@fungi.computer/agar 0.0.0-stage → 0.0.1

package/dist/apps.js

@@ -0,0 +1,47 @@
+import * as z from "zod";
+import { parseJsonValue } from "@fungi.computer/whistle/wire";
+import { defineCapability } from "./capabilities.js";
+import { rpcHandleSchema, rpcVoid, rpcMethod, rpcDataSchema, } from "./internal/rpc-contract.js";
+import * as Schema from "effect/Schema";
+/** A recipient App decides how to present this request; opening never sends it. */
+export const appIntentSchema = Schema.Union([
+    Schema.Struct({
+        kind: Schema.Literal("compose"),
+        text: Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(2_000))),
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("navigate"),
+        params: Schema.Array(Schema.Struct({
+            key: Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(64))),
+            value: Schema.String.pipe(Schema.check(Schema.isMaxLength(1_024))),
+        })).pipe(Schema.check(Schema.isMaxLength(16))),
+    }),
+]);
+export const appOpenInputSchema = Schema.Union([
+    Schema.Struct({
+        role: Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(80))),
+        intent: appIntentSchema,
+    }),
+    Schema.Struct({
+        appId: Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(128))),
+        intent: appIntentSchema,
+    }),
+], { mode: "oneOf" });
+/** The App the Team chose for a role, as the host's role routing resolves it; a null name is an unnamed App. */
+export const appRoleChoiceSchema = z
+    .strictObject({ displayName: z.string().min(1).max(80).nullable() })
+    .nullable();
+/**
+ * Open the Team's chosen App for a role with a bounded presentation intent.
+ * `role` answers which App that open would reach (null when none fills it),
+ * so a caller can name or hide its entry without hard-coding another App.
+ */
+export const appsOpen = defineCapability("apps.open", 1, rpcHandleSchema({
+    open: rpcVoid,
+    role: rpcMethod(rpcDataSchema(appRoleChoiceSchema)),
+}));
+export const openApp = (directory, input) => directory.require(appsOpen).open(input);
+/** Call a declared method of another App as the signed-in member. Caller grants never travel. */
+export const appsCall = defineCapability("apps.call", 1, rpcHandleSchema({
+    call: rpcMethod(rpcDataSchema(z.unknown().transform((value) => parseJsonValue(value)))),
+}));

package/dist/backend-declaration.d.ts

@@ -0,0 +1,6 @@
+import type { AppApi, AppDeclaration } from "@fungi.computer/puffball";
+import type { AppBackendDefinition } from "./backend-definition.js";
+/** Build-only API projection from the schemas used by runtime calls. */
+export declare function buildAppApi<Context>(backend: Pick<AppBackendDefinition<Context>, "methods" | "events" | "toolFamily">): AppApi;
+/** Strict build-only declaration generation; Workers never import this module. */
+export declare function buildAppDeclaration<Context>(backend: Pick<AppBackendDefinition<Context>, "methods" | "events" | "gills" | "sync" | "toolFamily">, declaration: unknown): AppDeclaration;

package/dist/backend-declaration.js

@@ -0,0 +1,65 @@
+import * as z from "zod";
+import * as Schema from "effect/Schema";
+import { appApiSchema, appDeclarationSchema, } from "@fungi.computer/puffball/app";
+/** Build-only API projection from the schemas used by runtime calls. */
+export function buildAppApi(backend) {
+    let api = {
+        methods: Object.fromEntries(Object.entries(backend.methods).map(([name, method]) => [
+            name,
+            {
+                ...method.policy,
+                input: z.toJSONSchema(method.input, { io: "input" }),
+                output: z.toJSONSchema(method.output, { io: "output" }),
+            },
+        ])),
+    };
+    if (backend.events !== undefined)
+        api = {
+            ...api,
+            events: Object.fromEntries(Object.entries(backend.events).map(([name, event]) => [
+                name,
+                {
+                    description: event.description,
+                    payload: z.toJSONSchema(event.payload, { io: "output" }),
+                },
+            ])),
+        };
+    if (backend.toolFamily !== undefined)
+        api = { ...api, toolFamily: backend.toolFamily };
+    return Schema.decodeUnknownSync(appApiSchema)(api);
+}
+/** Strict build-only declaration generation; Workers never import this module. */
+export function buildAppDeclaration(backend, declaration) {
+    const metadata = Schema.decodeUnknownSync(appDeclarationSchema)(declaration);
+    if (metadata.gills !== undefined)
+        throw new Error("App Gills must be generated from the backend, not a second catalog");
+    if (metadata.backend?.sync !== undefined)
+        throw new Error("App sync continuation must be generated from the backend");
+    const methods = new Map(Object.entries(backend.methods));
+    for (const view of backend.gills ?? []) {
+        const method = methods.get(view.declaration.source);
+        if (method?.policy.effect !== "read")
+            throw new Error(`App Gill source must be a declared read method: ${view.declaration.source}`);
+        for (const param of view.declaration.params ?? []) {
+            if (param.options !== undefined &&
+                methods.get(param.options)?.policy.effect !== "read")
+                throw new Error(`Gill options source must be a declared read method: ${param.options}`);
+        }
+    }
+    let generated = { ...metadata, api: buildAppApi(backend) };
+    if (backend.sync !== undefined)
+        generated = {
+            ...generated,
+            backend: {
+                ...metadata.backend,
+                bindings: metadata.backend?.bindings ?? [],
+                sync: backend.sync,
+            },
+        };
+    if (backend.gills !== undefined)
+        generated = {
+            ...generated,
+            gills: backend.gills.map((view) => view.declaration),
+        };
+    return Schema.decodeUnknownSync(appDeclarationSchema)(generated);
+}

package/dist/backend-definition.d.ts

@@ -0,0 +1,88 @@
+import * as z from "zod";
+import type { GillCall, GillReply } from "@fungi.computer/gills";
+import type { AppBackendGill } from "./gills.js";
+export type { AppBackendGill } from "./gills.js";
+import { type AppMethodCallContext } from "@fungi.computer/puffball/app-method-runtime";
+import type { AppApi, AppCapabilityId } from "@fungi.computer/puffball";
+import type { WhistleJsonValue } from "@fungi.computer/whistle";
+import { type Pending } from "./pending.js";
+export { pending, pendingSchema, type Pending } from "./pending.js";
+/** EVENTS.emit acknowledges delivery with native void, not a JSON value. */
+export declare const appEventEmitResultSchema: z.ZodUndefined;
+/** App-originated Session send refusal; retry advice is a duration, not a timestamp. */
+export declare const appSendBudgetRefusalSchema: z.ZodObject<{
+    error: z.ZodLiteral<"send_budget_exceeded">;
+    retryAfterMs: z.ZodNumber;
+}, z.core.$strict>;
+/** A declined Session send, with how long to wait before retrying. */
+export type AppSendBudgetRefusal = z.output<typeof appSendBudgetRefusalSchema>;
+/** A method's schemas own both its TypeScript contract and JSON boundary. */
+export type MethodPolicy = Readonly<{
+    description: string;
+    effect: "read" | "write" | "external";
+    requires: readonly AppCapabilityId[];
+    /** Omit this method from Workflow and tool discovery; direct calls keep their validators. */
+    hidden?: true;
+    /** Request anonymous read admission; hosts still require explicit installer approval. */
+    anonymous?: true;
+    /** Allow the shared Pending result while this method is still working. */
+    pending?: true;
+}>;
+/** Prepared method export consumed by the backend and its build. */
+export type AppBackendMethod<Context = void> = Readonly<{
+    policy: MethodPolicy;
+    input: z.ZodType;
+    output: z.ZodType;
+    /** Parse the raw input, run the handler, and return its JSON result. */
+    call: (input: WhistleJsonValue, context: Context, caller: AppMethodCallContext) => Promise<WhistleJsonValue>;
+}>;
+/** Define a typed method once; neither discovery nor builds execute its handler. */
+export declare function defineAppMethod<I extends z.ZodType, O extends z.ZodType, Context = void>(method: MethodPolicy & {
+    input: I;
+    output: O;
+} & ({
+    pending: true;
+    handler: (input: z.output<I>, context: Context, caller: AppMethodCallContext) => z.input<O> | Pending | Promise<z.input<O> | Pending>;
+} | {
+    pending?: undefined;
+    handler: (input: z.output<I>, context: Context, caller: AppMethodCallContext) => z.input<O> | Promise<z.input<O>>;
+})): AppBackendMethod<Context>;
+/** Typed backend export shared by a build and its runtime method admission. */
+export type AppBackendClass = (abstract new (...args: never[]) => object) & {
+    prototype: object;
+};
+/** A backend's full generated API: its declared methods, the facet
+ * installer, and runtime dispatch by method name. */
+export type AppBackendDefinition<Context = void> = Readonly<{
+    methods: Readonly<Record<string, AppBackendMethod<Context>>>;
+    /** Declared ordinary write method re-admitted for member background work. */
+    sync?: Readonly<{
+        method: string;
+    }>;
+    /** Generated, digest-covered views of declared read methods. */
+    gills?: readonly AppBackendGill[];
+    /** Run a declared projection through its source method. */
+    gill: (input: GillCall, context: Context, caller: AppMethodCallContext) => Promise<GillReply>;
+    /** Signed discovery metadata; listing never grants authority to execute. */
+    toolFamily?: AppApi["toolFamily"];
+    /** Event schemas are projected into the Release for host-side emit validation. */
+    events?: Readonly<Record<string, Readonly<{
+        description: string;
+        payload: z.ZodType;
+    }>>>;
+    /** Install declared methods on the facet, retaining its exact constructor
+     * type. Each installed method answers with an {@link AppMethodReply}. */
+    implement: <C extends AppBackendClass>(implementation: C) => C;
+    /** Look up a declared method by name and run its `call`, rejecting any
+     * name that was not declared. A handler's {@link AppMethodRefusal} is
+     * thrown to the caller unchanged. */
+    call: (method: string, input: WhistleJsonValue, context: Context, caller: AppMethodCallContext) => Promise<WhistleJsonValue>;
+}>;
+/** Generate the API from the method exports; callers cannot supply a second catalog. */
+export declare function defineAppBackend<Context = void>(options: Readonly<{
+    methods: Readonly<Record<string, AppBackendMethod<Context>>>;
+    events?: AppBackendDefinition<Context>["events"];
+    gills?: readonly AppBackendGill[];
+    sync?: AppBackendDefinition<Context>["sync"];
+    toolFamily?: AppBackendDefinition<Context>["toolFamily"];
+}>): AppBackendDefinition<Context>;

package/dist/backend-definition.js

@@ -0,0 +1,158 @@
+import * as z from "zod";
+import { backgroundSyncAllowed, parseAppMethodCallContext, isAppApiMethodName, appApiReservedMethodNames, } from "@fungi.computer/puffball/app-method-runtime";
+import { pendingSchema } from "./pending.js";
+import { AppMethodRefusal, appMethodRefusedReplySchema, } from "./method-refusal.js";
+export { pending, pendingSchema } from "./pending.js";
+/** EVENTS.emit acknowledges delivery with native void, not a JSON value. */
+export const appEventEmitResultSchema = z.undefined();
+/** App-originated Session send refusal; retry advice is a duration, not a timestamp. */
+export const appSendBudgetRefusalSchema = z.strictObject({
+    error: z.literal("send_budget_exceeded"),
+    retryAfterMs: z.number().int().min(1).max(60_000),
+});
+/** Define a typed method once; neither discovery nor builds execute its handler. */
+export function defineAppMethod(method) {
+    const output = method.pending === true
+        ? z.union([method.output, pendingSchema])
+        : method.output;
+    let policy = {
+        description: method.description,
+        effect: method.effect,
+        requires: Object.freeze([...method.requires]),
+    };
+    if (method.pending === true)
+        policy = { ...policy, pending: true };
+    if (method.hidden === true)
+        policy = { ...policy, hidden: true };
+    if (method.anonymous === true)
+        policy = { ...policy, anonymous: true };
+    return Object.freeze({
+        policy: Object.freeze(policy),
+        input: method.input,
+        output,
+        call: async (rawInput, context, rawCaller) => {
+            const caller = parseAppMethodCallContext(rawCaller);
+            const parsed = method.input.parse(rawInput);
+            const result = await method.handler(parsed, context, caller);
+            return z.json().parse(output.parse(result));
+        },
+    });
+}
+/** The generated method RPC answers with a typed reply: a handler's
+ * {@link AppMethodRefusal} crosses as a refusal, never as an execution failure. */
+async function methodReply(run) {
+    try {
+        return { kind: "ok", value: await run() };
+    }
+    catch (error) {
+        if (!(error instanceof AppMethodRefusal))
+            throw error;
+        return appMethodRefusedReplySchema.parse({
+            kind: "refused",
+            code: error.code,
+            message: error.message,
+        });
+    }
+}
+/** Generate the API from the method exports; callers cannot supply a second catalog. */
+export function defineAppBackend(options) {
+    const methods = new Map(Object.entries(options.methods));
+    for (const name of methods.keys())
+        if (!isAppApiMethodName(name))
+            throw new Error(`Invalid App backend method name: ${name}`);
+    if (!backgroundSyncAllowed({
+        methods: Object.fromEntries([...methods].map(([name, method]) => [name, method.policy])),
+    }, options.sync))
+        throw new Error("Background continuation must be a declared write covering all write requirements");
+    const call = async (name, input, context, caller) => {
+        const method = methods.get(name);
+        if (!method)
+            throw new Error(`Undeclared App backend method: ${name}`);
+        return method.call(input, context, caller);
+    };
+    const gills = new Map();
+    for (const view of options.gills ?? []) {
+        if (gills.has(view.declaration.id))
+            throw new Error(`Duplicate App Gill: ${view.declaration.id}`);
+        gills.set(view.declaration.id, view);
+    }
+    const gill = async (raw, context, caller) => {
+        const first = options.gills?.[0];
+        if (first === undefined)
+            throw new Error("Undeclared App Gill");
+        const selection = first.parseCall(raw);
+        const view = gills.get(selection.id);
+        if (!view)
+            throw new Error(`Undeclared App Gill: ${selection.id}`);
+        const method = methods.get(view.declaration.source);
+        if (method?.policy.effect !== "read")
+            throw new Error(`App Gill source must be a declared read method: ${view.declaration.source}`);
+        return view.call(selection, async (name, input, kind) => {
+            const source = methods.get(name);
+            if (source?.policy.effect !== "read")
+                throw new Error(kind === "options"
+                    ? "Gill options source must be a declared read method"
+                    : `App Gill source must be a declared read method: ${name}`);
+            return source.call(input, context, caller);
+        });
+    };
+    let definition = {
+        methods: Object.freeze({ ...options.methods }),
+        implement: (implementation) => {
+            const members = new Map();
+            let prototype = implementation.prototype;
+            while (prototype !== null && prototype !== Object.prototype) {
+                for (const [name, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(prototype))) {
+                    if (!members.has(name))
+                        members.set(name, descriptor);
+                }
+                prototype = Reflect.getPrototypeOf(prototype);
+            }
+            const allowed = new Set([
+                ...appApiReservedMethodNames.intrinsic,
+                ...appApiReservedMethodNames.lifecycle,
+            ]);
+            for (const [name, descriptor] of members) {
+                if (descriptor.get !== undefined || descriptor.set !== undefined)
+                    throw new Error(`App backend accessor unavailable: ${name}`);
+                if (methods.has(name))
+                    throw new Error(`App backend method must be generated: ${name}`);
+                if (allowed.has(name) &&
+                    (name === "constructor" ||
+                        z.function().safeParse(descriptor.value).success))
+                    continue;
+                throw new Error(`Undeclared App backend method: ${name}`);
+            }
+            for (const name of methods.keys())
+                Object.defineProperty(implementation.prototype, name, {
+                    value: function (input, caller) {
+                        return methodReply(() => definition.call(name, input, this, caller));
+                    },
+                });
+            if (gills.size > 0)
+                Object.defineProperty(implementation.prototype, "gill", {
+                    value: function (input, caller) {
+                        return definition.gill(input, this, caller);
+                    },
+                });
+            return implementation;
+        },
+        call,
+        gill,
+    };
+    if (options.sync !== undefined)
+        definition = { ...definition, sync: Object.freeze({ ...options.sync }) };
+    if (options.gills !== undefined)
+        definition = { ...definition, gills: Object.freeze([...options.gills]) };
+    if (options.events !== undefined)
+        definition = {
+            ...definition,
+            events: Object.freeze({ ...options.events }),
+        };
+    if (options.toolFamily !== undefined)
+        definition = {
+            ...definition,
+            toolFamily: Object.freeze({ ...options.toolFamily }),
+        };
+    return Object.freeze(definition);
+}

package/dist/backend-refusal.d.ts

@@ -0,0 +1,10 @@
+import * as z from "zod";
+/** Closed host refusal vocabulary. Private backend messages never reach callers. */
+export declare const appBackendRefusalSchema: z.ZodObject<{
+    error: z.ZodLiteral<"App execution unavailable">;
+    reason: z.ZodEnum<{
+        exec_isolation_required: "exec_isolation_required";
+        execution_not_admitted: "execution_not_admitted";
+        artifact_unavailable: "artifact_unavailable";
+    }>;
+}, z.core.$strict>;

package/dist/backend-refusal.js

@@ -0,0 +1,10 @@
+import * as z from "zod";
+/** Closed host refusal vocabulary. Private backend messages never reach callers. */
+export const appBackendRefusalSchema = z.strictObject({
+    error: z.literal("App execution unavailable"),
+    reason: z.enum([
+        "exec_isolation_required",
+        "execution_not_admitted",
+        "artifact_unavailable",
+    ]),
+});

package/dist/backend.d.ts

@@ -0,0 +1,30 @@
+import type { CapabilityContract } from "./capabilities.js";
+import type { WhistleJsonValue } from "@fungi.computer/whistle";
+/** Invoke this App's admitted backend. The App defines its JSON request/result. */
+export declare const appBackend: CapabilityContract<{
+    /** Send one JSON-encoded request to this App's admitted backend and
+     * resolve with its decoded JSON result; the App's own backend defines
+     * what `input` must contain. */
+    request(input: string): Promise<WhistleJsonValue>;
+}>;
+/**
+ * Call one of this App's declared, typed methods through its host. Unlike
+ * `appBackend`, the host knows which method is called, so it can apply the
+ * method's declared effect (for example, allow only `read` methods to a
+ * visitor of a public App).
+ */
+export declare const appMethods: CapabilityContract<{
+    /** Call the named method with JSON-encoded `input`; resolves with its JSON result. */
+    call(method: string, input: string): Promise<WhistleJsonValue>;
+}>;
+/** The admitting host overwrites this header from its authenticated principal.
+ * App request bodies and incoming browser headers never supply this identity. */
+export declare const appBackendActorHeader = "X-Agar-Actor-Id";
+/** The admitting host overwrites this header with the Computer it has
+ * verified the caller is admitted to use for this invocation, or omits it
+ * when no Computer is bound to the call. App request bodies and incoming
+ * browser headers never supply this identity: a backend that needs a
+ * Computer scope must read it from here, never from its own request body. */
+export declare const appBackendComputerHeader = "X-Agar-Computer-Id";
+export { appBackendRefusalSchema } from "./backend-refusal.js";
+export { AppMethodRefusal, appMethodRefusalCodes, appMethodRefusalStatus, appMethodRefusedReplySchema, appMethodReplySchema, maxAppMethodRefusalMessage, type AppMethodRefusalCode, type AppMethodRefusedReply, type AppMethodReply, } from "./method-refusal.js";

package/dist/backend.js

@@ -0,0 +1,28 @@
+import * as z from "zod";
+import { defineCapability } from "./capabilities.js";
+import { parseJsonValue } from "@fungi.computer/whistle/wire";
+import { rpcDataSchema, rpcHandleSchema, rpcMethod, } from "./internal/rpc-contract.js";
+/** Invoke this App's admitted backend. The App defines its JSON request/result. */
+export const appBackend = defineCapability("app.backend", 1, rpcHandleSchema({
+    request: rpcMethod(rpcDataSchema(z.unknown().transform((value) => parseJsonValue(value)))),
+}));
+/**
+ * Call one of this App's declared, typed methods through its host. Unlike
+ * `appBackend`, the host knows which method is called, so it can apply the
+ * method's declared effect (for example, allow only `read` methods to a
+ * visitor of a public App).
+ */
+export const appMethods = defineCapability("app.methods", 1, rpcHandleSchema({
+    call: rpcMethod(rpcDataSchema(z.unknown().transform((value) => parseJsonValue(value)))),
+}));
+/** The admitting host overwrites this header from its authenticated principal.
+ * App request bodies and incoming browser headers never supply this identity. */
+export const appBackendActorHeader = "X-Agar-Actor-Id";
+/** The admitting host overwrites this header with the Computer it has
+ * verified the caller is admitted to use for this invocation, or omits it
+ * when no Computer is bound to the call. App request bodies and incoming
+ * browser headers never supply this identity: a backend that needs a
+ * Computer scope must read it from here, never from its own request body. */
+export const appBackendComputerHeader = "X-Agar-Computer-Id";
+export { appBackendRefusalSchema } from "./backend-refusal.js";
+export { AppMethodRefusal, appMethodRefusalCodes, appMethodRefusalStatus, appMethodRefusedReplySchema, appMethodReplySchema, maxAppMethodRefusalMessage, } from "./method-refusal.js";

package/dist/capabilities.d.ts

@@ -0,0 +1,30 @@
+import * as z from "zod";
+import type { Disposer } from "./store.js";
+/** A capability owner's frozen, typed descriptor. Descriptor identity is not authority. */
+export type CapabilityContract<T> = {
+    readonly id: string;
+    readonly version: number;
+    readonly schema: z.ZodType<T>;
+};
+/** Define a capability with the owner's decoder for its live RPC interface. */
+export declare function defineCapability<T>(id: string, version: number, schema: z.ZodType<T>): CapabilityContract<T>;
+/** The App's read-only view of its currently admitted capabilities. */
+export type CapabilityDirectory = {
+    /** Changes after a successful grant replacement or disconnection. */
+    readonly version: number;
+    /** Read the current directory after a change. Does not emit on subscribe. */
+    subscribe(listener: () => void): Disposer;
+    /** Whether an implementation for this contract is currently admitted. */
+    has(contract: CapabilityContract<unknown>): boolean;
+    /** The admitted implementation for this contract, or throw a
+     * `CAPABILITY_DENIED` AppError when none is granted. */
+    require<T>(contract: CapabilityContract<T>): T;
+};
+/** Local capabilities admitted through their owner's typed contract. */
+export type CapabilityRegistry = CapabilityDirectory & {
+    /** Admit an implementation for this contract, replacing any previous one
+     * and bumping `version` so subscribers can react. */
+    provide: <T>(contract: CapabilityContract<T>, implementation: NoInfer<T>) => void;
+};
+/** Register typed local implementations without reopening their erased types. */
+export declare function createCapabilityRegistry(): CapabilityRegistry;

package/dist/capabilities.js

@@ -0,0 +1,50 @@
+import * as Context from "effect/Context";
+import * as Option from "effect/Option";
+import * as z from "zod";
+import { AppError } from "./errors.js";
+import { createReadonlyStore } from "./internal/store.js";
+class DefinedCapability {
+    id;
+    version;
+    #schema;
+    constructor(id, version, schema) {
+        this.id = id;
+        this.version = version;
+        this.#schema = schema;
+        Object.freeze(this);
+    }
+    // Only id/version travel with a wire grant; the parser stays with its owner.
+    get schema() {
+        return this.#schema;
+    }
+}
+/** Define a capability with the owner's decoder for its live RPC interface. */
+export function defineCapability(id, version, schema) {
+    return new DefinedCapability(id, version, schema);
+}
+/** Register typed local implementations without reopening their erased types. */
+export function createCapabilityRegistry() {
+    let services = Context.empty();
+    const version = createReadonlyStore(0);
+    const key = (contract) => Context.Service(`${contract.id}@${String(contract.version)}`);
+    return {
+        get version() {
+            return version.get();
+        },
+        subscribe: (listener) => version.subscribe(listener),
+        provide: (contract, implementation) => {
+            services = Context.add(services, key(contract), implementation);
+            version.update(version.get() + 1);
+        },
+        has: (contract) => Option.isSome(Context.getOption(services, key(contract))),
+        require(contract) {
+            const implementation = Context.getOption(services, key(contract));
+            if (Option.isSome(implementation))
+                return implementation.value;
+            throw new AppError("The capability is not granted", {
+                code: "CAPABILITY_DENIED",
+                retryable: false,
+            });
+        },
+    };
+}