@fungi.computer/puffball 0.0.0-stage → 0.0.1

package/dist/app-declaration.js

@@ -0,0 +1,115 @@
+import { appDeclaredGillSchema, } from "@fungi.computer/gills";
+import { appBackendBindingsSchema, appBackendBindingOperation, } from "./app-backend-bindings.js";
+import * as Schema from "effect/Schema";
+import { backgroundSyncAllowed } from "./internal/background-sync.js";
+import { appApiMethodNameSchema, appApiSchema } from "./app-api.js";
+import * as SchemaParser from "effect/SchemaParser";
+import * as SchemaAST from "effect/SchemaAST";
+import * as SchemaTransformation from "effect/SchemaTransformation";
+import { appCapabilityIds, appHandlers, appRoles, appStorageScopes, } from "./app-vocabulary.js";
+export const appRoleSchema = Schema.Literals(appRoles);
+export const appCapabilityIdSchema = Schema.Literals(appCapabilityIds);
+export const appHandlerSchema = Schema.Literals(appHandlers);
+const unique = {
+    message: "App declaration entries must be unique",
+};
+const isUnique = (values) => new Set(values).size === values.length;
+/** Chords the shell reserves for its leader; no App may declare them. */
+const reservedBindings = new Set([
+    "super+k",
+    "meta+k",
+    "cmd+k",
+    "mod+k",
+    "ctrl+k",
+    "control+k",
+]);
+const meaningful = Schema.String.pipe(Schema.check(Schema.isMaxLength(256)), Schema.check(Schema.makeFilter((value) => value.trim().length > 0, {
+    message: "Declared command text must not be blank",
+})));
+const order = { order: Schema.optional(Schema.Int) };
+const ordered = Schema.Struct(order);
+/**
+ * One declared command: a Whistle definition's identity and projections.
+ * Runtime-only facts (availability, typed actions, slash argument grammar)
+ * are not part of the digest-covered declaration and are dropped on decode.
+ */
+export const appDeclaredCommandSchema = Schema.Struct({
+    id: meaningful.pipe(Schema.check(Schema.makeFilter((id) => !id.includes(":"), {
+        message: "Declared command IDs are namespace-local",
+    }))),
+    title: meaningful,
+    category: meaningful,
+    description: Schema.optional(Schema.String.pipe(Schema.check(Schema.isMaxLength(1024)))),
+    sigil: Schema.optional(meaningful.pipe(Schema.check(Schema.isMaxLength(64)))),
+    projections: Schema.optional(Schema.Struct({
+        bindings: Schema.optional(Schema.Struct({
+            ...order,
+            values: Schema.Array(meaningful).pipe(Schema.check(Schema.isMaxLength(16)), Schema.check(Schema.makeFilter((values) => !values.some((binding) => reservedBindings.has(binding.trim().toLowerCase())), { message: "Apps cannot bind the reserved leader chord" }))),
+        })),
+        agent: Schema.optional(Schema.Struct({ ...order, keybind: Schema.optional(Schema.String) })),
+        help: Schema.optional(ordered),
+        menu: Schema.optional(ordered),
+        palette: Schema.optional(ordered),
+        slash: Schema.optional(Schema.Struct({
+            ...order,
+            aliases: Schema.Array(meaningful).pipe(Schema.check(Schema.isMaxLength(16))),
+        })),
+    })),
+});
+const commandsAreUnique = (commands) => isUnique(commands.map((command) => command.id)) &&
+    isUnique(commands.flatMap((command) => command.projections?.slash?.aliases ?? []));
+const gillsAreUnique = (gills) => isUnique(gills.map((gill) => gill.id));
+/** Maintained grammar for one bounded key in an App's private storage. */
+export const appStorageKeyNameSchema = Schema.String.check(Schema.isPattern(/^[a-z][a-z0-9.-]{0,63}$/));
+const storageKeyFields = Schema.Struct({
+    key: appStorageKeyNameSchema,
+    scopes: Schema.Array(Schema.Literals(appStorageScopes)).check(Schema.isMinLength(1), Schema.makeFilter(isUnique, unique)),
+    maxBytes: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 65536 })),
+});
+// Keep the nested storage contract strict when the declaration drops
+// runtime-only command fields.
+export const appStorageKeySchema = Schema.declareConstructor()([storageKeyFields], ([fields]) => (input, _self, options) => SchemaParser.decodeUnknownEffect(fields)(input, {
+    ...options,
+    onExcessProperty: "error",
+}), {
+    toCodecJson: () => new SchemaAST.Link(storageKeyFields.ast, SchemaTransformation.passthrough()),
+});
+const appCallFields = Schema.Struct({
+    appId: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(128)),
+    methods: Schema.Array(appApiMethodNameSchema).check(Schema.isMinLength(1), Schema.isMaxLength(16), Schema.makeFilter(isUnique, unique)),
+});
+const appCallSchema = Schema.declareConstructor()([appCallFields], ([fields]) => (input, _self, options) => SchemaParser.decodeUnknownEffect(fields)(input, {
+    ...options,
+    onExcessProperty: "error",
+}), {
+    toCodecJson: () => new SchemaAST.Link(appCallFields.ast, SchemaTransformation.passthrough()),
+});
+/** The bounded, digest-covered allowlist shown when approving member App calls. */
+export const appCallsSchema = Schema.Array(appCallSchema).check(Schema.isMinLength(1), Schema.isMaxLength(16), Schema.makeFilter((calls) => isUnique(calls.map((call) => call.appId)), unique));
+/** Boundary codec for the digest-covered {@link AppDeclaration}. */
+export const appDeclarationSchema = Schema.Struct({
+    api: Schema.optionalKey(appApiSchema),
+    displayName: Schema.optional(Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(64)))),
+    capabilities: Schema.Array(appCapabilityIdSchema).pipe(Schema.check(Schema.makeFilter(isUnique, unique))),
+    calls: Schema.optionalKey(appCallsSchema),
+    guidance: Schema.optional(Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(12_000)))),
+    handlers: Schema.Array(appHandlerSchema).pipe(Schema.check(Schema.makeFilter(isUnique, unique))),
+    receives: Schema.optionalKey(Schema.Array(Schema.Literal("git.push")).check(Schema.isMaxLength(1), Schema.makeFilter(isUnique, unique))),
+    icon: Schema.optionalKey(Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(80)))),
+    roles: Schema.Array(appRoleSchema).pipe(Schema.check(Schema.makeFilter(isUnique, unique))),
+    storage: Schema.optionalKey(Schema.Array(appStorageKeySchema).check(Schema.isMaxLength(16), Schema.makeFilter((keys) => isUnique(keys.map((entry) => entry.key)), unique))),
+    commands: Schema.optional(Schema.Array(appDeclaredCommandSchema).pipe(Schema.check(Schema.isMaxLength(64)), Schema.check(Schema.makeFilter(commandsAreUnique, {
+        message: "Declared command IDs and slash aliases must be unique",
+    })))),
+    gills: Schema.optional(Schema.Array(appDeclaredGillSchema).pipe(Schema.check(Schema.isMaxLength(16)), Schema.check(Schema.makeFilter(gillsAreUnique, {
+        message: "Declared Gill IDs must be unique",
+    })))),
+    backend: Schema.optional(Schema.Struct({
+        bindings: appBackendBindingsSchema,
+        sync: Schema.optionalKey(Schema.Struct({ method: appApiMethodNameSchema })),
+    })),
+}).pipe(Schema.check(Schema.makeFilter((declaration) => declaration.calls === undefined ||
+    declaration.capabilities.includes("apps.call"), { message: "App calls require apps.call" })), Schema.check(Schema.makeFilter((declaration) => declaration.backend?.bindings.every((binding) => binding.name !== "BACKGROUND") ?? true, { message: "BACKGROUND is host-minted and cannot be declared by an App" })), Schema.check(Schema.makeFilter((declaration) => backgroundSyncAllowed(declaration.api, declaration.backend?.sync), {
+    message: "Background continuation must be a declared write covering all write requirements",
+})), Schema.check(Schema.makeFilter((declaration) => !(declaration.receives?.includes("git.push") ?? false) ||
+    declaration.capabilities.includes("git.repository"), { message: "Git push reception requires git.repository" })), Schema.check(Schema.makeFilter((declaration) => declaration.backend?.bindings.every((binding) => binding.operations.every((name) => appBackendBindingOperation(binding.name, name)?.requires.every((capability) => declaration.capabilities.includes(capability)) === true)) ?? true, { message: "Backend bindings require declared App capabilities" })), Schema.check(Schema.makeFilter((declaration) => !declaration.backend?.bindings.some((binding) => binding.name === "APP_STORAGE") || (declaration.storage?.length ?? 0) > 0, { message: "App storage bindings require declared keys" })), Schema.check(Schema.makeFilter((declaration) => Object.values(declaration.api?.methods ?? {}).every((method) => method.requires.every((capability) => declaration.capabilities.includes(capability))), { message: "App API requires capabilities outside the App declaration" })));

package/dist/app-event-facts.d.ts

@@ -0,0 +1,40 @@
+import * as z from "zod";
+/** Canonical EventSink body; installation identity is supplied by the host. */
+export declare const appEventInputSchema: z.ZodObject<{
+    type: z.ZodString;
+    payload: z.ZodObject<{
+        type: z.ZodString;
+        timestamp: z.ZodString;
+        data: z.ZodJSONSchema;
+    }, z.core.$strict>;
+    eventId: z.ZodString;
+}, z.core.$strict>;
+/** Parsed EventSink input before the host attaches installation identity. */
+export type AppEventInput = z.output<typeof appEventInputSchema>;
+/** Host-attested repository origin of an accepted push fact. */
+export type AppEventGitSource = NonNullable<AppEventFact["gitSource"]>;
+/** Saved host fact delivered to the shared Workflows event router. */
+export declare const appEventFactSchema: z.ZodObject<{
+    type: z.ZodString;
+    payload: z.ZodObject<{
+        type: z.ZodString;
+        timestamp: z.ZodString;
+        data: z.ZodJSONSchema;
+    }, z.core.$strict>;
+    eventId: z.ZodString;
+    installationId: z.ZodString;
+    appId: z.ZodString;
+    releaseId: z.ZodString;
+    gitSource: z.ZodOptional<z.ZodObject<{
+        eventId: z.ZodString;
+        repository: z.ZodString;
+        updates: z.ZodArray<z.ZodObject<{
+            ref: z.ZodString;
+            before: z.ZodString;
+            after: z.ZodString;
+        }, z.core.$strict>>;
+        providerRepository: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Canonical saved event fact for delivery to a host event router. */
+export type AppEventFact = z.output<typeof appEventFactSchema>;

package/dist/app-event-facts.js

@@ -0,0 +1,28 @@
+import * as z from "zod";
+import { gitPushEventIdSchema } from "./git-representation.js";
+import { gitRepositoryNameSchema, gitRefUpdateSchema, } from "./git-representation.js";
+const identity = z.string().min(1).max(256);
+/** Canonical EventSink body; installation identity is supplied by the host. */
+export const appEventInputSchema = z.strictObject({
+    type: z.string().min(1).max(128),
+    payload: z.strictObject({
+        type: z.string().min(1).max(128),
+        timestamp: z.string().min(1).max(256),
+        data: z.json(),
+    }),
+    eventId: identity,
+});
+/** Host-accepted push origin, distinct from event payload authority. */
+const appEventGitSourceSchema = z.strictObject({
+    eventId: gitPushEventIdSchema,
+    repository: gitRepositoryNameSchema,
+    updates: z.array(gitRefUpdateSchema).min(1).max(256),
+    providerRepository: gitRepositoryNameSchema,
+});
+/** Saved host fact delivered to the shared Workflows event router. */
+export const appEventFactSchema = appEventInputSchema.extend({
+    installationId: identity,
+    appId: identity,
+    releaseId: identity,
+    gitSource: appEventGitSourceSchema.optional(),
+});

package/dist/app-method-context.d.ts

@@ -0,0 +1,109 @@
+import * as Schema from "effect/Schema";
+export type { AppMethodCallContext, HostActor, WorkflowAttestation, } from "./app-method-runtime.js";
+/** Host attribution, including paired sealed enqueue origin, uses the sole lightweight caller grammar. */
+export declare const appMethodCallContextSchema: Schema.declareConstructor<{
+    computerId: string | null;
+    actor: {
+        kind: "member";
+        memberId: string;
+    } | {
+        kind: "agent";
+        agentId: string;
+    } | {
+        kind: "team-key";
+        keyId: string;
+    };
+    backgroundLane?: string | undefined;
+    backgroundOrigin?: {
+        method: string;
+        seal: string;
+    } | undefined;
+    role?: "member" | "owner" | undefined;
+    soleMember?: true | undefined;
+    workflow?: {
+        workflowId: string;
+        runId: string;
+        nodeId: string;
+        armedBy: {
+            kind: "member";
+            memberId: string;
+        } | {
+            kind: "agent";
+            agentId: string;
+        } | {
+            kind: "team-key";
+            keyId: string;
+        };
+    } | undefined;
+    idempotencyKey?: string | undefined;
+}, {
+    computerId: string | null;
+    actor: {
+        kind: "member";
+        memberId: string;
+    } | {
+        kind: "agent";
+        agentId: string;
+    } | {
+        kind: "team-key";
+        keyId: string;
+    };
+    backgroundLane?: string | undefined;
+    backgroundOrigin?: {
+        method: string;
+        seal: string;
+    } | undefined;
+    role?: "member" | "owner" | undefined;
+    soleMember?: true | undefined;
+    workflow?: {
+        workflowId: string;
+        runId: string;
+        nodeId: string;
+        armedBy: {
+            kind: "member";
+            memberId: string;
+        } | {
+            kind: "agent";
+            agentId: string;
+        } | {
+            kind: "team-key";
+            keyId: string;
+        };
+    } | undefined;
+    idempotencyKey?: string | undefined;
+}, readonly [], {
+    computerId: string | null;
+    actor: {
+        kind: "member";
+        memberId: string;
+    } | {
+        kind: "agent";
+        agentId: string;
+    } | {
+        kind: "team-key";
+        keyId: string;
+    };
+    backgroundLane?: string | undefined;
+    backgroundOrigin?: {
+        method: string;
+        seal: string;
+    } | undefined;
+    role?: "member" | "owner" | undefined;
+    soleMember?: true | undefined;
+    workflow?: {
+        workflowId: string;
+        runId: string;
+        nodeId: string;
+        armedBy: {
+            kind: "member";
+            memberId: string;
+        } | {
+            kind: "agent";
+            agentId: string;
+        } | {
+            kind: "team-key";
+            keyId: string;
+        };
+    } | undefined;
+    idempotencyKey?: string | undefined;
+}>;

package/dist/app-method-context.js

@@ -0,0 +1,9 @@
+import * as Schema from "effect/Schema";
+import * as Effect from "effect/Effect";
+import * as SchemaIssue from "effect/SchemaIssue";
+import { parseAppMethodCallContext, } from "./app-method-runtime.js";
+/** Host attribution, including paired sealed enqueue origin, uses the sole lightweight caller grammar. */
+export const appMethodCallContextSchema = Schema.declareConstructor()([], () => (value, ast, options) => Effect.try({
+    try: () => parseAppMethodCallContext(value, options.onExcessProperty === "error"),
+    catch: () => new SchemaIssue.InvalidType(ast, value, options),
+}));

package/dist/app-method-runtime.d.ts

@@ -0,0 +1,86 @@
+export { backgroundSyncAllowed } from "./internal/background-sync.js";
+import * as z from "zod/mini";
+/** Reserved JavaScript, RPC and lifecycle names are never App method names. */
+export declare const appApiReservedMethodNames: Readonly<{
+    readonly intrinsic: readonly ["constructor", "toString", "valueOf", "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable", "toLocaleString"];
+    readonly rpc: readonly ["then", "dup", "connect", "id", "name"];
+    readonly instance: readonly ["ctx", "env"];
+    readonly lifecycle: readonly ["gill", "onGitPush", "syncRefused", "authorizeGitPush", "fetch", "alarm", "queue", "scheduled", "tail", "trace", "email", "test", "tailStream", "webSocketMessage", "webSocketClose", "webSocketError"];
+}>;
+/** Actor identity attested by the host, shared by calls and Workflow arming. */
+export declare const hostActorSchema: z.ZodMiniDiscriminatedUnion<[z.ZodMiniObject<{
+    kind: z.ZodMiniLiteral<"member">;
+    memberId: z.ZodMiniString<string>;
+}, z.core.$strip>, z.ZodMiniObject<{
+    kind: z.ZodMiniLiteral<"agent">;
+    agentId: z.ZodMiniString<string>;
+}, z.core.$strip>, z.ZodMiniObject<{
+    kind: z.ZodMiniLiteral<"team-key">;
+    keyId: z.ZodMiniString<string>;
+}, z.core.$strip>], "kind">;
+/** The host's verified member, Agent or Team-key identity. */
+export type HostActor = z.output<typeof hostActorSchema>;
+/** Host-held Workflow attribution, delivered separately from guest input. */
+export declare const workflowAttestationSchema: z.ZodMiniObject<{
+    workflowId: z.ZodMiniString<string>;
+    runId: z.ZodMiniString<string>;
+    nodeId: z.ZodMiniString<string>;
+    armedBy: z.ZodMiniDiscriminatedUnion<[z.ZodMiniObject<{
+        kind: z.ZodMiniLiteral<"member">;
+        memberId: z.ZodMiniString<string>;
+    }, z.core.$strip>, z.ZodMiniObject<{
+        kind: z.ZodMiniLiteral<"agent">;
+        agentId: z.ZodMiniString<string>;
+    }, z.core.$strip>, z.ZodMiniObject<{
+        kind: z.ZodMiniLiteral<"team-key">;
+        keyId: z.ZodMiniString<string>;
+    }, z.core.$strip>], "kind">;
+}, z.core.$strip>;
+/** Workflow attribution shared by invocation frames and Git writers. */
+export type WorkflowAttestation = z.output<typeof workflowAttestationSchema>;
+/** Sole grammar for the host-minted Computer pin and actor attribution. */
+export declare const appMethodCallerSchema: z.ZodMiniObject<{
+    computerId: z.ZodMiniNullable<z.ZodMiniString<string>>;
+    actor: z.ZodMiniDiscriminatedUnion<[z.ZodMiniObject<{
+        kind: z.ZodMiniLiteral<"member">;
+        memberId: z.ZodMiniString<string>;
+    }, z.core.$strip>, z.ZodMiniObject<{
+        kind: z.ZodMiniLiteral<"agent">;
+        agentId: z.ZodMiniString<string>;
+    }, z.core.$strip>, z.ZodMiniObject<{
+        kind: z.ZodMiniLiteral<"team-key">;
+        keyId: z.ZodMiniString<string>;
+    }, z.core.$strip>], "kind">;
+    backgroundLane: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    backgroundOrigin: z.ZodMiniOptional<z.ZodMiniObject<{
+        method: z.ZodMiniString<string>;
+        seal: z.ZodMiniString<string>;
+    }, z.core.$strict>>;
+    role: z.ZodMiniOptional<z.ZodMiniEnum<{
+        member: "member";
+        owner: "owner";
+    }>>;
+    soleMember: z.ZodMiniOptional<z.ZodMiniLiteral<true>>;
+    workflow: z.ZodMiniOptional<z.ZodMiniObject<{
+        workflowId: z.ZodMiniString<string>;
+        runId: z.ZodMiniString<string>;
+        nodeId: z.ZodMiniString<string>;
+        armedBy: z.ZodMiniDiscriminatedUnion<[z.ZodMiniObject<{
+            kind: z.ZodMiniLiteral<"member">;
+            memberId: z.ZodMiniString<string>;
+        }, z.core.$strip>, z.ZodMiniObject<{
+            kind: z.ZodMiniLiteral<"agent">;
+            agentId: z.ZodMiniString<string>;
+        }, z.core.$strip>, z.ZodMiniObject<{
+            kind: z.ZodMiniLiteral<"team-key">;
+            keyId: z.ZodMiniString<string>;
+        }, z.core.$strip>], "kind">;
+    }, z.core.$strip>>;
+    idempotencyKey: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strip>;
+/** Trusted attribution delivered separately from App method arguments. */
+export type AppMethodCallContext = z.output<typeof appMethodCallerSchema>;
+/** Decode trusted host attribution through the sole runtime-neutral grammar. */
+export declare const parseAppMethodCallContext: (value: unknown, rejectUnknownKeys?: boolean) => AppMethodCallContext;
+/** Shared domain grammar for generated RPC method names. */
+export declare const isAppApiMethodName: (name: string) => boolean;

package/dist/app-method-runtime.js

@@ -0,0 +1,122 @@
+export { backgroundSyncAllowed } from "./internal/background-sync.js";
+import * as z from "zod/mini";
+/** Reserved JavaScript, RPC and lifecycle names are never App method names. */
+export const appApiReservedMethodNames = Object.freeze({
+    intrinsic: [
+        "constructor",
+        "toString",
+        "valueOf",
+        "hasOwnProperty",
+        "isPrototypeOf",
+        "propertyIsEnumerable",
+        "toLocaleString",
+    ],
+    rpc: ["then", "dup", "connect", "id", "name"],
+    instance: ["ctx", "env"],
+    lifecycle: [
+        "gill",
+        "onGitPush",
+        "syncRefused",
+        "authorizeGitPush",
+        "fetch",
+        "alarm",
+        "queue",
+        "scheduled",
+        "tail",
+        "trace",
+        "email",
+        "test",
+        "tailStream",
+        "webSocketMessage",
+        "webSocketClose",
+        "webSocketError",
+    ],
+});
+/** Sole caller grammar shared by the lightweight runtime and Effect adapter. */
+const identity = z.string().check(z.minLength(1), z.maxLength(256));
+const memberActor = z.object({ kind: z.literal("member"), memberId: identity });
+const agentActor = z.object({ kind: z.literal("agent"), agentId: identity });
+const keyActor = z.object({ kind: z.literal("team-key"), keyId: identity });
+/** Actor identity attested by the host, shared by calls and Workflow arming. */
+export const hostActorSchema = z.discriminatedUnion("kind", [
+    memberActor,
+    agentActor,
+    keyActor,
+]);
+/** Host-held Workflow attribution, delivered separately from guest input. */
+export const workflowAttestationSchema = z.object({
+    /** Published Workflow selected by the run owner. */
+    workflowId: identity,
+    /** Run identity held by the run owner. */
+    runId: identity,
+    /** Node selected by the stored published Workflow. */
+    nodeId: identity,
+    /** Actor that armed the run, re-admitted by the host at dispatch. */
+    armedBy: hostActorSchema,
+});
+// Keep the single origin grammar in the lightweight caller module. The host-side
+// background-replay entry exposes this same schema without a runtime import cycle.
+const backgroundOrigin = z.strictObject({
+    method: z.string().check(z.refine((name) => isAppApiMethodName(name))),
+    seal: z.string().check(z.regex(/^[A-Za-z0-9_-]{43}$/u)),
+});
+/** Sole grammar for the host-minted Computer pin and actor attribution. */
+export const appMethodCallerSchema = z.object({
+    computerId: z.nullable(identity),
+    actor: hostActorSchema,
+    /** Host-attested enqueue eligibility for this ordinary write; absent otherwise. */
+    backgroundLane: z.optional(z.string().check(z.minLength(8), z.maxLength(263))),
+    /** Host-sealed foreground method for durable jobs; paired with backgroundLane. */
+    backgroundOrigin: z.optional(backgroundOrigin),
+    /** Team role attested by the host, never selected by App method input. */
+    role: z.optional(z.enum(["owner", "member"])),
+    /**
+     * The host attests that this member is currently the Team's only member.
+     * Present only on a member's own call; never on an Agent, Team key or
+     * Workflow node, and never selected by App method input.
+     */
+    soleMember: z.optional(z.literal(true)),
+    /** Present only on a Workflow node invocation admitted by its host. */
+    workflow: z.optional(workflowAttestationSchema),
+    /**
+     * The host's stable key for this logical call (for example one Workflow
+     * node), the same on every retry. A method with side effects uses it to do
+     * its work at most once. Absent when the caller supplies its own request id.
+     */
+    idempotencyKey: z.optional(z.string().check(z.minLength(1), z.maxLength(128))),
+});
+const strictActor = z.discriminatedUnion("kind", [
+    z.strictObject(memberActor.shape),
+    z.strictObject(agentActor.shape),
+    z.strictObject(keyActor.shape),
+]);
+const strictCaller = z.strictObject({
+    ...appMethodCallerSchema.shape,
+    actor: strictActor,
+    workflow: z.optional(z.strictObject({
+        ...workflowAttestationSchema.shape,
+        armedBy: strictActor,
+    })),
+});
+/** Decode trusted host attribution through the sole runtime-neutral grammar. */
+export const parseAppMethodCallContext = (value, rejectUnknownKeys = false) => validateCaller((rejectUnknownKeys ? strictCaller : appMethodCallerSchema).parse(value));
+function validateCaller(context) {
+    if (context.soleMember !== undefined &&
+        (context.actor.kind !== "member" || context.workflow !== undefined))
+        throw new Error("Only a member's own call can be its Team's sole member");
+    if ((context.backgroundLane === undefined) !==
+        (context.backgroundOrigin === undefined))
+        throw new Error("Background lane and origin must be attested together");
+    if (context.backgroundLane !== undefined &&
+        (context.actor.kind !== "member" ||
+            context.workflow !== undefined ||
+            context.backgroundLane !== `member:${context.actor.memberId}`))
+        throw new Error("Background lane must name an ordinary member");
+    return context;
+}
+/** Shared domain grammar for generated RPC method names. */
+export const isAppApiMethodName = (name) => name.length <= 80 &&
+    /^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)*$/.test(name) &&
+    !Object.values(appApiReservedMethodNames)
+        .flat()
+        .some((reserved) => reserved === name);

package/dist/app-origin-paths.d.ts

@@ -0,0 +1,6 @@
+/** Shared App-origin routing namespaces; customer route policy consumes these exact roots. */
+export declare const appOriginPaths: {
+    readonly surfaceAssets: "/surfaces";
+    readonly installedApps: "/installed-apps";
+    readonly privatePreviews: "/private-apps";
+};

package/dist/app-origin-paths.js

@@ -0,0 +1,6 @@
+/** Shared App-origin routing namespaces; customer route policy consumes these exact roots. */
+export const appOriginPaths = {
+    surfaceAssets: "/surfaces",
+    installedApps: "/installed-apps",
+    privatePreviews: "/private-apps",
+};