@fungi.computer/braid 0.0.1 → 0.2.0

package/dist/runtime/git-pass-contract.js

@@ -2,8 +2,32 @@ import { z } from "zod";
 import { workflowAttestationSchema } from "@fungi.computer/puffball/app-method-runtime";
 import { gitAccessScope, resolvedGitAccessSchema } from "../git-access.js";
 const id = z.string().min(1).max(256);
+/** One credential grammar for both hosts; the owner is public, the token is not. */
+export const workflowGitPassPrefix = "wgp.";
+export const workflowGitPassTokenSchema = z
+    .string()
+    .regex(/^wgp\.([a-zA-Z0-9_-]{1,256})\.([0-9a-f]{64})$/u)
+    .transform((bearer) => {
+    const [, ownerId = "", token = ""] = bearer.split(".");
+    return { ownerId, token };
+});
+/** Format the existing standalone bearer shape, never a credential-bearing URL. */
+export function formatWorkflowGitPassToken(ownerId, token) {
+    const bearer = `${workflowGitPassPrefix}${ownerId}.${token}`;
+    workflowGitPassTokenSchema.parse(bearer);
+    return bearer;
+}
+/** Git reads this command-local config without writing a credential or repository config. */
+export function workflowGitExecutionEnvironment(credential) {
+    return {
+        FUNGI_GIT_REMOTE: credential.remote,
+        GIT_CONFIG_COUNT: "1",
+        GIT_CONFIG_KEY_0: `http.${credential.remote}.extraHeader`,
+        GIT_CONFIG_VALUE_0: `Authorization: Bearer ${credential.bearer}`,
+    };
+}
 /** Non-secret Team-issued authority for one stored Workflow step on its pinned Computer. */
-export const workflowGitPassGrantSchema = z
+export const workflowGitPassGrantSchema = z.lazy(() => z
     .strictObject({
     teamId: id,
     computerId: id,
@@ -17,7 +41,7 @@ export const workflowGitPassGrantSchema = z
     gitAccess: resolvedGitAccessSchema,
     triggerId: id.optional(),
 })
-    .refine((grant) => grant.scope === gitAccessScope(grant.gitAccess), "A pass's scope is its admitted Git access");
+    .refine((grant) => grant.scope === gitAccessScope(grant.gitAccess), "A pass's scope is its admitted Git access"));
 /** Run cleanup remains valid after the Computer's product data is erased. */
 export const workflowGitPassRevocationSchema = z.strictObject({
     teamId: id,

package/dist/runtime/git-pass-store.d.ts

@@ -1,32 +1,35 @@
 import { type RepositoryRef } from "@fungi.computer/agar/git";
 import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
-import { type WorkflowGitPassGrant } from "./git-pass-contract.js";
-/** Scoped pass state shared by both Computer hosts; credentials never enter the grant. */
+import { type WorkflowGitCredential, type WorkflowGitPassGrant } from "./git-pass-contract.js";
+/** One fresh credential per newly admitted native invocation; only its digest is durable. */
 export declare function createWorkflowGitPassStore(options: Readonly<{
     sql: WatchdogSqliteOwner["sql"];
     transactionSync: <T>(body: () => T) => T;
     ownerId(): string | null;
     computerId(): string | undefined;
-    mintPassId(): string;
-    remote(passId: string, repository: RepositoryRef): string;
+    mintToken?: () => string;
+    remote(repository: RepositoryRef): string;
     denied(): Error;
     now?: () => number;
 }>): Readonly<{
-    openWorkflowPass(raw: WorkflowGitPassGrant): {
-        passId: string;
-        remote: string;
-        expiresAt: number;
-        bearer?: string;
-    };
+    /** Only the NEW native-admission path calls this; replay never obtains another secret. */
+    issue(rawInvocationId: string, rawGrant: WorkflowGitPassGrant): Promise<WorkflowGitCredential>;
+    /** A live native replay can extend its existing lease, never issue or resurrect it. */
+    renew(rawInvocationId: string, rawGrant: WorkflowGitPassGrant): void;
+    /** Keep the public receipt so a delayed issuer cannot reopen the same invocation. */
+    close(rawInvocationId: string, rawGrant: WorkflowGitPassGrant): void;
     /** Retain a tombstone so a delayed mint cannot resurrect a terminal run. */
     revokeWorkflowRunGitPasses(input: {
         teamId: string;
         runId: string;
     }): void;
-    /** Re-admit the stored scope for every Git request; an expired pass grants nothing. */
+    /** Every request also needs the host's live native-invocation and domain admission. */
     admit(input: {
-        passId: string;
+        bearer: string;
         repository: RepositoryRef;
         scope: "read" | "write";
-    }): WorkflowGitPassGrant | null;
+    }): Promise<{
+        invocationId: string;
+        grant: WorkflowGitPassGrant;
+    } | null>;
 }>;

package/dist/runtime/git-pass-store.js

@@ -1,55 +1,124 @@
 import { repositoryRefsEqual, } from "@fungi.computer/agar/git";
-import { workflowGitPassResultSchema } from "@fungi.computer/agar/computer-contracts";
 import { z } from "zod";
-import { workflowGitPassGrantSchema, workflowGitPassRevocationSchema, } from "./git-pass-contract.js";
-/** Scoped pass state shared by both Computer hosts; credentials never enter the grant. */
+import { canonicalJson } from "../index.js";
+import { formatWorkflowGitPassToken, workflowGitPassTokenSchema, workflowGitPassGrantSchema, workflowGitPassRevocationSchema, } from "./git-pass-contract.js";
+const invocationIdSchema = z.string().min(1).max(256);
+const tokenSchema = z.string().regex(/^[0-9a-f]{64}$/u);
+const leaseSchema = z.strictObject({
+    invocation_id: invocationIdSchema,
+    run_id: z.string(),
+    grant_json: z.string(),
+    token_digest: z.string().nullable(),
+    expires_at: z.number().int(),
+    state: z.enum(["open", "closed"]),
+});
+const remoteSchema = z
+    .url({ protocol: /^https$/, abort: true })
+    .refine((value) => {
+    const url = new URL(value);
+    return url.username === "" && url.password === "";
+}, "Workflow Git remotes must not contain credentials");
+function mintToken() {
+    return Array.from(crypto.getRandomValues(new Uint8Array(32)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** A verifier digest, never a native invocation identity or replay hash. */
+async function tokenDigest(token) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** Optional internal fields use JSON's omission semantics at the storage boundary. */
+function serializeGrant(grant) {
+    return canonicalJson(z.json().parse(JSON.parse(JSON.stringify(grant))));
+}
+/** One fresh credential per newly admitted native invocation; only its digest is durable. */
 export function createWorkflowGitPassStore(options) {
     const { sql } = options;
     const now = options.now ?? Date.now;
-    sql.exec(`CREATE TABLE IF NOT EXISTS computer_workflow_git_passes (
-    pass_id TEXT PRIMARY KEY, node_key TEXT NOT NULL UNIQUE, run_id TEXT NOT NULL,
-    grant_json TEXT NOT NULL, expires_at INTEGER NOT NULL
+    // Pre-release reusable, plaintext pass state is disposable, not another reader.
+    sql.exec("DROP TABLE IF EXISTS computer_workflow_git_passes");
+    sql.exec(`CREATE TABLE IF NOT EXISTS computer_workflow_git_invocations (
+    invocation_id TEXT PRIMARY KEY, run_id TEXT NOT NULL,
+    grant_json TEXT NOT NULL, token_digest TEXT UNIQUE,
+    expires_at INTEGER NOT NULL,
+    state TEXT NOT NULL CHECK (state IN ('open', 'closed'))
   ) STRICT`);
     sql.exec(`CREATE TABLE IF NOT EXISTS computer_workflow_git_ended_runs (run_id TEXT PRIMARY KEY) STRICT`);
+    function admittedGrant(raw) {
+        const grant = workflowGitPassGrantSchema.parse(raw);
+        if (grant.teamId !== options.ownerId() ||
+            grant.computerId !== options.computerId() ||
+            grant.workflow.runId !== grant.runId ||
+            grant.workflow.nodeId !== grant.nodeId ||
+            grant.workflow.armedBy.kind !== "member" ||
+            grant.workflow.armedBy.memberId !== grant.memberId)
+            throw options.denied();
+        return grant;
+    }
+    function ended(runId) {
+        return (sql
+            .exec("SELECT 1 FROM computer_workflow_git_ended_runs WHERE run_id=?", runId)
+            .toArray().length !== 0);
+    }
+    function read(invocationId) {
+        const row = sql
+            .exec("SELECT * FROM computer_workflow_git_invocations WHERE invocation_id=?", invocationId)
+            .toArray()[0];
+        return row === undefined ? undefined : leaseSchema.parse(row);
+    }
     return Object.freeze({
-        openWorkflowPass(raw) {
-            const grant = workflowGitPassGrantSchema.parse(raw);
-            if (grant.teamId !== options.ownerId() ||
-                grant.computerId !== options.computerId() ||
-                grant.workflow.runId !== grant.runId ||
-                grant.workflow.nodeId !== grant.nodeId ||
-                grant.workflow.armedBy.kind !== "member" ||
-                grant.workflow.armedBy.memberId !== grant.memberId)
+        /** Only the NEW native-admission path calls this; replay never obtains another secret. */
+        async issue(rawInvocationId, rawGrant) {
+            const invocationId = invocationIdSchema.parse(rawInvocationId);
+            const grant = admittedGrant(rawGrant);
+            if (ended(grant.runId) || read(invocationId) !== undefined)
                 throw options.denied();
+            const remote = remoteSchema.parse(options.remote(grant.gitAccess.repository));
+            const token = tokenSchema.parse((options.mintToken ?? mintToken)());
+            const bearer = formatWorkflowGitPassToken(grant.teamId, token);
+            const digest = await tokenDigest(token);
             return options.transactionSync(() => {
-                if (sql
-                    .exec("SELECT 1 FROM computer_workflow_git_ended_runs WHERE run_id=?", grant.runId)
-                    .toArray().length > 0)
-                    throw options.denied();
-                const key = JSON.stringify([
-                    grant.runId,
-                    grant.graphId ?? null,
-                    grant.nodeId,
-                    grant.iteration,
-                    grant.scope,
-                ]);
-                const row = sql
-                    .exec("SELECT pass_id,grant_json,expires_at FROM computer_workflow_git_passes WHERE node_key=?", key)
-                    .toArray()[0];
-                if (row !== undefined &&
-                    z.string().parse(row.grant_json) !== JSON.stringify(grant))
+                // The digest await can race a terminal revocation or another issuer.
+                admittedGrant(grant);
+                if (ended(grant.runId) || read(invocationId) !== undefined)
                     throw options.denied();
-                const passId = row === undefined
-                    ? options.mintPassId()
-                    : z.string().parse(row.pass_id);
                 const expiresAt = now() + 60_000;
-                sql.exec(`INSERT INTO computer_workflow_git_passes VALUES(?,?,?,?,?)
-          ON CONFLICT(node_key) DO UPDATE SET expires_at=excluded.expires_at`, passId, key, grant.runId, JSON.stringify(grant), expiresAt);
-                return workflowGitPassResultSchema.parse({
-                    passId,
-                    expiresAt,
-                    remote: options.remote(passId, grant.gitAccess.repository),
-                });
+                sql.exec("INSERT INTO computer_workflow_git_invocations VALUES(?,?,?,?,?,'open')", invocationId, grant.runId, serializeGrant(grant), digest, expiresAt);
+                return { bearer, remote, expiresAt };
+            });
+        },
+        /** A live native replay can extend its existing lease, never issue or resurrect it. */
+        renew(rawInvocationId, rawGrant) {
+            const invocationId = invocationIdSchema.parse(rawInvocationId);
+            const grant = admittedGrant(rawGrant);
+            options.transactionSync(() => {
+                const row = read(invocationId);
+                if (row?.state !== "open" ||
+                    row.expires_at <= now() ||
+                    row.grant_json !== serializeGrant(grant) ||
+                    ended(grant.runId))
+                    throw options.denied();
+                sql.exec("UPDATE computer_workflow_git_invocations SET expires_at=? WHERE invocation_id=?", now() + 60_000, invocationId);
+            });
+        },
+        /** Keep the public receipt so a delayed issuer cannot reopen the same invocation. */
+        close(rawInvocationId, rawGrant) {
+            const invocationId = invocationIdSchema.parse(rawInvocationId);
+            options.transactionSync(() => {
+                const row = read(invocationId);
+                if (row !== undefined) {
+                    // Revocation never depends on current authority or reconstructed
+                    // metadata still being sufficient to admit a new command.
+                    sql.exec("UPDATE computer_workflow_git_invocations SET state='closed',token_digest=NULL WHERE invocation_id=?", invocationId);
+                    return;
+                }
+                const grant = workflowGitPassGrantSchema.parse(rawGrant);
+                // The run tombstone already prevents delayed issuance. Do not recreate
+                // receipts after terminal cleanup has deleted the run's invocation rows.
+                if (ended(grant.runId))
+                    return;
+                // Close can beat the issue RPC or its digest await. Retain the same
+                // public identity either way, so neither can publish a later credential.
+                sql.exec("INSERT INTO computer_workflow_git_invocations VALUES(?,?,?,NULL,0,'closed')", invocationId, grant.runId, serializeGrant(grant));
             });
         },
         /** Retain a tombstone so a delayed mint cannot resurrect a terminal run. */
@@ -59,24 +128,31 @@ export function createWorkflowGitPassStore(options) {
                 throw options.denied();
             options.transactionSync(() => {
                 sql.exec("INSERT OR IGNORE INTO computer_workflow_git_ended_runs VALUES(?)", runId);
-                sql.exec("DELETE FROM computer_workflow_git_passes WHERE run_id=?", runId);
+                sql.exec("DELETE FROM computer_workflow_git_invocations WHERE run_id=?", runId);
             });
         },
-        /** Re-admit the stored scope for every Git request; an expired pass grants nothing. */
-        admit(input) {
-            const at = now();
-            const row = sql
-                .exec("SELECT grant_json,expires_at FROM computer_workflow_git_passes WHERE pass_id=?", input.passId)
+        /** Every request also needs the host's live native-invocation and domain admission. */
+        async admit(input) {
+            const parsed = workflowGitPassTokenSchema.safeParse(input.bearer);
+            if (!parsed.success || parsed.data.ownerId !== options.ownerId())
+                return null;
+            const digest = await tokenDigest(parsed.data.token);
+            const raw = sql
+                .exec("SELECT * FROM computer_workflow_git_invocations WHERE token_digest=?", digest)
                 .toArray()[0];
-            if (row === undefined || z.number().parse(row.expires_at) <= at)
+            if (raw === undefined)
+                return null;
+            const row = leaseSchema.parse(raw);
+            if (row.state !== "open" || row.expires_at <= now())
                 return null;
-            const grant = workflowGitPassGrantSchema.parse(JSON.parse(z.string().parse(row.grant_json)));
+            const grant = workflowGitPassGrantSchema.parse(JSON.parse(row.grant_json));
             if (grant.teamId !== options.ownerId() ||
                 grant.computerId !== options.computerId() ||
                 !repositoryRefsEqual(grant.gitAccess.repository, input.repository) ||
-                (input.scope === "write" && grant.scope !== "write"))
+                (input.scope === "write" && grant.scope !== "write") ||
+                ended(grant.runId))
                 return null;
-            return grant;
+            return { invocationId: row.invocation_id, grant };
         },
     });
 }

package/dist/runtime/git-pass.d.ts

@@ -1,5 +1,4 @@
 import type { RepositoryRef } from "@fungi.computer/agar/git";
-import { type WorkflowGitPassResult } from "@fungi.computer/agar/computer-contracts";
 import type { WorkflowRunContext } from "./graph-contract.js";
 import type { StoredWorkflowNode } from "./graph-dispatch.js";
 import { type WorkflowGitPassGrant } from "./git-pass-contract.js";
@@ -19,7 +18,6 @@ export declare function createWorkflowGitPasses(ports: Readonly<{
         method: string;
     }): WorkflowGitPassNode | null;
     admitMemberGitAccess(memberId: string, repository: RepositoryRef, scope: WorkflowGitScope): Promise<void>;
-    open(computerId: string, grant: WorkflowGitPassGrant): Promise<WorkflowGitPassResult>;
     revoke(computerId: string, input: {
         teamId: string;
         runId: string;
@@ -33,9 +31,10 @@ export declare function createWorkflowGitPasses(ports: Readonly<{
     wake?(due: number | null): Promise<void>;
 }>): {
     cleanupWake: () => number | null;
-    openWorkflowPass(context: WorkflowRunContext, target: {
+    /** Returns only public authority; native NEW admission owns credential issuance. */
+    admitWorkflowGit(context: WorkflowRunContext, target: {
         installationId: string;
         method: string;
-    }): Promise<WorkflowGitPassResult>;
+    }): Promise<WorkflowGitPassGrant>;
     deliverCleanups(): Promise<void>;
 };

package/dist/runtime/git-pass.js

@@ -1,4 +1,3 @@
-import { workflowGitPassResultSchema, } from "@fungi.computer/agar/computer-contracts";
 import { canonicalJson } from "../index.js";
 import { gitAccessScope } from "../git-access.js";
 import { workflowGitPassGrantSchema, } from "./git-pass-contract.js";
@@ -7,7 +6,8 @@ export function createWorkflowGitPasses(ports) {
     const cleanupWake = () => ports.pending().length === 0 ? null : Date.now() + 5000;
     return {
         cleanupWake,
-        async openWorkflowPass(context, target) {
+        /** Returns only public authority; native NEW admission owns credential issuance. */
+        async admitWorkflowGit(context, target) {
             const admitted = ports.admitNode(context, target);
             if (admitted?.computerId == null ||
                 admitted.context.gitAccess === undefined ||
@@ -38,21 +38,7 @@ export function createWorkflowGitPasses(ports) {
             if (canonicalJson(ports.admitNode(context, target)) !==
                 canonicalJson(admitted))
                 throw ports.denied();
-            const pass = workflowGitPassResultSchema.parse(await ports.open(grant.computerId, grant));
-            try {
-                await ports.admitMemberGitAccess(grant.memberId, grant.gitAccess.repository, scope);
-                if (canonicalJson(ports.admitNode(context, target)) !==
-                    canonicalJson(admitted))
-                    throw ports.denied();
-            }
-            catch (cause) {
-                await ports.revoke(grant.computerId, {
-                    teamId: grant.teamId,
-                    runId: grant.runId,
-                });
-                throw cause;
-            }
-            return pass;
+            return grant;
         },
         async deliverCleanups() {
             try {

package/dist/runtime/graph-contract.d.ts

@@ -191,6 +191,7 @@ export declare const graphRunSchema: S.Struct<{
                     readonly id: S.String;
                     readonly kind: S.Literal<"review">;
                     readonly title: S.String;
+                    readonly detail: S.optionalKey<S.String>;
                     readonly show: S.$Array<S.Struct<{
                         readonly node: S.Union<readonly [S.String, S.Literals<readonly ["$input", "$item"]>]>;
                         readonly port: S.String;
@@ -200,6 +201,7 @@ export declare const graphRunSchema: S.Struct<{
                     readonly choices: S.optionalKey<S.$Array<S.Struct<{
                         readonly id: S.String;
                         readonly label: S.String;
+                        readonly description: S.optionalKey<S.String>;
                     }>>>;
                 }>, S.Struct<{
                     readonly id: S.String;
@@ -310,6 +312,7 @@ export declare const graphRunSchema: S.Struct<{
                 readonly id: S.String;
                 readonly kind: S.Literal<"review">;
                 readonly title: S.String;
+                readonly detail: S.optionalKey<S.String>;
                 readonly show: S.$Array<S.Struct<{
                     readonly node: S.Union<readonly [S.String, S.Literals<readonly ["$input", "$item"]>]>;
                     readonly port: S.String;
@@ -319,6 +322,7 @@ export declare const graphRunSchema: S.Struct<{
                 readonly choices: S.optionalKey<S.$Array<S.Struct<{
                     readonly id: S.String;
                     readonly label: S.String;
+                    readonly description: S.optionalKey<S.String>;
                 }>>>;
             }>, S.Struct<{
                 readonly id: S.String;
@@ -412,7 +416,7 @@ export declare const graphRunSchema: S.Struct<{
             readonly graphId: S.optionalKey<S.String>;
             readonly nodeId: S.String;
             readonly level: S.Literals<readonly ["read", "write"]>;
-            readonly capabilities: S.$Array<S.Literals<readonly ["agent.list", "agent.manage", "agent.rename", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>>;
+            readonly capabilities: S.$Array<S.Literals<readonly ["approvals", "agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>>;
             readonly bindings: S.$Array<S.Union<S.Struct<{
                 readonly name: S.Literal<"BACKGROUND" | "GIT" | "EVENTS" | "APPS" | "WORKFLOWS" | "APP_STORAGE" | "MEDIA" | "COMPUTER" | "INBOX" | "AGENTS">;
                 readonly operations: S.$Array<S.Literals<string[]>>;

package/dist/runtime/graph-run-store.d.ts

@@ -59,6 +59,12 @@ export declare function createGraphWorkflowRuns(options: {
             readonly iteration: string;
             readonly instanceId: string;
             readonly eventType: string;
+            readonly position?: readonly {
+                readonly node: string;
+                readonly loop: "repeat" | "map";
+                readonly index: number;
+                readonly count: number;
+            }[];
             readonly choices?: readonly string[];
         };
         status: "closed" | "pending" | "answered" | "delivered" | "timed_out";

package/dist/runtime/ports.d.ts

@@ -1,4 +1,5 @@
 import type { Pending } from "@fungi.computer/agar/backend-definition";
+import type { ResultRow } from "@fungi.computer/gills";
 import type { RunCeiling } from "./run-ceiling.js";
 import type { Catalog } from "../index.js";
 import type * as Schema from "effect/Schema";
@@ -35,6 +36,8 @@ export type WorkflowAppCallResult = Pending | Readonly<{
     kind: "complete";
     output: Schema.Json;
     costMilliunits: number;
+    /** How the finished call reads to a person, when the App declares a presentation. */
+    row?: ResultRow;
 }> | Readonly<{
     kind: "refused";
     code: "not_granted" | "invalid_input" | "invalid_output" | "revoked" | "unknown_method";
@@ -142,10 +145,17 @@ export type WorkflowTriggerRunPorts = Readonly<{
     startCachedGraph(binding: import("./trigger-owner.js").ArmedWorkflowTrigger, request: Pick<import("./graph-start.js").GraphStartRequest, "requestId" | "input"> & {
         /** The firing event's repository, evaluated from the armed trigger. */
         triggerRepository?: string;
-    }): Promise<Exclude<GraphStartReply, {
+    }, 
+    /** Host-private binding check, evaluated with the durable run write. */
+    admission?: WorkflowTriggerAdmission): Promise<Exclude<GraphStartReply, {
         kind: "invalid";
     }>>;
 }>;
+/** Host-private checks and reservation identity, never supplied by a sender. */
+export type WorkflowTriggerAdmission = Readonly<{
+    admitBinding(): boolean;
+    reservationId?: string;
+}>;
 /** Hosts retain their existing error vocabulary and denial classification. */
 export type WorkflowErrorPort = Readonly<{
     denied(): Error;

package/dist/runtime/run-ceiling.d.ts

@@ -51,7 +51,7 @@ export declare const runCeilingSchema: S.Struct<{
         readonly graphId: S.optionalKey<S.String>;
         readonly nodeId: S.String;
         readonly level: S.Literals<readonly ["read", "write"]>;
-        readonly capabilities: S.$Array<S.Literals<readonly ["agent.list", "agent.manage", "agent.rename", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>>;
+        readonly capabilities: S.$Array<S.Literals<readonly ["approvals", "agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>>;
         readonly bindings: S.$Array<S.Union<S.Struct<{
             readonly name: S.Literal<"BACKGROUND" | "GIT" | "EVENTS" | "APPS" | "WORKFLOWS" | "APP_STORAGE" | "MEDIA" | "COMPUTER" | "INBOX" | "AGENTS">;
             readonly operations: S.$Array<S.Literals<string[]>>;