@fungi.computer/computer 0.0.1 → 0.2.0

package/dist/files.js

@@ -1,4 +1,8 @@
-import { replaceOutputSchema, } from "./operation-contract.js";
+import { WorkspaceFileStore } from "@fungi.computer/cloudflare-computer/tools";
+import { posix } from "node:path";
+import { SearchVisibility } from "@fungi.computer/knapsack/files-search";
+import { imageReadResult, imageSniffBytes, imageTooLargeMessage, maximumImageBytes, sniffImageMimeType, } from "@fungi.computer/knapsack/files-read";
+import { replaceOutputSchema, } from "@fungi.computer/computer-contract";
 const utf8 = new TextEncoder();
 function entryType(entry) {
     if (entry.isSymbolicLink)
@@ -52,7 +56,7 @@ export function readBoundedWorkspaceText(provider, path, maximumBytes) {
 }
 /** Adapt native Workspace.fs at the one real file boundary. */
 export function createWorkspaceFilesPort(workspace, owner) {
-    return Object.freeze({
+    const port = {
         async read(input) {
             const stat = await workspace.fs.stat(input.path);
             if (!stat.isFile)
@@ -69,10 +73,22 @@ export function createWorkspaceFilesPort(workspace, owner) {
                     truncated: false,
                 };
             }
-            const pageBytes = await readBytes(workspace, input.path, input.offset, Math.min(input.limit, stat.size - input.offset));
-            if (pageBytes.byteLength === 0) {
+            // The first read covers the sniff window whatever the caller's limit.
+            const windowBytes = await readBytes(workspace, input.path, input.offset, Math.min(input.offset === 0
+                ? Math.max(input.limit, imageSniffBytes)
+                : input.limit, stat.size - input.offset));
+            if (windowBytes.byteLength === 0) {
                 throw new Error(`Files path changed during read: ${input.path}`);
             }
+            const mimeType = input.offset === 0 ? sniffImageMimeType(windowBytes) : undefined;
+            if (mimeType !== undefined) {
+                if (stat.size > maximumImageBytes)
+                    throw new Error(imageTooLargeMessage(input.path, stat.size, maximumImageBytes));
+                return imageReadResult(input.path, mimeType, windowBytes.byteLength === stat.size
+                    ? windowBytes
+                    : await readBytes(workspace, input.path, 0, stat.size));
+            }
+            const pageBytes = windowBytes.subarray(0, input.limit);
             const page = decodeUtf8Page(pageBytes, input.path, input.offset + pageBytes.byteLength < stat.size);
             const nextOffset = input.offset + page.byteLength;
             return {
@@ -83,54 +99,159 @@ export function createWorkspaceFilesPort(workspace, owner) {
                 truncated: nextOffset < stat.size,
             };
         },
-        async list(input) {
-            const rows = await workspace.fs.readdir(input.path, {
-                limit: input.limit + 1,
-            });
-            const entries = rows.slice(0, input.limit).map((entry) => {
-                const path = childPath(input.path, entry.name);
-                return {
-                    path,
-                    name: entry.name,
-                    type: entryType(entry),
-                    size: entry.size,
-                    modifiedAt: entry.mtime,
-                };
-            });
+        async list(input, context) {
+            const output = await searchWorkspaceDirectory(workspace, { ...input, offset: 0 }, context?.signal);
             return {
                 path: input.path,
-                entries,
-                truncated: rows.length > input.limit,
+                ...output,
+                results: output.results.map((entry) => ({
+                    path: entry.path,
+                    type: entryType(entry),
+                })),
             };
         },
-        async glob(input) {
-            const rows = await workspace.fs.find(input.path, input.pattern, {
-                limit: input.limit + 1,
-            });
+        async glob(input, context) {
+            const output = await visibleSearch(workspace, workspacePath(input.path), input.limit, (options) => workspace.fs.find(workspacePath(input.path), input.pattern, options), (entry) => entry.type === "dir", context?.signal);
             return {
                 path: input.path,
-                matches: rows.slice(0, input.limit).map((entry) => entry.path),
-                truncated: rows.length > input.limit,
+                ...output,
+                results: output.results.map((row) => ({
+                    path: row.path,
+                    type: row.type === "dir" ? "directory" : "file",
+                })),
             };
         },
-        async grep(input) {
-            const rows = await workspace.fs.grep(input.pattern, input.path, {
+        async grep(input, context) {
+            const options = {
                 regex: input.regex,
                 ignoreCase: input.ignoreCase,
                 limit: input.limit + 1,
-            });
+            };
+            if (input.include !== undefined)
+                options.include = input.include;
+            const output = await visibleSearch(workspace, workspacePath(input.path), input.limit, (page) => workspace.fs.grep(input.pattern, workspacePath(input.path), {
+                ...options,
+                ...page,
+            }), () => false, context?.signal);
             return {
                 path: input.path,
-                matches: rows.slice(0, input.limit).map((row) => ({
+                ...output,
+                results: output.results.map((row) => ({
                     path: row.path,
                     line: row.line,
                     text: row.text,
                 })),
-                truncated: rows.length > input.limit,
             };
         },
         async replace(input) {
             return replaceOutputSchema.parse(await owner.replaceFileIfUnchanged(input));
         },
+    };
+    return Object.freeze({
+        ...port,
+        // The Computer REST contract keeps its own path and content searches for
+        // Apps and Hub routes; its matches/boolean results are not Agent results.
+        rest: Object.freeze({
+            list: (input) => listWorkspaceFiles(workspace, input),
+            async glob(input) {
+                const output = await port.glob(input);
+                return {
+                    path: input.path,
+                    matches: output.results.map((entry) => entry.path),
+                    truncated: output.truncated !== null,
+                };
+            },
+            async grep(input) {
+                const output = await port.grep(input);
+                return {
+                    path: input.path,
+                    matches: output.results,
+                    truncated: output.truncated !== null,
+                };
+            },
+        }),
+    });
+}
+function searchWorkspaceDirectory(workspace, input, signal) {
+    const path = workspacePath(input.path);
+    return visibleSearch(workspace, path, input.limit, async (options) => (await workspace.fs.readdir(path, options)).map((entry) => ({
+        ...entry,
+        path: childPath(path, entry.name),
+    })), (entry) => entry.isDirectory, signal, input.offset);
+}
+/** Shared REST listing: offsets count visible entries, never ignored candidates. */
+export async function listWorkspaceFiles(workspace, input) {
+    const output = await searchWorkspaceDirectory(workspace, input);
+    // The existing list wire has no scan-reason field. Do not disguise an
+    // exhausted scan as an empty finished page or a fabricated next offset.
+    if (output.truncated === "scan")
+        throw new Error("Files listing reached the search scan bound; narrow path");
+    return {
+        path: input.path,
+        entries: output.results.map((entry) => ({
+            name: entry.name,
+            size: entry.size,
+            modifiedAt: entry.mtime,
+            type: entryType(entry),
+        })),
+        nextOffset: output.truncated === null ? null : input.offset + output.results.length,
+    };
+}
+/** Computer wire paths are absolute within its Workspace, even for relative Files inputs. */
+function workspacePath(path) {
+    if (path === ".")
+        return "/";
+    return path.startsWith("/") ? path : `/${path}`;
+}
+/** Storage adapter only; shared Files policy owns visibility and grammar. */
+function workspaceSearchVisibility(workspace) {
+    const store = new WorkspaceFileStore(workspace);
+    let bytes = 0;
+    return new SearchVisibility(async (directory) => {
+        const path = posix.join("/", directory, ".gitignore");
+        const stat = await store.stat(path);
+        if (stat !== null) {
+            // Match Local's bounded text reads; never silently omit unreadable rules.
+            if (stat.size > 128 * 1_024 || bytes + stat.size > 64 * 1_024 * 1_024)
+                throw new Error(`Files ignore rules exceed the search byte bound: ${path}`);
+            bytes += stat.size;
+            return decodeUtf8(await readBytes(workspace, path, 0, stat.size), path);
+        }
+        return undefined;
     });
 }
+function searchRelativePath(path) {
+    return posix.relative("/", posix.resolve("/", path));
+}
+/** Page the SDK's traversal; filtering must not spend the visible-result limit. */
+async function visibleSearch(workspace, root, limit, page, isDirectory, signal, visibleOffset = 0) {
+    const rules = workspaceSearchVisibility(workspace);
+    const results = [];
+    signal?.throwIfAborted();
+    const metadata = await workspace.fs.stat(root);
+    if (!(await rules.visible(searchRelativePath(root), metadata.isDirectory)))
+        return { results, truncated: null };
+    const maximumCandidates = 50_000;
+    let offset = 0;
+    while (offset < maximumCandidates) {
+        signal?.throwIfAborted();
+        const count = Math.min(offset === 0 ? limit + 1 : Math.max(128, limit + 1), maximumCandidates - offset);
+        const rows = await page(offset === 0 ? { limit: count } : { limit: count, offset });
+        for (const row of rows) {
+            signal?.throwIfAborted();
+            if (!(await rules.visible(searchRelativePath(row.path), isDirectory(row))))
+                continue;
+            if (visibleOffset > 0) {
+                visibleOffset--;
+                continue;
+            }
+            if (results.length === limit)
+                return { results, truncated: "limit" };
+            results.push(row);
+        }
+        if (rows.length < count)
+            return { results, truncated: null };
+        offset += rows.length;
+    }
+    return { results, truncated: "scan" };
+}

package/dist/fleet/backing.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { attachedBackendId, localBackendSchema, } from "../computer-backends.js";
 import { ComputerBackingError, computerBackingChangeSchema, hostedBackingsSchema, localBackendAttachSchema, localBackendDetachSchema, localBackendDetachRequestSchema, } from "./wire.js";
 const maximumLocalBackends = 8;
-const localRowSchema = z.strictObject({
+const localRowSchema = z.lazy(() => z.strictObject({
     computer_id: z.string(),
     device_id: z.string(),
     actor_id: z.string(),
@@ -10,7 +10,7 @@ const localRowSchema = z.strictObject({
     host_label: z.string(),
     folder_label: z.string(),
     request_id: z.string(),
-});
+}));
 function mintDeviceId() {
     const alphabet = "abcdefghijklmnopqrstuvwxyz234567";
     const bytes = crypto.getRandomValues(new Uint8Array(16));

package/dist/fleet/index.d.ts

@@ -5,7 +5,7 @@ export { computerActionSchema, computerProvenanceSchema, computerGrantSchema, co
 export { ComputerRuntimeUsage } from "./runtime-usage.js";
 export { computerUsageIntervalSchema, type ComputerUsageInterval, } from "./wire.js";
 export { createFleetInventory } from "./inventory.js";
-export { ComputerInventoryError, type FleetActor, type FleetComputer, } from "./inventory-wire.js";
+export { ComputerInventoryError, computerCreateRequestSchema, computerPageSchema, type ComputerCreateRequest, type ComputerPage, type FleetActor, type FleetComputer, } from "./inventory-wire.js";
 export { createFleetSlots } from "./slots.js";
 export { FleetLifecycle, FleetGrantRefused, type FleetLifecyclePorts, type FleetLifecycleFact, } from "./lifecycle.js";
 export { createFleetComputers } from "./computers.js";

package/dist/fleet/index.js

@@ -5,7 +5,7 @@ export { computerActionSchema, computerProvenanceSchema, computerGrantSchema, co
 export { ComputerRuntimeUsage } from "./runtime-usage.js";
 export { computerUsageIntervalSchema, } from "./wire.js";
 export { createFleetInventory } from "./inventory.js";
-export { ComputerInventoryError, } from "./inventory-wire.js";
+export { ComputerInventoryError, computerCreateRequestSchema, computerPageSchema, } from "./inventory-wire.js";
 export { createFleetSlots } from "./slots.js";
 export { FleetLifecycle, FleetGrantRefused, } from "./lifecycle.js";
 export { createFleetComputers } from "./computers.js";

package/dist/fleet/inventory-wire.d.ts

@@ -12,6 +12,10 @@ export type FleetComputer = Readonly<{
     updatedAt: number;
 }>;
 /** A durable create receipt binds the complete request to its actor. */
+export declare const computerCreateRequestSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodString;
+}, z.core.$strict>;
 export type ComputerCreateRequest = Readonly<{
     name?: string | undefined;
     requestId: string;

package/dist/fleet/inventory-wire.js

@@ -1,4 +1,9 @@
 import { z } from "zod";
+/** A durable create receipt binds the complete request to its actor. */
+export const computerCreateRequestSchema = z.strictObject({
+    name: z.string().min(1).max(256).optional(),
+    requestId: z.string().min(1).max(256),
+});
 /** Inventory pages retain stable ordering and a bounded response. */
 export const computerPageSchema = z.strictObject({
     limit: z.number().int().min(1).max(100).default(100),

package/dist/fleet/inventory.js

@@ -7,7 +7,7 @@ const computerIds = defineIdFamily({
     version: 1,
     kinds: { computer: { prefix: "computer" } },
 });
-const rowSchema = z.strictObject({
+const rowSchema = z.lazy(() => z.strictObject({
     computer_id: z.string().min(1),
     name: z.string().min(1).max(256),
     actor_kind: z.string().min(1),
@@ -15,15 +15,15 @@ const rowSchema = z.strictObject({
     active: z.number().int().min(0).max(1),
     created_at: z.number().int().nonnegative(),
     updated_at: z.number().int().nonnegative(),
-});
-const receiptSchema = z.strictObject({
+}));
+const receiptSchema = z.lazy(() => z.strictObject({
     requested_name: z.string().min(1).max(256).nullable(),
     request_id: z.string().min(1).max(256),
     actor_kind: z.string().min(1),
     actor_id: z.string().min(1).max(256),
     name: z.string().min(1).max(256),
     computer_id: z.string().min(1),
-});
+}));
 const selectRow = "SELECT computer_id,name,actor_kind,actor_id,active,created_at,updated_at FROM hub_team_computers";
 function actorColumns(actor) {
     return { actorId: actor.id, actorKind: actor.kind };

package/dist/fleet/lifecycle.d.ts

@@ -53,10 +53,16 @@ export declare class FleetLifecycle {
     readonly usage: ComputerRuntimeUsage;
     constructor(ports: FleetLifecyclePorts);
     get recycleRuntimeId(): string | undefined;
+    /** A successful stop cannot race an admitted boot or in-flight operation. */
+    get hasPendingOperations(): boolean;
     takeFacts(): FleetLifecycleFact[];
     private diagnostic;
     /** Keep pending starts visible while the host obtains admission and capacity. */
-    beginHostedStart(): () => void;
+    private beginHostedStart;
+    /** Start the selected hosted backend under the host's admission and slot policy. */
+    startHostedComputer(admitted: (backing: HostedBacking, run: () => Promise<void>) => Promise<void>): Promise<{
+        state: "running";
+    }>;
     /** Read liveness without waking a sleeping backend. Queue state wins over booting. */
     readComputerState(): Promise<{
         state: "queued";

package/dist/fleet/lifecycle.js

@@ -6,12 +6,7 @@ import { ComputerRuntimeUsage } from "./runtime-usage.js";
 import { checkComputerGrant } from "./admission.js";
 const vmRecycleAfterMs = 23 * 60 * 60 * 1_000;
 const vmRecycleQuietMs = 30_000;
-const runtimeWatchSchema = z.coerce
-    .number()
-    .int()
-    .min(1_000)
-    .max(3_600_000)
-    .catch(60_000);
+const runtimeWatchSchema = z.lazy(() => z.coerce.number().int().min(1_000).max(3_600_000).catch(60_000));
 function runtimeWatchDelay(delivered, running, watchMs) {
     if (running > 0)
         return delivered ? watchMs : 1_000;
@@ -45,6 +40,12 @@ export class FleetLifecycle {
     get recycleRuntimeId() {
         return this.#recycleRuntimeId;
     }
+    /** A successful stop cannot race an admitted boot or in-flight operation. */
+    get hasPendingOperations() {
+        return (this.#hostedOperations > 0 ||
+            this.#startingHosted > 0 ||
+            this.#recycling !== undefined);
+    }
     takeFacts() {
         const facts = this.#facts;
         this.#facts = [];
@@ -60,6 +61,22 @@ export class FleetLifecycle {
             this.#startingHosted--;
         };
     }
+    /** Start the selected hosted backend under the host's admission and slot policy. */
+    async startHostedComputer(admitted) {
+        const hosted = this.ports.backend.requireHostedRoute();
+        const finish = this.beginHostedStart();
+        try {
+            await admitted(hosted.backing, async () => {
+                await this.ports.backend.workspace().push(hosted.id);
+            });
+            if (!(await this.ports.backend.containerRunning(hosted.backing)))
+                throw new Error("Hosted Computer disconnected while starting");
+            return { state: "running" };
+        }
+        finally {
+            finish();
+        }
+    }
     /** Read liveness without waking a sleeping backend. Queue state wins over booting. */
     async readComputerState() {
         const backends = await this.readAttachedBackends();

package/dist/fleet/wire.d.ts

@@ -5,6 +5,12 @@ export declare const computerActionSchema: z.ZodEnum<{
     exec: "exec";
     start: "start";
     delete: "delete";
+    mkdir: "mkdir";
+    backing: "backing";
+    bash: "bash";
+    exposePort: "exposePort";
+    listPorts: "listPorts";
+    unexposePort: "unexposePort";
     "files.read": "files.read";
     "files.readBytes": "files.readBytes";
     "files.write": "files.write";
@@ -14,12 +20,6 @@ export declare const computerActionSchema: z.ZodEnum<{
     "files.grep": "files.grep";
     "files.edit": "files.edit";
     "files.patch": "files.patch";
-    mkdir: "mkdir";
-    bash: "bash";
-    backing: "backing";
-    exposePort: "exposePort";
-    listPorts: "listPorts";
-    unexposePort: "unexposePort";
     terminal: "terminal";
     stop: "stop";
     processStart: "processStart";
@@ -40,6 +40,12 @@ export declare const computerGrantSchema: z.ZodObject<{
         exec: "exec";
         start: "start";
         delete: "delete";
+        mkdir: "mkdir";
+        backing: "backing";
+        bash: "bash";
+        exposePort: "exposePort";
+        listPorts: "listPorts";
+        unexposePort: "unexposePort";
         "files.read": "files.read";
         "files.readBytes": "files.readBytes";
         "files.write": "files.write";
@@ -49,12 +55,6 @@ export declare const computerGrantSchema: z.ZodObject<{
         "files.grep": "files.grep";
         "files.edit": "files.edit";
         "files.patch": "files.patch";
-        mkdir: "mkdir";
-        bash: "bash";
-        backing: "backing";
-        exposePort: "exposePort";
-        listPorts: "listPorts";
-        unexposePort: "unexposePort";
         terminal: "terminal";
         stop: "stop";
         processStart: "processStart";
@@ -82,12 +82,12 @@ export declare const computerStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
 }, z.core.$strict>], "state">;
 export type ComputerRuntimeState = z.output<typeof computerStateSchema>;
 /** Hosted fallback order, with the same bound and identity law as the retained owner. */
-export declare const hostedBackingsSchema: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+export declare const hostedBackingsSchema: z.ZodLazy<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"platform-container">;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"on-box-vm">;
-    hostId: z.ZodString;
-}, z.core.$strict>], "kind">>;
+    hostId: z.ZodLazy<z.ZodString>;
+}, z.core.$strict>], "kind">>>;
 /** The host delivers this complete revision to its Computer runtime. */
 export type ComputerBackendsProjection = Readonly<{
     computerId: string;
@@ -95,15 +95,15 @@ export type ComputerBackendsProjection = Readonly<{
     backends: readonly AttachedBackend[];
 }>;
 /** An explicit override, or the fleet default when no Computer is selected. */
-export declare const computerBackingChangeSchema: z.ZodObject<{
+export declare const computerBackingChangeSchema: z.ZodLazy<z.ZodObject<{
     computerId: z.ZodOptional<z.ZodString>;
-    backings: z.ZodNullable<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    backings: z.ZodNullable<z.ZodLazy<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"platform-container">;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"on-box-vm">;
-        hostId: z.ZodString;
-    }, z.core.$strict>], "kind">>>;
-}, z.core.$strict>;
+        hostId: z.ZodLazy<z.ZodString>;
+    }, z.core.$strict>], "kind">>>>;
+}, z.core.$strict>>;
 export type ComputerBackingChange = Readonly<{
     computerId?: string | undefined;
     backings: readonly z.output<typeof hostedBackingSchema>[] | null;
@@ -117,15 +117,15 @@ export declare class ComputerBackingError extends Error {
 export declare const localBackendAttachSchema: z.ZodObject<{
     computerId: z.ZodString;
     publicKey: z.ZodBase64;
-    hostLabel: z.ZodString;
-    folderLabel: z.ZodString;
+    hostLabel: z.ZodLazy<z.ZodString>;
+    folderLabel: z.ZodLazy<z.ZodString>;
     requestId: z.ZodString;
 }, z.core.$strict>;
 export type LocalBackendAttachInput = z.output<typeof localBackendAttachSchema>;
-export declare const localBackendDetachSchema: z.ZodObject<{
+export declare const localBackendDetachSchema: z.ZodLazy<z.ZodObject<{
     computerId: z.ZodString;
     backendId: z.ZodString;
-}, z.core.$strict>;
+}, z.core.$strict>>;
 /** Recover a lost attach response without retaining the device key. */
 export declare const localBackendDetachRequestSchema: z.ZodObject<{
     computerId: z.ZodString;
@@ -139,7 +139,7 @@ export declare const computerUsageIntervalSchema: z.ZodObject<{
         kind: z.ZodLiteral<"platform-container">;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"on-box-vm">;
-        hostId: z.ZodString;
+        hostId: z.ZodLazy<z.ZodString>;
     }, z.core.$strict>], "kind">;
     startedAt: z.ZodNumber;
     observedAt: z.ZodNumber;
@@ -159,7 +159,7 @@ export type ComputerUsageInterval = Readonly<{
     ended: boolean;
 }>;
 /** Observations, not billing decisions. The host owns delivery and settlement. */
-export declare const computerFactSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+export declare const computerFactSchema: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"process.exited">;
     requestId: z.ZodString;
     exitCode: z.ZodNullable<z.ZodNumber>;
@@ -213,7 +213,7 @@ export declare const computerFactSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"platform-container">;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"on-box-vm">;
-        hostId: z.ZodString;
+        hostId: z.ZodLazy<z.ZodString>;
     }, z.core.$strict>], "kind">;
     startedAt: z.ZodNumber;
     observedAt: z.ZodNumber;
@@ -224,5 +224,5 @@ export declare const computerFactSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         actor: z.ZodString;
         via: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
-}, z.core.$strict>], "kind">;
+}, z.core.$strict>], "kind">>;
 export type ComputerFact = z.output<typeof computerFactSchema>;

package/dist/fleet/wire.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { computerOperationSchema, computerValueSchema, pathSchema, } from "../operation-contract.js";
+import { computerOperationSchema, computerValueSchema, pathSchema, } from "@fungi.computer/computer-contract";
 import { attachedBackendId, hostedBackingSchema, localBackendSchema, } from "../computer-backends.js";
 /** Operations the host may admit on one Computer. */
 export const computerActionSchema = z.enum([
@@ -39,15 +39,15 @@ export const computerStateSchema = z.discriminatedUnion("state", [
     }),
 ]);
 /** Hosted fallback order, with the same bound and identity law as the retained owner. */
-export const hostedBackingsSchema = z
+export const hostedBackingsSchema = z.lazy(() => z
     .array(hostedBackingSchema)
     .max(4)
-    .refine((backings) => new Set(backings.map(attachedBackendId)).size === backings.length, "hosted backings must be distinct");
+    .refine((backings) => new Set(backings.map(attachedBackendId)).size === backings.length, "hosted backings must be distinct"));
 /** An explicit override, or the fleet default when no Computer is selected. */
-export const computerBackingChangeSchema = z.strictObject({
+export const computerBackingChangeSchema = z.lazy(() => z.strictObject({
     computerId: z.string().min(1).max(256).optional(),
     backings: hostedBackingsSchema.nullable(),
-});
+}));
 /** A backing operation was refused without changing the stored decision. */
 export class ComputerBackingError extends Error {
     code;
@@ -65,10 +65,10 @@ export const localBackendAttachSchema = z.strictObject({
     folderLabel: localBackendSchema.shape.folderLabel,
     requestId: z.string().min(1).max(256),
 });
-export const localBackendDetachSchema = z.strictObject({
+export const localBackendDetachSchema = z.lazy(() => z.strictObject({
     computerId: z.string().min(1).max(256),
     backendId: z.string().regex(/^local-[a-z2-7]{16}$/),
-});
+}));
 /** Recover a lost attach response without retaining the device key. */
 export const localBackendDetachRequestSchema = z.strictObject({
     computerId: localBackendAttachSchema.shape.computerId,
@@ -89,7 +89,7 @@ export const computerUsageIntervalSchema = z.strictObject({
 });
 const timestamp = z.number().int().nonnegative();
 /** Observations, not billing decisions. The host owns delivery and settlement. */
-export const computerFactSchema = z.discriminatedUnion("kind", [
+export const computerFactSchema = z.lazy(() => z.discriminatedUnion("kind", [
     z.strictObject({
         ...factIdentity,
         kind: z.literal("process.exited"),
@@ -124,4 +124,4 @@ export const computerFactSchema = z.discriminatedUnion("kind", [
         kind: z.literal("interval"),
         ...computerUsageIntervalSchema.shape,
     }),
-]);
+]));