@fungi.computer/oyster 0.2.0 → 0.3.0

package/dist/instance-id.d.ts

@@ -0,0 +1,10 @@
+import { type CairnId } from "@fungi.computer/cairn/id";
+import * as Schema from "effect/Schema";
+/** The Cairn ID family that mints and recognizes App Instance IDs (`instance_…`). */
+export declare const instanceIds: Readonly<{
+    readonly instance: import("@fungi.computer/cairn").IdCodec<"app-instance", "instance", 1>;
+}>;
+/** A stable App Instance ID minted by {@link instanceIds}. */
+export type InstanceId = CairnId<"app-instance", "instance">;
+/** Decodes a string into an {@link InstanceId}, rejecting any other ID family. */
+export declare const instanceIdSchema: Schema.Codec<InstanceId, string>;

package/dist/instance-id.js

@@ -0,0 +1,10 @@
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import * as Schema from "effect/Schema";
+/** The Cairn ID family that mints and recognizes App Instance IDs (`instance_…`). */
+export const instanceIds = defineIdFamily({
+    family: "app-instance",
+    version: 1,
+    kinds: { instance: { prefix: "instance" } },
+});
+/** Decodes a string into an {@link InstanceId}, rejecting any other ID family. */
+export const instanceIdSchema = Schema.String.pipe(Schema.refine((value) => instanceIds.instance.is(value)));

package/dist/instance-refusal.d.ts

@@ -0,0 +1,11 @@
+import type { AppInstanceErrorCode } from "./index.js";
+/** The retained HTTP meaning of a known Instance refusal, never generic failed. */
+export declare function instanceRefusalStatus(code: AppInstanceErrorCode): number;
+/** Only closed host-authored boot reasons produce a caller-facing message. */
+export declare function instanceRefusalBody(code: string): {
+    error: "backend_load_failed" | "backend_construction_failed" | "ui_mount_failed" | "boot_runner_unavailable" | "boot_browser_binding_missing" | "boot_clone_unavailable" | "boot_timeout" | "boot_cleanup_failed";
+    message: string;
+} | {
+    error: string;
+    message?: undefined;
+};

package/dist/instance-refusal.js

@@ -0,0 +1,21 @@
+import { BootGateError, bootFailureSchema } from "./boot-gate.js";
+const conflicts = new Set([
+    "conflicting_owner_state",
+    "stale_authority",
+    "instance_release_mismatch",
+    "release_no_longer_matches_instance",
+    "state_schema_migration_unsupported",
+]);
+/** The retained HTTP meaning of a known Instance refusal, never generic failed. */
+export function instanceRefusalStatus(code) {
+    if (bootFailureSchema.safeParse(code).success)
+        return 422;
+    return conflicts.has(code) ? 409 : 403;
+}
+/** Only closed host-authored boot reasons produce a caller-facing message. */
+export function instanceRefusalBody(code) {
+    const boot = bootFailureSchema.safeParse(code);
+    return boot.success
+        ? { error: boot.data, message: new BootGateError(boot.data).message }
+        : { error: code };
+}

package/dist/internal/delivery.js

@@ -22,7 +22,8 @@ async function admitGitPush(host, readRelease, installationId, raw) {
     const current = await host.installations.get(installationId);
     if (current?.status !== "enabled" ||
         current.instanceId !== installation.instanceId ||
-        current.authorityVersion !== installation.authorityVersion ||
+        current.authority.authorityVersion !==
+            installation.authority.authorityVersion ||
         current.release.releaseId !== installation.release.releaseId)
         throw new Error("Git push installation changed");
     return { installation: current, release, fact };
@@ -45,8 +46,9 @@ function deliverAdmittedGitPush(host, installation, release, fact) {
  * this path never calls the producer's optional enqueue callback. */
 export async function deliverGitPush(host, installationId, fact) {
     const admitted = await admitGitPush(host, (release) => verifyRelease(host.artifacts, release, defaultAssetPolicy, false), installationId, fact);
-    if (admitted !== null)
+    if (admitted !== null) {
         await deliverAdmittedGitPush(host, admitted.installation, admitted.release, admitted.fact);
+    }
 }
 /** Re-admit a stored member through the same directory and method gate as a click. */
 export async function deliverBackground(host, raw) {

package/dist/internal/host-gate.js

@@ -45,7 +45,13 @@ export async function hostGateFacts(host, installation, release, principal) {
     const declaration = release.declaration ?? emptyAppDeclaration;
     const toolPolicy = await hostToolPolicy(host, actor, installation.installationId);
     return {
-        installation,
+        installation: {
+            status: installation.status,
+            visibility: installation.visibility,
+            instanceId: installation.instanceId,
+            authority: installation.authority,
+            artifactDigest: installation.release.artifact.artifactDigest,
+        },
         declaration,
         declaredOperations: await deriveDeclaredOperations(installation.release, declaration, host.capabilities ?? []),
         api: release.api,

package/dist/internal/registry-installations.js

@@ -1,12 +1,12 @@
+import { installationOperationsPort } from "../installation-operations.js";
 /** Read and commit installations in the scope's registry. */
 export function registryInstallations(env, scope) {
     const registry = () => env.REGISTRY.getByName(scope.durableName("registry"));
     return {
+        operations: installationOperationsPort((request) => registry().installationOperation(request), { tenantId: scope.tenantId, origin: scope.origin }),
+        generation: async () => registry().generation(),
         list: async () => registry().list(),
         get: async (id) => registry().get(id),
-        put: async (installation) => {
-            await registry().put(installation, scope.tenantId);
-        },
-        compareAndPut: async (installation, expectedAuthorityVersion) => await registry().compareAndPut(installation, expectedAuthorityVersion, scope.tenantId),
+        compareAndPut: async (installation, expectedAuthorityVersion, expectedGeneration) => await registry().compareAndPut(installation, expectedAuthorityVersion, expectedGeneration, scope.tenantId),
     };
 }

package/dist/keys.d.ts

@@ -2,12 +2,14 @@ import type { Grant, GrantVocabulary, Scope } from "@fungi.computer/ear-tag/gran
 import type { KeyPrincipal, KeyRecord, KeyStore } from "@fungi.computer/ear-tag/keys";
 import type { AppToolPolicy } from "./apps/tools.js";
 /** Every capability an Oyster key may carry. */
-export type OysterKeyCapability = "apps.read" | "apps.use" | "computer.use";
+export type OysterKeyCapability = "apps.read" | "apps.use" | "computer.use" | "machine.enroll";
 /**
  * `apps.use` also reaches `apps.read` (one level, per `defineGrants`'s own
  * `implies`): a key that may change an App's data may also read it.
  * `computer.use` has no narrower capability under it; the Computer is on or
  * off, host-wide.
+ * `machine.enroll` admits enrollment only; it implies no App or Computer access.
+ * The enrollment owner, not this vocabulary, owns one-use consumption.
  */
 export declare const oysterKeyVocabulary: GrantVocabulary<OysterKeyCapability>;
 /** A grant reaching every current and future installation for `capability`. */
@@ -46,3 +48,5 @@ export type LiveOysterKey = Readonly<{
 export declare function keyAppAccess(key: LiveOysterKey, installationId: string): AppToolPolicy | null;
 /** Whether a live key's own grants turn its Computer access on. Off by default. */
 export declare function keyAllowsComputerUse(key: LiveOysterKey): boolean;
+/** Whether a live key's grants permit a one-use device enrollment. */
+export declare function keyAllowsMachineEnroll(key: LiveOysterKey): boolean;

package/dist/keys.js

@@ -1,6 +1,6 @@
 /**
  * Oyster's own Ear Tag vocabulary: named keys an owner issues for its
- * installed Apps and, optionally, its Computer. A key's id is its name, so
+ * installed Apps, its Computer or machine enrollment. A key's id is its name, so
  * forks and other name-derived identities stay stable across the cutover.
  */
 import { defineGrants } from "@fungi.computer/ear-tag/grants";
@@ -9,9 +9,11 @@ import { defineGrants } from "@fungi.computer/ear-tag/grants";
  * `implies`): a key that may change an App's data may also read it.
  * `computer.use` has no narrower capability under it; the Computer is on or
  * off, host-wide.
+ * `machine.enroll` admits enrollment only; it implies no App or Computer access.
+ * The enrollment owner, not this vocabulary, owns one-use consumption.
  */
 export const oysterKeyVocabulary = defineGrants({
-    capabilities: ["apps.read", "apps.use", "computer.use"],
+    capabilities: ["apps.read", "apps.use", "computer.use", "machine.enroll"],
     implies: { "apps.use": ["apps.read"] },
 });
 /** A grant reaching every current and future installation for `capability`. */
@@ -50,3 +52,9 @@ export function keyAppAccess(key, installationId) {
 export function keyAllowsComputerUse(key) {
     return oysterKeyVocabulary.grantsAllow(key.grants, "computer.use");
 }
+/** Whether a live key's grants permit a one-use device enrollment. */
+export function keyAllowsMachineEnroll(key) {
+    return (key.grants.length === 1 &&
+        key.grants[0]?.capability === "machine.enroll" &&
+        oysterKeyVocabulary.grantsAllow(key.grants, "machine.enroll"));
+}

package/dist/machine-link/authority.d.ts

@@ -0,0 +1,89 @@
+import { z } from "zod";
+import type { PostDeliveryResult, PostEnvelope } from "@fungi.computer/carrier/post";
+import type { MachineAgentHome } from "./home.js";
+export declare const machineLinkIdentitySchema: z.ZodObject<{
+    teamId: z.ZodString;
+    deviceId: z.ZodString;
+}, z.core.$strict>;
+export type MachineLinkIdentity = z.infer<typeof machineLinkIdentitySchema>;
+/** One canonical device owner, not a Team's socket collection. */
+export declare function machineLinkName(identity: MachineLinkIdentity): string;
+/** One device's live authority, as the host answers it for one act. */
+export type MachineLinkDeviceFacts = Readonly<{
+    live: false;
+}> | Readonly<MachineLinkIdentity & {
+    live: true;
+    memberId: string;
+    publicKey: string;
+    fenceEpoch: number;
+}>;
+/** Retained authority, including a revoked device's last committed fence. */
+export type MachineLinkFenceFact = Readonly<MachineLinkIdentity & {
+    live: boolean;
+    fenceEpoch: number;
+}>;
+export declare const machineLinkFenceResultSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        unconfirmed: "unconfirmed";
+        confirmed: "confirmed";
+    }>;
+    fenceEpoch: z.ZodInt;
+}, z.core.$strict>;
+export type MachineLinkFenceResult = z.infer<typeof machineLinkFenceResultSchema>;
+/** Device identity comes from the forwarding link's pin, never the mail body. */
+export declare const machineLinkCallerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"hosted">;
+    agentId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"device">;
+    deviceId: z.ZodString;
+    agentId: z.ZodString;
+}, z.core.$strict>], "kind">;
+export type MachineLinkCaller = z.infer<typeof machineLinkCallerSchema>;
+export declare const machineLinkFenceFactSchema: z.ZodObject<{
+    teamId: z.ZodString;
+    deviceId: z.ZodString;
+    live: z.ZodBoolean;
+    fenceEpoch: z.ZodInt;
+}, z.core.$strict>;
+/** The host's current facts for one addressed operation or mail. */
+export type MachineLinkTargetFacts = Readonly<{
+    teamId: string;
+    callerAgentId: string;
+    targetAgentId: string;
+    /** The Agent the target acts for: the settlement requester, or the caller. */
+    actorAgentId: string;
+    /** The caller's own home; the link checks it against the caller it saw. */
+    callerHome: MachineAgentHome;
+    targetHome: MachineAgentHome;
+}>;
+/**
+ * Everything a machine link asks its host. Every method is a fresh live read
+ * for one dial, frame, delivery or operation; the link never caches an answer.
+ * The Hub answers through its Team control boundary, a standalone Oyster
+ * through its owner's key and grants.
+ */
+export type MachineLinkAuthority = Readonly<{
+    /** Device present and unrevoked, owner/member live, current key and epoch. */
+    admitDevice(id: MachineLinkIdentity): Promise<MachineLinkDeviceFacts>;
+    /** Retained fence facts, including a revoked device; null for an unknown one. */
+    currentFence(id: MachineLinkIdentity): Promise<MachineLinkFenceFact | null>;
+    /** Public Agent entries this device may see. */
+    directory(id: MachineLinkIdentity): Promise<readonly {
+        agentId: string;
+        name: string;
+    }[]>;
+    /** Sender, actor and the target's actual home, rechecked for this act. */
+    resolveTarget(id: MachineLinkIdentity, caller: MachineLinkCaller, agentId: string, requesterAgentId: string | null): Promise<MachineLinkTargetFacts>;
+    /** Carry mail received from this device to its target's actual home. */
+    deliverHome(id: MachineLinkIdentity, caller: MachineLinkCaller, target: MachineLinkTargetFacts, envelope: PostEnvelope): Promise<PostDeliveryResult>;
+    /** Whether this link's replay ledger may be erased now. */
+    canErase(id: MachineLinkIdentity): Promise<boolean>;
+    /** Push one committed fence fact to the device's link (C2 promptness). */
+    deliverControlFact(fact: MachineLinkFenceFact): Promise<MachineLinkFenceResult>;
+}>;
+/** A link refusal, decoded by the host into its own error vocabulary. */
+export declare class MachineLinkRefused extends Error {
+    readonly reason: "actor_not_allowed" | "unavailable";
+    constructor(reason: "actor_not_allowed" | "unavailable");
+}

package/dist/machine-link/authority.js

@@ -0,0 +1,37 @@
+import { z } from "zod";
+const id = z.string().min(1).max(256);
+export const machineLinkIdentitySchema = z.strictObject({
+    teamId: id,
+    deviceId: id,
+});
+/** One canonical device owner, not a Team's socket collection. */
+export function machineLinkName(identity) {
+    return JSON.stringify(machineLinkIdentitySchema.parse({
+        teamId: identity.teamId,
+        deviceId: identity.deviceId,
+    }));
+}
+export const machineLinkFenceResultSchema = z.strictObject({
+    kind: z.enum(["confirmed", "unconfirmed"]),
+    fenceEpoch: z.int().nonnegative(),
+});
+/** Device identity comes from the forwarding link's pin, never the mail body. */
+export const machineLinkCallerSchema = z.discriminatedUnion("kind", [
+    z.strictObject({ kind: z.literal("hosted"), agentId: id }),
+    z.strictObject({ kind: z.literal("device"), deviceId: id, agentId: id }),
+]);
+export const machineLinkFenceFactSchema = z.strictObject({
+    teamId: id,
+    deviceId: id,
+    live: z.boolean(),
+    fenceEpoch: z.int().nonnegative(),
+});
+/** A link refusal, decoded by the host into its own error vocabulary. */
+export class MachineLinkRefused extends Error {
+    reason;
+    constructor(reason) {
+        super(`machine-link:${reason}`);
+        this.reason = reason;
+        this.name = "MachineLinkRefused";
+    }
+}

package/dist/machine-link/client.d.ts

@@ -0,0 +1,66 @@
+import type * as Schema from "effect/Schema";
+import type { PostEnvelope, PostDeliveryResult } from "@fungi.computer/carrier/post";
+import type { MachineAgentOperation } from "@fungi.computer/seam/machine-link-protocol";
+import type { MachineAgentHome } from "./home.js";
+import type { MachineLink } from "./link.js";
+import { type MachineLinkCaller, type MachineLinkIdentity } from "./authority.js";
+/** The caller a hosted settlement read acts for. */
+export type MachineAgentSettlementPrincipal = Readonly<{
+    teamId: string;
+    actor: Readonly<{
+        kind: "agent";
+        id: string;
+    }>;
+}>;
+/**
+ * The host's Agent wire grammar. This module routes Agent work by home and
+ * never decodes an Agent body itself. Each codec must be strict: it is the
+ * only decoder of caller bodies and of settlements a device returns.
+ */
+export type MachineAgentCodecs<Settlement> = Readonly<{
+    /** The Session-creation intent, or null when the body is not one. */
+    sessionCreation(body: Schema.Json): Readonly<{
+        requestId: string;
+    }> | null;
+    /** One serialized settlement from a hosted or machine-homed Agent. */
+    settlement(encoded: string): Settlement;
+    /** Throws unless an acknowledgment carries a well-formed Accepted receipt. */
+    accepted(receipt: Schema.Json): void;
+}>;
+/** The device link entry points a hosted caller needs. */
+export type MachineAgentLinkPort = Readonly<{
+    deliver(identity: MachineLinkIdentity, caller: MachineLinkCaller, agentId: string, envelope: PostEnvelope): Promise<PostDeliveryResult>;
+    operation(identity: MachineLinkIdentity, caller: MachineLinkCaller, agentId: string, operation: MachineAgentOperation): ReturnType<MachineLink["operation"]>;
+}>;
+/**
+ * Actual-home routing for a hosted Agent's mail, Session creation and
+ * settlement reads. A machine-homed target goes to its device link and never
+ * falls back to a hosted Agent; the host supplies the fresh home read.
+ */
+export declare function createMachineAgentClient<Settlement>(options: {
+    identity: () => Readonly<{
+        teamId: string;
+        agentId: string;
+    }> | null;
+    links: {
+        getByName(name: string): MachineAgentLinkPort;
+    };
+    /** The target's current home, read fresh for this act. */
+    home: (agentId: string) => Promise<MachineAgentHome>;
+    codecs: MachineAgentCodecs<Settlement>;
+    hosted: {
+        getByName(name: string): {
+            deliver(envelope: PostEnvelope): Promise<PostDeliveryResult>;
+            fetch(request: Request): Promise<Response>;
+            settlement(principal: MachineAgentSettlementPrincipal, sessionId: string, commandId: string): Promise<string | undefined>;
+        };
+    };
+}): {
+    namespace: {
+        getByName: (agentId: string) => {
+            deliver: (envelope: PostEnvelope) => Promise<PostDeliveryResult>;
+        };
+    };
+    dispatch: (agentId: string, request: Request) => Promise<Response>;
+    settlement: (agentId: string, sessionId: string, commandId: string, requesterAgentId: string) => Promise<Settlement | undefined>;
+};

package/dist/machine-link/client.js

@@ -0,0 +1,94 @@
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { validator } from "hono/validator";
+import { z } from "zod";
+import { createHomeAwareAgentMailNamespace } from "./delivery.js";
+import { machineLinkName, } from "./authority.js";
+const identity = z.string().min(1).max(256);
+/**
+ * Actual-home routing for a hosted Agent's mail, Session creation and
+ * settlement reads. A machine-homed target goes to its device link and never
+ * falls back to a hosted Agent; the host supplies the fresh home read.
+ */
+export function createMachineAgentClient(options) {
+    function actor() {
+        const current = options.identity();
+        if (current === null)
+            throw new Error("Agent Team identity is unavailable");
+        return current;
+    }
+    const home = (agentId) => options.home(agentId);
+    const machine = (deviceId) => {
+        const current = actor();
+        const identity = { teamId: current.teamId, deviceId };
+        const caller = {
+            kind: "hosted",
+            agentId: current.agentId,
+        };
+        return {
+            identity,
+            caller,
+            link: options.links.getByName(machineLinkName(identity)),
+        };
+    };
+    return {
+        namespace: {
+            getByName: (agentId) => ({
+                deliver: async (envelope) => {
+                    return await createHomeAwareAgentMailNamespace({
+                        sender: actor(),
+                        home,
+                        hosted: options.hosted,
+                        accepted: options.codecs.accepted,
+                        machine: (deviceId, cargo) => {
+                            const target = machine(deviceId);
+                            return target.link.deliver(target.identity, target.caller, agentId, cargo);
+                        },
+                    })
+                        .getByName(agentId)
+                        .deliver(envelope);
+                },
+            }),
+        },
+        dispatch: async (agentId, request) => {
+            const targetHome = await home(agentId);
+            if (targetHome.kind === "hosted")
+                return await options.hosted.getByName(agentId).fetch(request);
+            const routes = new Hono().post("/sessions", bodyLimit({ maxSize: 512 * 1024 }), 
+            // Hono hands over the parsed JSON body; the host codec decodes it.
+            validator("json", (value, context) => {
+                const parsed = options.codecs.sessionCreation(value);
+                if (parsed === null)
+                    return context.json({ error: "invalid" }, 400);
+                return parsed;
+            }), async (context) => {
+                const target = machine(targetHome.deviceId);
+                const result = z.strictObject({ sessionId: identity }).parse(await target.link.operation(target.identity, target.caller, agentId, {
+                    type: "createSession",
+                    requestId: context.req.valid("json").requestId,
+                }));
+                return context.json(result, 201);
+            });
+            return await routes.fetch(request);
+        },
+        settlement: async (agentId, sessionId, commandId, requesterAgentId) => {
+            const targetHome = await home(agentId);
+            const current = actor();
+            const target = targetHome.kind === "machine" ? machine(targetHome.deviceId) : null;
+            const encoded = target === null
+                ? await options.hosted.getByName(agentId).settlement({
+                    teamId: current.teamId,
+                    actor: { kind: "agent", id: requesterAgentId },
+                }, sessionId, commandId)
+                : (z.strictObject({ settlement: z.string().nullable() }).parse(await target.link.operation(target.identity, target.caller, agentId, {
+                    type: "settlement",
+                    requesterAgentId,
+                    sessionId,
+                    commandId,
+                })).settlement ?? undefined);
+            return encoded === undefined
+                ? undefined
+                : options.codecs.settlement(encoded);
+        },
+    };
+}

package/dist/machine-link/delivery.d.ts

@@ -0,0 +1,18 @@
+import * as Schema from "effect/Schema";
+import { type PostEnvelope, type PostDeliveryResult, type PostRoute } from "@fungi.computer/carrier/post";
+import { type MachineAgentHome } from "./home.js";
+/**
+ * Home selection only, as the namespace under the host's disclosure-owning
+ * Agent mail route. Carrier retains retries; the receiving Agent admits work.
+ */
+export declare function createHomeAwareAgentMailNamespace(options: {
+    sender: Readonly<{
+        teamId: string;
+        agentId: string;
+    }>;
+    home: (agentId: string) => Promise<MachineAgentHome | null>;
+    hosted: PostRoute<never, never>["namespace"];
+    machine: (deviceId: string, envelope: PostEnvelope) => Promise<PostDeliveryResult>;
+    /** Host's Agent grammar: throws unless the receipt is a well-formed Accepted. */
+    accepted: (receipt: Schema.Json) => void;
+}): PostRoute<never, never>["namespace"];

package/dist/machine-link/delivery.js

@@ -0,0 +1,55 @@
+import * as Schema from "effect/Schema";
+import { BirdDogMailSchema } from "@fungi.computer/bird-dog/effect";
+import { PostEnvelopeSchema, PostDeliveryResultSchema, } from "@fungi.computer/carrier/post";
+import { agentMailAddressSchema } from "@fungi.computer/seam/machine-link-protocol";
+import { decodeMachineAgentHome } from "./home.js";
+/**
+ * Home selection only, as the namespace under the host's disclosure-owning
+ * Agent mail route. Carrier retains retries; the receiving Agent admits work.
+ */
+export function createHomeAwareAgentMailNamespace(options) {
+    return {
+        getByName: (agentId) => ({
+            deliver: async (raw) => {
+                if (new TextEncoder().encode(JSON.stringify(raw)).byteLength >
+                    512 * 1024)
+                    return "refused";
+                const envelope = Schema.decodeUnknownSync(PostEnvelopeSchema, {
+                    onExcessProperty: "error",
+                })(raw);
+                const address = Schema.decodeUnknownSync(agentMailAddressSchema, {
+                    onExcessProperty: "error",
+                })(envelope.address);
+                const mail = Schema.decodeUnknownSync(BirdDogMailSchema, {
+                    onExcessProperty: "error",
+                })(envelope.event);
+                if (envelope.kind !== "agentMail" ||
+                    envelope.key !== mail.key ||
+                    address.scopeId !== options.sender.teamId ||
+                    address.agentId !== agentId ||
+                    mail.to.agentId !== agentId ||
+                    mail.from.agentId !== options.sender.agentId ||
+                    new TextEncoder().encode(JSON.stringify(mail)).byteLength > 256 * 1024)
+                    return "refused";
+                const projected = await options.home(agentId);
+                if (projected === null)
+                    return "refused";
+                const home = decodeMachineAgentHome(projected);
+                // Unavailable machine transport must throw for Carrier retry, never
+                // fall back to a hosted Agent or manufacture a custody/command receipt.
+                const result = Schema.decodeUnknownSync(PostDeliveryResultSchema)(await (home.kind === "hosted"
+                    ? options.hosted.getByName(agentId).deliver(envelope)
+                    : options.machine(home.deviceId, envelope)));
+                if (result === "refused")
+                    return result;
+                if (result === "accepted" ||
+                    result === "duplicate" ||
+                    !("receipt" in result))
+                    throw new Error("Agent mail acknowledgment lacks an Accepted receipt");
+                if (result.status !== "refused")
+                    options.accepted(result.receipt);
+                return result;
+            },
+        }),
+    };
+}

package/dist/machine-link/enrollment.d.ts

@@ -0,0 +1,111 @@
+import type { MachineAgentHome } from "./home.js";
+import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+import { z } from "zod";
+/** Public keys and selected identities only; a local store path never crosses. */
+export declare const machineEnrollmentSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    publicKey: z.ZodBase64;
+    machineLabel: z.ZodString;
+    agents: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type MachineEnrollment = z.infer<typeof machineEnrollmentSchema>;
+/** Trusted Local OAuth facts, never supplied in the public enrollment body. */
+export declare const machineMemberSchema: z.ZodObject<{
+    memberId: z.ZodString;
+    clientId: z.ZodString;
+    loginId: z.ZodString;
+}, z.core.$strict>;
+export type MachineMember = z.infer<typeof machineMemberSchema>;
+/** Server-selected issuer facts; omitted fields match all of this member's devices. */
+export declare const machineLoginSelectionSchema: z.ZodObject<{
+    clientId: z.ZodOptional<z.ZodString>;
+    loginId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type MachineLoginSelection = z.infer<typeof machineLoginSelectionSchema>;
+/**
+ * Host-owned Agent identity reservation over the enrollment's own store. The
+ * same receipt yields the same Team Agent; no hosted Agent is opened.
+ */
+export type MachineAgentReservation = (reservation: Readonly<{
+    memberId: string;
+    requestId: string;
+    name: string;
+}>) => Readonly<{
+    agentId: string;
+}>;
+declare const limitsSchema: z.ZodObject<{
+    machines: z.ZodNumber;
+    agentsPerMachine: z.ZodNumber;
+}, z.core.$strict>;
+/** Honest enrollment refusals; none denotes command acceptance. */
+export declare class MachineEnrollmentRefused extends Error {
+    readonly reason: "request_conflict" | "capacity" | "device_revoked" | "login_not_current";
+    constructor(reason: "request_conflict" | "capacity" | "device_revoked" | "login_not_current");
+}
+/**
+ * Team-owned enrollment state over the ordinary Agent directory, not a second
+ * hosted runtime. Its caller must supply the live, member-authorized identity.
+ * Limits are captured host policy; this module does not invent a Team quota.
+ */
+export declare function createMachineEnrollment(options: {
+    owner: WatchdogSqliteOwner;
+    limits: z.infer<typeof limitsSchema>;
+    authorizeMember: (memberId: string) => Promise<void>;
+    authorizeLogin: (member: MachineMember) => Promise<boolean>;
+    onAgentCreated: (agentId: string) => void;
+    /** The host's Agent directory, opened over this enrollment's store. */
+    agents: (sql: WatchdogSqliteOwner["sql"]) => MachineAgentReservation;
+}): {
+    enroll: (rawMember: MachineMember, raw: MachineEnrollment) => Promise<{
+        deviceId: string;
+        agents: {
+            selection: number;
+            agentId: string;
+        }[];
+    }>;
+    device: (deviceId: string) => {
+        deviceId: string;
+        memberId: string;
+        clientId: string;
+        loginId: string;
+        publicKey: string;
+        machineLabel: string;
+        fenceEpoch: number;
+    } | null;
+    home: (agentId: string) => MachineAgentHome | null;
+    revoke: (memberId: string, deviceId: string) => boolean;
+    authorizeDevice: (deviceId: string) => Promise<{
+        deviceId: string;
+        memberId: string;
+        clientId: string;
+        loginId: string;
+        publicKey: string;
+        machineLabel: string;
+        fenceEpoch: number;
+    }>;
+    retainedDevices: () => {
+        deviceId: string;
+        memberId: string;
+        clientId: string;
+        loginId: string;
+        revoked: boolean;
+        fenceEpoch: number;
+    }[];
+    fenceDevice: (deviceId: string) => number | null;
+    fenceMember: (memberId: string) => {
+        deviceId: string;
+        fenceEpoch: number;
+    }[];
+    fenceLogins: (memberId: string, selection: MachineLoginSelection) => {
+        deviceId: string;
+        fenceEpoch: number;
+    }[];
+    retireAllForErasure: () => {
+        deviceId: string;
+        fenceEpoch: number;
+    }[];
+    keyRetired: (deviceId: string) => boolean;
+};
+export {};