@fungi.computer/oyster 0.5.0 → 0.7.0

package/dist/build/build-jobs.d.ts

@@ -87,7 +87,7 @@ export declare function createTeamBuildPublisher(options: Readonly<{
         readonly expiresAt: number;
         readonly remote: string;
         readonly reportUrl: string;
-        readonly status: "revoked" | "running" | "failed" | "succeeded" | "interrupted";
+        readonly status: "revoked" | "failed" | "running" | "succeeded" | "interrupted";
         readonly artifact: {
             readonly digest: string;
             readonly bytes: number;
@@ -103,7 +103,7 @@ export declare function createTeamBuildPublisher(options: Readonly<{
         readonly expiresAt: number;
         readonly remote: string;
         readonly reportUrl: string;
-        readonly status: "revoked" | "running" | "failed" | "succeeded" | "interrupted";
+        readonly status: "revoked" | "failed" | "running" | "succeeded" | "interrupted";
         readonly artifact: {
             readonly digest: string;
             readonly bytes: number;

package/dist/build/candidate-builder.d.ts

@@ -56,6 +56,8 @@ export declare function buildTeamCandidate(input: {
     outputPath: string;
     /** Trusted Computer-local cache; never part of customer configuration. */
     packageStoreDirectory?: string;
+    /** Host-owned observation of raw subprocess output; never source configuration. */
+    onOutput?: (stream: "stdout" | "stderr", bytes: Uint8Array) => void;
 }): Promise<Readonly<{
     digest: string;
     bytes: number;

package/dist/build/candidate-builder.js

@@ -48,15 +48,19 @@ export async function buildTeamCandidate(input) {
     const onPhase = (phase, milliseconds) => {
         phases[phase] += milliseconds;
     };
+    const onOutput = (stream, bytes) => {
+        input.onOutput?.(stream, bytes);
+    };
     const prepareStarted = performance.now();
     const candidate = await Effect.runPromise(createCapturedCandidatePreparer(config, {
         sourceCapture: createLocalCommitSourceCapture(input.repositoryPath, config.sourceRevision),
         buildExecutor: createLocalBuildExecutor(input.packageStoreDirectory === undefined
-            ? { packageScripts: "run", onPhase }
+            ? { packageScripts: "run", onPhase, onOutput }
             : {
                 packageScripts: "run",
                 packageStoreDirectory: input.packageStoreDirectory,
                 onPhase,
+                onOutput,
             }),
     }).prepareCandidate(parseReleaseId("rel_build")));
     const prepared = performance.now() - prepareStarted;

package/dist/build/candidate-cli.js

@@ -32,6 +32,9 @@ try {
         outputPath,
         // Computer scratch survives captured snapshot cleanup, without a global or durable Workspace store.
         packageStoreDirectory: "/var/tmp/fungi-app-package-store",
+        onOutput: (stream, bytes) => {
+            process[stream].write(bytes);
+        },
     });
     const reportUrl = process.env.TEAM_BUILD_REPORT;
     if (!reportUrl)

package/dist/build/candidate-cli.mjs

@@ -19518,6 +19518,11 @@ var appBackendBindingKinds = {
         requires: ["workflow.run", "workflow.arm"],
         effect: "write"
       },
+      pauseSchedule: {
+        cap: "app.workflow.run",
+        requires: ["workflow.run", "workflow.arm"],
+        effect: "write"
+      },
       schedules: {
         cap: "app.workflow.read",
         requires: ["workflow.run"],
@@ -19659,7 +19664,22 @@ var appBackendBindingKinds = {
     name: "AGENTS",
     operations: {
       list: { cap: "agent.list", requires: ["agent.list"], effect: "read" },
-      send: { cap: "agent.send", requires: ["agent.send"], effect: "write" }
+      send: { cap: "agent.send", requires: ["agent.send"], effect: "write" },
+      schedules: {
+        cap: "agent.read",
+        requires: ["agent.read"],
+        effect: "read"
+      },
+      pauseSchedule: {
+        cap: "agent.manage",
+        requires: ["agent.manage"],
+        effect: "write"
+      },
+      deleteSchedule: {
+        cap: "agent.manage",
+        requires: ["agent.manage"],
+        effect: "write"
+      }
     }
   }
 };
@@ -19714,13 +19734,17 @@ var emptyAppDeclaration = Object.freeze({
 
 // ../puffball/dist/app-api.js
 var appApiMethodNameSchema = String4.check(makeFilter2(isAppApiMethodName));
+function isJsonContainer(value) {
+  return value !== null && typeof value === "object";
+}
 function withinDepth(value, depth = 0) {
   if (depth > 16)
     return false;
-  if (is2(ArraySchema(Json2))(value))
-    return value.every((child) => withinDepth(child, depth + 1));
-  if (is2(JsonObject)(value))
-    return Object.values(value).every((child) => withinDepth(child, depth + 1));
+  if (isJsonContainer(value)) {
+    for (const child of Object.values(value))
+      if (!withinDepth(child, depth + 1))
+        return false;
+  }
   return true;
 }
 var projection = JsonObject.pipe(check(makeFilter2((value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 2e4 && withinDepth(value), { message: "App API schema exceeds its byte or depth bound" })));
@@ -19731,15 +19755,12 @@ var method = Struct({
   output: projection,
   pending: optional2(Literal2(true)),
   hidden: optional2(Literal2(true)),
-  anonymous: optional2(Literal2(true)),
   present: optional2(Struct({
     verb: String4.check(isMinLength(1), isMaxLength(32))
   })),
   effect: Literals(["read", "write", "external"]),
   requires: ArraySchema(Literals(appCapabilityIds)).pipe(check(makeFilter2((values) => new Set(values).size === values.length)))
-}).check(makeFilter2((value) => value.anonymous !== true || value.effect === "read" && value.requires.length === 0, {
-  message: "Anonymous methods must be reads with no required capabilities"
-}));
+});
 var appApiSchema = Struct({
   methods: Record(String4, method).pipe(check(makeFilter2((methods) => Object.keys(methods).every(is2(appApiMethodNameSchema)), { message: "Invalid App API method name" })), check(makeFilter2((methods) => Object.keys(methods).length <= 64)), check(makeFilter2((methods) => {
     const names = Object.keys(methods);
@@ -21745,6 +21766,12 @@ var BirdDogSystemIdentitySchema = Struct({
   systemId: Literal2("hub")
 });
 var BIRD_DOG_DIAGNOSTIC_MAX_LENGTH = 200;
+var BIRD_DOG_WAITING_MAX_ITEMS = 8;
+var BirdDogWaitingItemSchema = Struct({
+  itemId: Identifier,
+  kind: String4.check(isMinLength(1), isMaxLength(64)),
+  summary: String4.check(isMinLength(1), isMaxLength(200))
+});
 var SettledBirdDogReplySchema = Struct({
   commandId: Identifier,
   outcome: Literals([
@@ -21754,7 +21781,8 @@ var SettledBirdDogReplySchema = Struct({
     "cancelled",
     "outcome_unknown"
   ]),
-  diagnostic: optionalKey2(String4.check(isMinLength(1), isMaxLength(BIRD_DOG_DIAGNOSTIC_MAX_LENGTH)))
+  diagnostic: optionalKey2(String4.check(isMinLength(1), isMaxLength(BIRD_DOG_DIAGNOSTIC_MAX_LENGTH))),
+  waitingOnYou: optionalKey2(ArraySchema(BirdDogWaitingItemSchema).check(isMinLength(1), isMaxLength(BIRD_DOG_WAITING_MAX_ITEMS)))
 });
 var BirdDogUndeliverableReasonSchema = Literals([
   "recipient_offline",
@@ -21835,6 +21863,7 @@ var BirdDogAgentJobPayloadSchema = Struct({
 });
 var BirdDogAgentJobInputSchema = Struct({
   work: BirdDogAgentWorkSchema,
+  delivery: Literals(["steer", "followUp"]),
   mail: optional2(BirdDogMailSchema)
 });
 
@@ -35634,7 +35663,7 @@ async function stopHtmlGroup(child) {
   }
   throw new Error("HTML process group survived its five-second cleanup bound");
 }
-function runHtmlCommand(args2, cwd, env, command = "pnpm") {
+function runHtmlCommand(args2, cwd, env, command = "pnpm", onOutput) {
   return acquireUseRelease2(
     sync2(() => {
       if (process.platform === "win32")
@@ -35649,11 +35678,13 @@ function runHtmlCommand(args2, cwd, env, command = "pnpm") {
         let stdout = "";
         let stderr = "";
         child.stdout.on("data", (chunk) => {
+          onOutput?.("stdout", chunk);
           stdout += chunk.toString();
           if (Buffer2.byteLength(stdout) > 1024 * 1024)
             reject(new Error("HTML command output exceeded its bound"));
         });
         child.stderr.on("data", (chunk) => {
+          onOutput?.("stderr", chunk);
           stderr += chunk.toString();
           if (Buffer2.byteLength(stderr) > 1024 * 1024)
             reject(new Error("HTML command diagnostics exceeded their bound"));
@@ -35694,10 +35725,10 @@ function snapshotBuildEnvironment(sourceSnapshotPath) {
 }
 function rebuildViteSnapshot(sourceSnapshotPath, recipe, options) {
   if (recipe.kind === "source-html")
-    return rebuildNpmSnapshot(sourceSnapshotPath, recipe);
+    return rebuildNpmSnapshot(sourceSnapshotPath, recipe, options);
   return gen2(function* () {
     const env = snapshotBuildEnvironment(sourceSnapshotPath);
-    const run2 = (args2, cwd = sourceSnapshotPath) => runHtmlCommand(args2, cwd, env);
+    const run2 = (args2, cwd = sourceSnapshotPath) => runHtmlCommand(args2, cwd, env, "pnpm", options.onOutput);
     if ((yield* run2(["--version"])).trim() !== "11.24.0") {
       return yield* fail5(new Error("Publisher requires pnpm 11.24.0"));
     }
@@ -35915,7 +35946,7 @@ function readHtmlBuildOutput(sourceSnapshotPath, recipe) {
     return Object.freeze({ kind: "bytes", bytes });
   });
 }
-function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
+function rebuildNpmSnapshot(sourceSnapshotPath, recipe, options) {
   return gen2(function* () {
     const env = snapshotBuildEnvironment(sourceSnapshotPath);
     const home = join5(sourceSnapshotPath, ".publisher-home");
@@ -35932,7 +35963,8 @@ function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
       ["--version"],
       sourceSnapshotPath,
       env,
-      "npm"
+      "npm",
+      options.onOutput
     )).trim() !== recipe.toolchain.npm)
       return yield* fail5(
         new Error("Captured npm version differs from the recipe")
@@ -35941,7 +35973,8 @@ function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
       ["ci", "--include=dev", "--ignore-scripts", "--no-audit", "--no-fund"],
       sourceSnapshotPath,
       env,
-      "npm"
+      "npm",
+      options.onOutput
     );
     const program = join5(sourceSnapshotPath, ".publisher-build.mjs");
     yield* tryPromise2(async () => {
@@ -35962,7 +35995,8 @@ function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
       ],
       sourceSnapshotPath,
       env,
-      "node"
+      "node",
+      options.onOutput
     );
     return yield* readHtmlBuildOutput(sourceSnapshotPath, recipe);
   });
@@ -36103,7 +36137,9 @@ function createLocalBuildExecutor(options = {}) {
               if ((yield* runHtmlCommand(
                 ["--version"],
                 source.snapshotPath,
-                environment
+                environment,
+                "pnpm",
+                options.onOutput
               )).trim() !== "11.24.0")
                 return yield* fail5(
                   new Error("Publisher requires pnpm 11.24.0")
@@ -36114,7 +36150,9 @@ function createLocalBuildExecutor(options = {}) {
                   options.packageCacheDirectory
                 ),
                 source.snapshotPath,
-                environment
+                environment,
+                "pnpm",
+                options.onOutput
               );
             }
           }
@@ -36265,6 +36303,9 @@ async function buildTeamCandidate(input) {
   const onPhase = (phase, milliseconds) => {
     phases[phase] += milliseconds;
   };
+  const onOutput = (stream, bytes2) => {
+    input.onOutput?.(stream, bytes2);
+  };
   const prepareStarted = performance.now();
   const candidate = await runPromise2(
     createCapturedCandidatePreparer(config2, {
@@ -36273,10 +36314,11 @@ async function buildTeamCandidate(input) {
         config2.sourceRevision
       ),
       buildExecutor: createLocalBuildExecutor(
-        input.packageStoreDirectory === void 0 ? { packageScripts: "run", onPhase } : {
+        input.packageStoreDirectory === void 0 ? { packageScripts: "run", onPhase, onOutput } : {
           packageScripts: "run",
           packageStoreDirectory: input.packageStoreDirectory,
-          onPhase
+          onPhase,
+          onOutput
         }
       )
     }).prepareCandidate(parseReleaseId("rel_build"))
@@ -36347,7 +36389,10 @@ try {
     repositoryPath,
     outputPath,
     // Computer scratch survives captured snapshot cleanup, without a global or durable Workspace store.
-    packageStoreDirectory: "/var/tmp/fungi-app-package-store"
+    packageStoreDirectory: "/var/tmp/fungi-app-package-store",
+    onOutput: (stream, bytes) => {
+      process[stream].write(bytes);
+    }
   });
   const reportUrl = process.env.TEAM_BUILD_REPORT;
   if (!reportUrl) throw new TeamCandidateBuildError("report_failed");

package/dist/build/job-log.d.ts

@@ -0,0 +1,23 @@
+import * as Schema from "effect/Schema";
+/** Maximum retained combined stdout/stderr bytes, split equally into head and tail. */
+export declare const buildJobLogMaxBytes: number;
+/** Base64url preserves raw command bytes, including split UTF-8 and terminal control bytes. */
+export declare const buildJobLogSchema: Schema.Struct<{
+    readonly encoding: Schema.Literal<"base64url">;
+    readonly output: Schema.String;
+    readonly truncated: Schema.NullOr<Schema.Struct<{
+        readonly droppedBytes: Schema.Number;
+    }>>;
+}>;
+export type BuildJobLog = Schema.Schema.Type<typeof buildJobLogSchema>;
+/** The artifact-upload door cannot write this host-owned job-log namespace. */
+export declare const isBuildJobLogRef: (ref: string) => boolean;
+/** One bounded raw-event sink; event arrival order is the combined output order. */
+export declare function createBuildJobLog(): {
+    /** Retained buffer capacity, distinct from the transient encoded result. */
+    readonly allocatedBytes: number;
+    append(bytes: Uint8Array): void;
+    finish(): BuildJobLog;
+};
+/** Preserve BirdDog's redacted 200-character status/mail budget and name the full log. */
+export declare function buildJobDiagnostic(jobId: string, detail: string): string;

package/dist/build/job-log.js

@@ -0,0 +1,88 @@
+import * as Schema from "effect/Schema";
+import { base64url } from "jose";
+import { boundedDiagnostic } from "@fungi.computer/bird-dog/effect";
+/** Maximum retained combined stdout/stderr bytes, split equally into head and tail. */
+export const buildJobLogMaxBytes = 2 * 1024 * 1024;
+/** Base64url preserves raw command bytes, including split UTF-8 and terminal control bytes. */
+export const buildJobLogSchema = Schema.Struct({
+    encoding: Schema.Literal("base64url"),
+    output: Schema.String.check(Schema.isMaxLength(Math.ceil(buildJobLogMaxBytes / 3) * 4)),
+    truncated: Schema.NullOr(Schema.Struct({
+        droppedBytes: Schema.Number.check(Schema.isInt(), Schema.isGreaterThan(0)),
+    })),
+});
+/** The artifact-upload door cannot write this host-owned job-log namespace. */
+export const isBuildJobLogRef = (ref) => ref.startsWith("artifact:build-log-");
+/** One bounded raw-event sink; event arrival order is the combined output order. */
+export function createBuildJobLog() {
+    const half = buildJobLogMaxBytes / 2;
+    let head = new Uint8Array(0);
+    let tail = new Uint8Array(0);
+    let headBytes = 0;
+    let tailBytes = 0;
+    let tailPosition = 0;
+    let total = 0;
+    const capacityFor = (current, needed) => Math.min(half, Math.max(needed, current === 0 ? 4096 : current * 2));
+    return {
+        /** Retained buffer capacity, distinct from the transient encoded result. */
+        get allocatedBytes() {
+            return head.byteLength + tail.byteLength;
+        },
+        append(bytes) {
+            total += bytes.byteLength;
+            const prefix = Math.min(half - headBytes, bytes.byteLength);
+            if (headBytes + prefix > head.byteLength) {
+                const next = new Uint8Array(capacityFor(head.byteLength, headBytes + prefix));
+                next.set(head.subarray(0, headBytes));
+                head = next;
+            }
+            head.set(bytes.subarray(0, prefix), headBytes);
+            headBytes += prefix;
+            const remaining = bytes.subarray(prefix);
+            if (remaining.byteLength === 0)
+                return;
+            const needed = Math.min(half, tailBytes + remaining.byteLength);
+            if (needed > tail.byteLength) {
+                const next = new Uint8Array(capacityFor(tail.byteLength, needed));
+                const start = tailBytes === tail.byteLength ? tailPosition : 0;
+                const first = Math.min(tailBytes, tail.byteLength - start);
+                next.set(tail.subarray(start, start + first));
+                next.set(tail.subarray(0, tailBytes - first), first);
+                tail = next;
+                tailPosition = tailBytes;
+            }
+            const suffix = remaining.subarray(Math.max(0, remaining.byteLength - half));
+            if (remaining.byteLength >= half) {
+                tailBytes = 0;
+                tailPosition = 0;
+            }
+            const first = Math.min(suffix.byteLength, tail.byteLength - tailPosition);
+            tail.set(suffix.subarray(0, first), tailPosition);
+            tail.set(suffix.subarray(first), 0);
+            tailPosition = (tailPosition + suffix.byteLength) % tail.byteLength;
+            tailBytes = Math.min(half, tailBytes + remaining.byteLength);
+        },
+        finish() {
+            const bytes = new Uint8Array(headBytes + tailBytes);
+            bytes.set(head.subarray(0, headBytes));
+            const start = tailBytes === tail.byteLength ? tailPosition : 0;
+            const first = Math.min(tailBytes, tail.byteLength - start);
+            bytes.set(tail.subarray(start, start + first), headBytes);
+            bytes.set(tail.subarray(0, tailBytes - first), headBytes + first);
+            const droppedBytes = total - bytes.byteLength;
+            return {
+                encoding: "base64url",
+                output: base64url.encode(bytes),
+                truncated: droppedBytes === 0 ? null : { droppedBytes },
+            };
+        },
+    };
+}
+/** The job read door, not an artifact-serving URL. */
+const buildJobLogReference = (jobId) => `/api/builds/${encodeURIComponent(jobId)}?log`;
+/** Preserve BirdDog's redacted 200-character status/mail budget and name the full log. */
+export function buildJobDiagnostic(jobId, detail) {
+    const reference = `Log: ${buildJobLogReference(jobId)}`;
+    const diagnostic = boundedDiagnostic(detail) ?? "Build finished";
+    return `${reference}\n${diagnostic.slice(0, 200 - reference.length - 1)}`;
+}

package/dist/build/local-build.d.ts

@@ -53,6 +53,8 @@ export type LocalBuildExecutorOptions = Readonly<{
     packageScripts?: "run";
     /** Hears how long the dependency install and the compile each took. */
     onPhase?: (phase: "install" | "build", milliseconds: number) => void;
+    /** Forward raw install/build output to the admitted Computer's job log. */
+    onOutput?: (stream: "stdout" | "stderr", bytes: Uint8Array) => void;
 }>;
 /** Exact pinned esbuild options shared by local builds and artifact-budget proofs. */
 export declare function localSnapshotBuildOptions(source: CapturedSource, recipe: PinnedRecipe, emission: DefinitionEmission): esbuild.BuildOptions;

package/dist/build/local-build.js

@@ -571,7 +571,7 @@ async function stopHtmlGroup(child) {
     }
     throw new Error("HTML process group survived its five-second cleanup bound");
 }
-function runHtmlCommand(args, cwd, env, command = "pnpm") {
+function runHtmlCommand(args, cwd, env, command = "pnpm", onOutput) {
     return Effect.acquireUseRelease(Effect.sync(() => {
         if (process.platform === "win32")
             throw new Error("HTML builds require POSIX process groups");
@@ -585,11 +585,13 @@ function runHtmlCommand(args, cwd, env, command = "pnpm") {
             let stdout = "";
             let stderr = "";
             child.stdout.on("data", (chunk) => {
+                onOutput?.("stdout", chunk);
                 stdout += chunk.toString();
                 if (Buffer.byteLength(stdout) > 1024 * 1024)
                     reject(new Error("HTML command output exceeded its bound"));
             });
             child.stderr.on("data", (chunk) => {
+                onOutput?.("stderr", chunk);
                 stderr += chunk.toString();
                 if (Buffer.byteLength(stderr) > 1024 * 1024)
                     reject(new Error("HTML command diagnostics exceeded their bound"));
@@ -632,10 +634,10 @@ function snapshotBuildEnvironment(sourceSnapshotPath) {
 }
 function rebuildViteSnapshot(sourceSnapshotPath, recipe, options) {
     if (recipe.kind === "source-html")
-        return rebuildNpmSnapshot(sourceSnapshotPath, recipe);
+        return rebuildNpmSnapshot(sourceSnapshotPath, recipe, options);
     return Effect.gen(function* () {
         const env = snapshotBuildEnvironment(sourceSnapshotPath);
-        const run = (args, cwd = sourceSnapshotPath) => runHtmlCommand(args, cwd, env);
+        const run = (args, cwd = sourceSnapshotPath) => runHtmlCommand(args, cwd, env, "pnpm", options.onOutput);
         if ((yield* run(["--version"])).trim() !== "11.24.0") {
             return yield* Effect.fail(new Error("Publisher requires pnpm 11.24.0"));
         }
@@ -827,7 +829,7 @@ function readHtmlBuildOutput(sourceSnapshotPath, recipe) {
         return Object.freeze({ kind: "bytes", bytes });
     });
 }
-function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
+function rebuildNpmSnapshot(sourceSnapshotPath, recipe, options) {
     return Effect.gen(function* () {
         const env = snapshotBuildEnvironment(sourceSnapshotPath);
         const home = join(sourceSnapshotPath, ".publisher-home");
@@ -840,9 +842,9 @@ function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
             await writeFile(userConfig, "", { flag: "wx" });
             await writeFile(globalConfig, "", { flag: "wx" });
         });
-        if ((yield* runHtmlCommand(["--version"], sourceSnapshotPath, env, "npm")).trim() !== recipe.toolchain.npm)
+        if ((yield* runHtmlCommand(["--version"], sourceSnapshotPath, env, "npm", options.onOutput)).trim() !== recipe.toolchain.npm)
             return yield* Effect.fail(new Error("Captured npm version differs from the recipe"));
-        yield* runHtmlCommand(["ci", "--include=dev", "--ignore-scripts", "--no-audit", "--no-fund"], sourceSnapshotPath, env, "npm");
+        yield* runHtmlCommand(["ci", "--include=dev", "--ignore-scripts", "--no-audit", "--no-fund"], sourceSnapshotPath, env, "npm", options.onOutput);
         const program = join(sourceSnapshotPath, ".publisher-build.mjs");
         yield* Effect.tryPromise(async () => {
             const { htmlBuildProgram } = await snapshotPrograms();
@@ -858,7 +860,7 @@ function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
             dirname(recipe.entry),
             "true",
             "",
-        ], sourceSnapshotPath, env, "node");
+        ], sourceSnapshotPath, env, "node", options.onOutput);
         return yield* readHtmlBuildOutput(sourceSnapshotPath, recipe);
     });
 }
@@ -982,9 +984,9 @@ export function createLocalBuildExecutor(options = {}) {
                                 })))(await readFile(join(source.snapshotPath, "package.json"), "utf8"));
                             });
                             const environment = snapshotBuildEnvironment(source.snapshotPath);
-                            if ((yield* runHtmlCommand(["--version"], source.snapshotPath, environment)).trim() !== "11.24.0")
+                            if ((yield* runHtmlCommand(["--version"], source.snapshotPath, environment, "pnpm", options.onOutput)).trim() !== "11.24.0")
                                 return yield* Effect.fail(new Error("Publisher requires pnpm 11.24.0"));
-                            yield* runHtmlCommand(frozenSnapshotInstallArguments(options.packageStoreDirectory, options.packageCacheDirectory), source.snapshotPath, environment);
+                            yield* runHtmlCommand(frozenSnapshotInstallArguments(options.packageStoreDirectory, options.packageCacheDirectory), source.snapshotPath, environment, "pnpm", options.onOutput);
                         }
                     }
                     const ui = yield* recipe.kind === "bundled-html"

package/dist/channels/binding.d.ts

@@ -9,11 +9,18 @@ export type ConversationBinding = Readonly<{
         verifier: "fungi-v1" | "github" | "secret-url";
         eventsPerMinute: number;
     }> | Readonly<{
-        provider: "web" | "discord" | "email" | "game";
+        provider: "web";
+        siteKey: string;
+        origins: readonly string[];
+        accent?: string | undefined;
+    }> | Readonly<{
+        provider: "discord" | "email" | "game";
     }>;
     /** Zod's optional binding projection may carry an explicit undefined. */
     limits?: BindingLimits | undefined;
 }>;
+/** Does one allowlisted origin admit this exact browser origin? */
+export declare function originAllowed(allowed: readonly string[], origin: string): boolean;
 /** Per-party edge limits applied before any work is accepted. */
 export declare const bindingLimitsSchema: z.ZodObject<{
     messagesPerPartyPerDay: z.ZodNumber;

package/dist/channels/binding.js

@@ -1,5 +1,17 @@
 import { z } from "zod";
 import { channelIds } from "./ids.js";
+/** Does one allowlisted origin admit this exact browser origin? */
+export function originAllowed(allowed, origin) {
+    return allowed.some((entry) => {
+        if (!entry.startsWith("https://*."))
+            return entry === origin;
+        const suffix = entry.slice("https://*".length);
+        if (!origin.startsWith("https://") || !origin.endsWith(suffix))
+            return false;
+        const label = origin.slice("https://".length, -suffix.length);
+        return label.length > 0 && !label.includes(".");
+    });
+}
 /** Per-party edge limits applied before any work is accepted. */
 export const bindingLimitsSchema = z.strictObject({
     messagesPerPartyPerDay: z.number().int().min(1).max(10_000),

package/dist/channels/conversations.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { type FungiAuthor, type AuthorMeta, type MessageMetaValue } from "@fungi.computer/agar/agents";
+import { type FungiAuthor, type AuthorMeta } from "@fungi.computer/agar/agents";
 import { type Handoff } from "@fungi.computer/agar/channels";
 import { type ConversationBinding, type ChannelParty } from "./binding.js";
 export type HandoffEvent = Readonly<{
@@ -124,12 +124,11 @@ export type ChannelWithdrawResult = Readonly<{
     commandId: string;
     sessionId?: string;
 }>;
-/** Only the pending fields a channel visitor can read. */
-export type ChannelPendingPrompt = Readonly<{
+/** A host-projected intent contains no private metadata or internal request key. */
+export type VisitorPendingPrompt = Readonly<{
     requestId: string;
     commandId: string;
     text: string;
-    meta?: MessageMetaValue | undefined;
     delivery: "steer" | "followUp";
     images?: readonly Readonly<{
         type: "image";
@@ -137,10 +136,22 @@ export type ChannelPendingPrompt = Readonly<{
         mimeType: string;
     }>[] | undefined;
 }>;
+/** Only public baseline pagination crosses the visitor Session port. */
+export type VisitorReadOptions = Readonly<{
+    limit?: number;
+    before?: string;
+}>;
 /** The channel's narrow Session port; hosts translate to their durable client. */
 export type SessionDoor = Readonly<{
     withdraw: (sessionId: string, requestId: string) => Promise<ChannelWithdrawResult>;
-    latestPending: (sessionId: string, visitor: FungiAuthor) => Promise<ChannelPendingPrompt | null>;
+    latestPending: (sessionId: string, visitor: FungiAuthor) => Promise<VisitorPendingPrompt | null>;
+    participantDocument: (sessionId: string, visitorId: string, options: VisitorReadOptions) => Promise<string>;
+    participantStream: (sessionId: string, visitorId: string, options: Readonly<{
+        expiresAt: number;
+        now: () => number;
+        release: () => void;
+        canRead: () => Promise<boolean>;
+    }>) => Promise<ReadableStream<Uint8Array>>;
     createSession: (requestId: string) => Promise<string>;
     /** Deliver this conversation Session's tool grants to the runtime. */
     deliverGrants: (sessionId: string) => void;

package/dist/channels/visitor-channel.d.ts

@@ -0,0 +1,53 @@
+import { type ConversationBinding } from "./binding.js";
+import { type ChannelConversations, type ChannelWithdrawResult, type InboundEvent, type IntakeResult, type SessionDoor, type VisitorPendingPrompt, type VisitorReadOptions } from "./conversations.js";
+import type { ChannelVisitors, VisitorGrant } from "./visitors.js";
+/**
+ * Web visitor sequencing only. The host owns authorization, its admission
+ * receipt and the Session implementation; identity and conversations can live
+ * in different stores (and, in standalone, different Agents).
+ */
+export declare function createVisitorChannel(options: Readonly<{
+    binding: (bindingId: string) => ConversationBinding | null;
+    visitors: () => ChannelVisitors;
+    conversations: () => ChannelConversations;
+    sessionDoor: () => SessionDoor;
+    intake: (event: InboundEvent) => Promise<IntakeResult>;
+    acquireStream: (bindingId: string, visitorId: string, addressHash: string) => (() => void) | null;
+    now: () => number;
+}>): {
+    mint: (bindingId: string, siteKey: string, addressHash: string) => Promise<VisitorGrant>;
+    refresh: (bindingId: string, secret: string) => Promise<VisitorGrant>;
+    rotate: (bindingId: string, siteKey: string, token: string, addressHash: string) => Promise<VisitorGrant | Readonly<{
+        kind: "unauthorized";
+    }>>;
+    send: (bindingId: string, token: string, requestId: string, text: string) => Promise<IntakeResult | Readonly<{
+        kind: "unauthorized";
+    }>>;
+    withdraw: (bindingId: string, token: string, rawRequestId: string) => Promise<ChannelWithdrawResult | Readonly<{
+        kind: "unauthorized";
+    }> | Readonly<{
+        kind: "denied";
+        reason: "event_conflict" | "new_party_limit" | "banned";
+    }>>;
+    latestPending: (bindingId: string, token: string) => Promise<VisitorPendingPrompt | null | Readonly<{
+        kind: "unauthorized";
+    }>>;
+    open: (bindingId: string, token: string, read: VisitorReadOptions) => Promise<Readonly<{
+        kind: "session";
+        snapshot: string;
+    }> | Readonly<{
+        kind: "unauthorized";
+    }> | Readonly<{
+        kind: "denied";
+        reason: "new_party_limit" | "banned";
+    }>>;
+    watch: (bindingId: string, token: string, canRead: (visitorId: string) => Promise<boolean>) => Promise<Readonly<{
+        kind: "stream";
+        body: ReadableStream<Uint8Array>;
+    }> | Readonly<{
+        kind: "empty" | "unauthorized";
+    }> | Readonly<{
+        kind: "denied";
+        reason: "suspended" | "stream_limit";
+    }>>;
+};