approved"), revision: z.string() }),
+]);
+/** The outcome of an owner's direct App-tool approval. */
+export const appAgentToolPolicyResultSchema = z.union([
+    appAgentToolPolicyStatusSchema,
+    z.object({ error: z.string() }),
+]);
+/** Owner-only capability to read and approve an Agent's App-tool policy. */
+export const agentToolPolicy = defineCapability("agent.toolPolicy", 1, rpcHandleSchema({
+    status: rpcMethod(rpcDataSchema(z.union([appAgentToolPolicyStatusSchema, z.null()]))),
+    approve: rpcMethod(rpcDataSchema(appAgentToolPolicyResultSchema)),
+}));
+/**
+ * Capability for read-only Agent sessions: open a transport to an
+ * existing Agent, or read the member's inbox feed.
+ */
+export const agentSessionRead = defineCapability("agent.read", 1, rpcHandleSchema({
+    open: rpcMethod(rpcFetchHandleSchema),
+    openInbox: rpcMethod(rpcFetchHandleSchema),
+}));
+/**
+ * Capability for read-write Agent sessions: open a transport to an
+ * existing Agent and send to it, including the member's inbox feed.
+ */
+export const agentSessionWrite = defineCapability("agent.send", 1, rpcHandleSchema({
+    open: rpcMethod(rpcFetchHandleSchema),
+    openInbox: rpcMethod(rpcFetchHandleSchema),
+}));
+/** List the Agents in the host-granted Team or local-project scope. */
+export async function listAppAgents(capabilities) {
+    return decodeAgents(await capabilities.require(agentList).list());
+}
+/** Create an Agent through the Team directory selected by the host. */
+export async function createAppAgent(capabilities, input) {
+    const request = Schema.decodeUnknownSync(appAgentCreateInputSchema)(input);
+    const agent = await capabilities.require(agentManage).create(request);
+    return Schema.decodeUnknownSync(appAgentSchema)(agent);
+}
+/** Keep read and write handles separate while owning their shared connection lifetime. */
+async function openOperationHandles(openRead, openWrite) {
+    const read = await openRead();
+    let write;
+    let closing;
+    const ensureOpen = () => {
+        if (closing)
+            throw new AppError("The Agent connection is closed", {
+                code: "DISCONNECTED",
+                retryable: true,
+            });
+    };
+    const closeHandle = async (handle) => {
+        try {
+            await handle.close();
+        }
+        finally {
+            handle[Symbol.dispose]();
+        }
+    };
+    return {
+        fetch: async (request) => {
+            ensureOpen();
+            const handle = request.method === "GET" ||
+                request.method === "HEAD" ||
+                openRead === openWrite
+                ? read
+                : await (write ??= openWrite());
+            ensureOpen();
+            return decodeResponse(await handle.fetch(request));
+        },
+        close: () => {
+            if (!closing) {
+                closing = Promise.all([
+                    closeHandle(read),
+                    ...(write ? [write.then(closeHandle)] : []),
+                ]).then(() => undefined);
+                void closing.catch((cause) => {
+                    reportCatchFailure("agents.close", cause);
+                });
+            }
+            return closing;
+        },
+    };
+}
+const transportBaseUrl = "https://agent-session.fungi.invalid";
+/**
+ * Adapt one live object capability to Fetch without exposing the parent's
+ * authenticated URL or credentials to the isolated App.
+ */
+export async function openAppAgent(capabilities, input) {
+    const agentId = decodeAgentId(input.agentId);
+    // Shiitake uses this address as Session identity; reopening the same Agent
+    // must share a key without aliasing another Agent's identically named Session.
+    const agentPath = `/agents/id-${encodeURIComponent(agentId)}`;
+    const baseUrl = `${transportBaseUrl}${agentPath}`;
+    const directory = capabilities.has(agentSessionRead)
+        ? capabilities.require(agentSessionRead)
+        : capabilities.has(agentSessionWrite)
+            ? capabilities.require(agentSessionWrite)
+            : capabilities.require(agentManage);
+    const openRead = () => directory.open({ agentId });
+    const openWrite = capabilities.has(agentSessionRead)
+        ? () => (capabilities.has(agentSessionWrite)
+            ? capabilities.require(agentSessionWrite)
+            : capabilities.require(agentManage)).open({ agentId })
+        : openRead;
+    const handles = await openOperationHandles(openRead, openWrite);
+    const fetch = async (requestInput, init) => {
+        const request = new Request(requestInput, init);
+        const target = new URL(request.url);
+        if (target.origin !== transportBaseUrl ||
+            !target.pathname.startsWith(`${agentPath}/`))
+            throw new AppError("The Agent request target is invalid", {
+                code: "INVALID_ARGUMENT",
+                retryable: false,
+            });
+        // The capability already owns Agent selection. Preserve its ordinary
+        // /sessions and /acp routes while removing the local identity prefix.
+        target.pathname = target.pathname.slice(agentPath.length);
+        return handles.fetch(new Request(target, request));
+    };
+    return Object.freeze({ baseUrl, fetch, close: handles.close });
+}
+const inboxBaseUrl = `${transportBaseUrl}/member`;
+/**
+ * Open the member's inbox feed through the host. The Hub owns the feed and
+ * filters it to the Agents this App may read; the App never sees the URL.
+ */
+export async function openAppInbox(capabilities) {
+    const contract = capabilities.has(agentSessionRead)
+        ? agentSessionRead
+        : agentSessionWrite;
+    const openRead = () => capabilities.require(contract).openInbox();
+    const openWrite = capabilities.has(agentSessionRead)
+        ? () => capabilities.require(agentSessionWrite).openInbox()
+        : openRead;
+    const handles = await openOperationHandles(openRead, openWrite);
+    const fetch = async (requestInput, init) => {
+        const request = new Request(requestInput, init);
+        const target = new URL(request.url);
+        if (target.origin !== transportBaseUrl ||
+            !target.pathname.startsWith("/member/inbox"))
+            throw new AppError("The inbox request target is invalid", {
+                code: "INVALID_ARGUMENT",
+                retryable: false,
+            });
+        target.pathname = target.pathname.slice("/member".length);
+        return handles.fetch(new Request(target, request));
+    };
+    return Object.freeze({ baseUrl: inboxBaseUrl, fetch, close: handles.close });
+}

package/dist/app-build-contract.d.ts

@@ -0,0 +1,43 @@
+import * as z from "zod";
+/** Refusals emitted by the Team App build owner. */
+export declare const teamAppBuildFailureCodeSchema: z.ZodEnum<{
+    unavailable: "unavailable";
+    denied: "denied";
+    invalid: "invalid";
+    conflict: "conflict";
+    build_failed: "build_failed";
+}>;
+/** Pending, completed or failed reply from the App build owner. */
+export declare const appBuildReplySchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"pending">;
+    retryAfterMs: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    releaseId: z.ZodString;
+    previewUrl: z.ZodURL;
+}, z.core.$strict>, z.ZodObject<{
+    error: z.ZodEnum<{
+        unavailable: "unavailable";
+        denied: "denied";
+        invalid: "invalid";
+        conflict: "conflict";
+        build_failed: "build_failed";
+    }>;
+}, z.core.$strict>]>;
+/** Complete App build binding reply, including broker admission failures. */
+export declare const appBuildBrokerResultSchema: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"pending">;
+    retryAfterMs: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    releaseId: z.ZodString;
+    previewUrl: z.ZodURL;
+}, z.core.$strict>, z.ZodObject<{
+    error: z.ZodEnum<{
+        unavailable: "unavailable";
+        denied: "denied";
+        invalid: "invalid";
+        conflict: "conflict";
+        build_failed: "build_failed";
+    }>;
+}, z.core.$strict>]>, z.ZodObject<{
+    error: z.ZodString;
+}, z.core.$strict>]>;

package/dist/app-build-contract.js

@@ -0,0 +1,24 @@
+import * as z from "zod";
+import { pendingSchema } from "./pending.js";
+/** Refusals emitted by the Team App build owner. */
+export const teamAppBuildFailureCodeSchema = z.enum([
+    "invalid",
+    "denied",
+    "conflict",
+    "unavailable",
+    "build_failed",
+]);
+/** Pending, completed or failed reply from the App build owner. */
+export const appBuildReplySchema = z.union([
+    pendingSchema,
+    z.strictObject({
+        releaseId: z.string().min(1).max(256),
+        previewUrl: z.url(),
+    }),
+    z.strictObject({ error: teamAppBuildFailureCodeSchema }),
+]);
+/** Complete App build binding reply, including broker admission failures. */
+export const appBuildBrokerResultSchema = z.union([
+    appBuildReplySchema,
+    z.strictObject({ error: z.string() }),
+]);

package/dist/apps.d.ts

@@ -0,0 +1,66 @@
+import * as z from "zod";
+import type { WhistleJsonValue } from "@fungi.computer/whistle";
+import * as Schema from "effect/Schema";
+import type { CapabilityContract, CapabilityDirectory } from "./capabilities.js";
+/** A recipient App decides how to present this request; opening never sends it. */
+export declare const appIntentSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"compose">;
+    readonly text: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"navigate">;
+    readonly params: Schema.$Array<Schema.Struct<{
+        readonly key: Schema.String;
+        readonly value: Schema.String;
+    }>>;
+}>]>;
+export type AppIntent = Schema.Schema.Type<typeof appIntentSchema>;
+/** The navigate form of an App intent, whose params a role contract defines. */
+export type AppNavigateIntent = Extract<AppIntent, {
+    kind: "navigate";
+}>;
+export declare const appOpenInputSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly role: Schema.String;
+    readonly intent: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"compose">;
+        readonly text: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"navigate">;
+        readonly params: Schema.$Array<Schema.Struct<{
+            readonly key: Schema.String;
+            readonly value: Schema.String;
+        }>>;
+    }>]>;
+}>, Schema.Struct<{
+    readonly appId: Schema.String;
+    readonly intent: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"compose">;
+        readonly text: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"navigate">;
+        readonly params: Schema.$Array<Schema.Struct<{
+            readonly key: Schema.String;
+            readonly value: Schema.String;
+        }>>;
+    }>]>;
+}>]>;
+export type AppOpenInput = Schema.Schema.Type<typeof appOpenInputSchema>;
+/** The App the Team chose for a role, as the host's role routing resolves it; a null name is an unnamed App. */
+export declare const appRoleChoiceSchema: z.ZodNullable<z.ZodObject<{
+    displayName: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>>;
+export type AppRoleChoice = z.output<typeof appRoleChoiceSchema>;
+/**
+ * Open the Team's chosen App for a role with a bounded presentation intent.
+ * `role` answers which App that open would reach (null when none fills it),
+ * so a caller can name or hide its entry without hard-coding another App.
+ */
+export declare const appsOpen: CapabilityContract<{
+    open(input: AppOpenInput): Promise<void>;
+    role(role: string): Promise<AppRoleChoice>;
+}>;
+export declare const openApp: (directory: CapabilityDirectory, input: AppOpenInput) => Promise<void>;
+/** Call a declared method of another App as the signed-in member. Caller grants never travel. */
+export declare const appsCall: CapabilityContract<{
+    /** The input is JSON text, as with app.methods; the result is decoded owned JSON. */
+    call(appId: string, method: string, input: string): Promise<WhistleJsonValue>;
+}>;