@fungi.computer/puffball 0.0.1 → 0.1.0

package/dist/app-api.js

@@ -24,6 +24,9 @@ const method = Schema.Struct({
     pending: Schema.optional(Schema.Literal(true)),
     hidden: Schema.optional(Schema.Literal(true)),
     anonymous: Schema.optional(Schema.Literal(true)),
+    present: Schema.optional(Schema.Struct({
+        verb: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(32)),
+    })),
     effect: Schema.Literals(["read", "write", "external"]),
     requires: Schema.Array(Schema.Literals(appCapabilityIds)).pipe(Schema.check(Schema.makeFilter((values) => new Set(values).size === values.length))),
 }).check(Schema.makeFilter((value) => value.anonymous !== true ||

package/dist/app-backend-binding-vocabulary.d.ts

@@ -65,17 +65,20 @@ export declare const appBackendBindingKinds: {
                 readonly requires: readonly ["git.repository", "computer.execute"];
                 readonly effect: "write";
             };
-            /** Read one build job's current status; the host re-checks the caller is the owner. */
+            /** Read one build job's current status; the host re-checks the caller
+             * is the owner. An operation is granted only through approved
+             * capabilities, so it needs the ones its build was admitted with. */
             readonly buildStatus: {
                 readonly cap: "app.build";
-                readonly requires: readonly [];
+                readonly requires: readonly ["git.repository", "computer.execute"];
                 readonly effect: "read";
             };
             /** Install a Release at an installation id, or switch a live one onto
-             * it; the host re-checks the caller is the owner. */
+             * it; the host re-checks the caller is the owner. It completes the
+             * build-and-install loop, under the capabilities a build needs. */
             readonly select: {
                 readonly cap: "app.select";
-                readonly requires: readonly [];
+                readonly requires: readonly ["git.repository", "computer.execute"];
                 readonly effect: "write";
             };
             readonly catalog: {
@@ -83,10 +86,11 @@ export declare const appBackendBindingKinds: {
                 readonly requires: readonly ["team.workbenchHost"];
                 readonly effect: "read";
             };
-            /** Fork a platform App's published source into its own Team-owned App. */
+            /** Fork a platform App's published source into its own Team-owned App,
+             * as a repository in the calling installation's Git. */
             readonly fork: {
                 readonly cap: "app.fork";
-                readonly requires: readonly [];
+                readonly requires: readonly ["git.repository"];
                 readonly effect: "write";
             };
         };

package/dist/app-backend-binding-vocabulary.js

@@ -54,17 +54,20 @@ export const appBackendBindingKinds = {
                 requires: ["git.repository", "computer.execute"],
                 effect: "write",
             },
-            /** Read one build job's current status; the host re-checks the caller is the owner. */
+            /** Read one build job's current status; the host re-checks the caller
+             * is the owner. An operation is granted only through approved
+             * capabilities, so it needs the ones its build was admitted with. */
             buildStatus: {
                 cap: "app.build",
-                requires: [],
+                requires: ["git.repository", "computer.execute"],
                 effect: "read",
             },
             /** Install a Release at an installation id, or switch a live one onto
-             * it; the host re-checks the caller is the owner. */
+             * it; the host re-checks the caller is the owner. It completes the
+             * build-and-install loop, under the capabilities a build needs. */
             select: {
                 cap: "app.select",
-                requires: [],
+                requires: ["git.repository", "computer.execute"],
                 effect: "write",
             },
             catalog: {
@@ -72,10 +75,11 @@ export const appBackendBindingKinds = {
                 requires: ["team.workbenchHost"],
                 effect: "read",
             },
-            /** Fork a platform App's published source into its own Team-owned App. */
+            /** Fork a platform App's published source into its own Team-owned App,
+             * as a repository in the calling installation's Git. */
             fork: {
                 cap: "app.fork",
-                requires: [],
+                requires: ["git.repository"],
                 effect: "write",
             },
         },

package/dist/app-declaration.d.ts

@@ -1,7 +1,7 @@
 import * as Schema from "effect/Schema";
 import { type AppDeclaration, type AppDeclaredCommand } from "./app-vocabulary.js";
 export declare const appRoleSchema: Schema.Literals<readonly ["dashboard", "inbox", "files", "media", "sessions", "terminal"]>;
-export declare const appCapabilityIdSchema: Schema.Literals<readonly ["agent.list", "agent.manage", "agent.rename", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>;
+export declare const appCapabilityIdSchema: Schema.Literals<readonly ["agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>;
 export declare const appHandlerSchema: Schema.Literals<readonly ["file.open"]>;
 /**
  * One declared command: a Whistle definition's identity and projections.

package/dist/app-event-facts.d.ts

@@ -26,7 +26,7 @@ export declare const appEventFactSchema: z.ZodObject<{
     appId: z.ZodString;
     releaseId: z.ZodString;
     gitSource: z.ZodOptional<z.ZodObject<{
-        eventId: z.ZodString;
+        eventId: z.ZodLazy<z.ZodString>;
         repository: z.ZodString;
         updates: z.ZodArray<z.ZodObject<{
             ref: z.ZodString;

package/dist/app-method-runtime.d.ts

@@ -52,10 +52,10 @@ export declare const appMethodCallerSchema: z.ZodMiniObject<{
         keyId: z.ZodMiniString<string>;
     }, z.core.$strip>], "kind">;
     backgroundLane: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    backgroundOrigin: z.ZodMiniOptional<z.ZodMiniObject<{
+    backgroundOrigin: z.ZodMiniOptional<z.ZodMiniLazy<z.ZodMiniObject<{
         method: z.ZodMiniString<string>;
         seal: z.ZodMiniString<string>;
-    }, z.core.$strict>>;
+    }, z.core.$strict>>>;
     role: z.ZodMiniOptional<z.ZodMiniEnum<{
         member: "member";
         owner: "owner";

package/dist/app-method-runtime.js

@@ -56,10 +56,10 @@ export const workflowAttestationSchema = z.object({
 });
 // Keep the single origin grammar in the lightweight caller module. The host-side
 // background-replay entry exposes this same schema without a runtime import cycle.
-const backgroundOrigin = z.strictObject({
+const backgroundOrigin = z.lazy(() => z.strictObject({
     method: z.string().check(z.refine((name) => isAppApiMethodName(name))),
     seal: z.string().check(z.regex(/^[A-Za-z0-9_-]{43}$/u)),
-});
+}));
 /** Sole grammar for the host-minted Computer pin and actor attribution. */
 export const appMethodCallerSchema = z.object({
     computerId: z.nullable(identity),

package/dist/app-vocabulary.d.ts

@@ -58,7 +58,7 @@ export declare function resolveAppRoles(choices: ReadonlyMap<AppRole, string>, c
  * Host capabilities an App may request. A request is never authority; the
  * Team's installation grants decide. Extend this list here.
  */
-export declare const appCapabilityIds: readonly ["agent.list", "agent.manage", "agent.rename", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"];
+export declare const appCapabilityIds: readonly ["agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"];
 /** One requestable host capability id. */
 export type AppCapabilityId = (typeof appCapabilityIds)[number];
 /** Backend requests are narrower than the App capabilities a Team approves. */
@@ -78,6 +78,10 @@ export type AppApi = Readonly<{
         hidden?: true | undefined;
         /** Request anonymous read admission; declaration alone grants no authority. */
         anonymous?: true | undefined;
+        /** Finished calls read as a person-facing row projected by the App's hidden `present` method. */
+        present?: Readonly<{
+            verb: string;
+        }> | undefined;
     }>>>;
     /** A signed dynamic tool namespace; its methods remain subject to ordinary admission. */
     toolFamily?: Readonly<{

package/dist/app-vocabulary.js

@@ -52,6 +52,7 @@ export const appCapabilityIds = [
     "agent.list",
     "agent.manage",
     "agent.rename",
+    "agent.avatar",
     "agent.toolPolicy",
     "agent.read",
     "agent.send",

package/dist/background-replay.d.ts

@@ -4,19 +4,19 @@ import { type HostActor, type AppMethodCallContext } from "./app-method-runtime.
 import type { AppApi } from "./app-vocabulary.js";
 export { backgroundSyncAllowed } from "./internal/background-sync.js";
 /** The caller's single lightweight grammar for a host-sealed enqueue origin. */
-export declare const backgroundOriginSchema: import("zod/mini").ZodMiniObject<{
+export declare const backgroundOriginSchema: import("zod/mini").ZodMiniLazy<import("zod/mini").ZodMiniObject<{
     method: import("zod/mini").ZodMiniString<string>;
     seal: import("zod/mini").ZodMiniString<string>;
-}, z.core.$strict>;
+}, z.core.$strict>>;
 /** Origin evidence, never a retained grant or credential. */
 export type BackgroundOrigin = z.output<typeof backgroundOriginSchema>;
 /** The closed result of checking a claimed job's origin in a fresh replay frame. */
-export declare const claimedJobAdmissionSchema: z.ZodUnion<readonly [z.ZodObject<{
+export declare const claimedJobAdmissionSchema: z.ZodLazy<z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"admitted">;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"refused">;
     code: z.ZodLiteral<"access_changed">;
-}, z.core.$strict>]>;
+}, z.core.$strict>]>>;
 /** A claim either passes origin admission or refuses before binding effects. */
 export type ClaimedJobAdmission = z.output<typeof claimedJobAdmissionSchema>;
 /** Host-minted replay port; an App cannot declare this binding. */
@@ -50,7 +50,7 @@ export declare function backgroundContext(context: AppMethodCallContext, ancestr
 /** App-side eligibility reads only the host-attested context; it never invents ancestry. */
 export declare function mayEnqueueBackground(context: AppMethodCallContext): boolean;
 /** Identity and observed revisions only. Unknown fields, including bearer material, refuse. */
-export declare const backgroundWakeSchema: z.ZodObject<{
+export declare const backgroundWakeSchema: z.ZodLazy<z.ZodObject<{
     installationId: z.ZodString;
     actor: z.ZodObject<{
         kind: import("zod/mini").ZodMiniLiteral<"member">;
@@ -59,12 +59,12 @@ export declare const backgroundWakeSchema: z.ZodObject<{
     lane: z.ZodString;
     originMethod: z.ZodString;
     observed: z.ZodObject<{
-        authorityVersion: z.ZodNumber;
+        authorityVersion: z.ZodLazy<z.ZodNumber>;
         artifactDigest: z.ZodCustom<Sha256Digest, Sha256Digest>;
-        membershipVersion: z.ZodOptional<z.ZodNumber>;
+        membershipVersion: z.ZodOptional<z.ZodLazy<z.ZodNumber>>;
     }, z.core.$strict>;
-    epoch: z.ZodNumber;
-}, z.core.$strict>;
+    epoch: z.ZodLazy<z.ZodNumber>;
+}, z.core.$strict>>;
 /** A host wake cannot confer authority without fresh directory and method admission. */
 export type BackgroundWake = z.output<typeof backgroundWakeSchema>;
 /** A retained identity eligible for member-only replay. */

package/dist/background-replay.js

@@ -8,13 +8,13 @@ export { backgroundSyncAllowed } from "./internal/background-sync.js";
 /** The caller's single lightweight grammar for a host-sealed enqueue origin. */
 export const backgroundOriginSchema = appMethodCallerSchema.shape.backgroundOrigin.def.innerType;
 /** The closed result of checking a claimed job's origin in a fresh replay frame. */
-export const claimedJobAdmissionSchema = z.union([
+export const claimedJobAdmissionSchema = z.lazy(() => z.union([
     z.strictObject({ kind: z.literal("admitted") }),
     z.strictObject({
         kind: z.literal("refused"),
         code: z.literal("access_changed"),
     }),
-]);
+]));
 const originBytes = (claims) => new TextEncoder().encode(JSON.stringify([
     "fungi.background-origin/1",
     claims.instanceId,
@@ -110,9 +110,9 @@ export function mayEnqueueBackground(context) {
         Schema.is(WatchdogQueuedJobSchema.fields.lane)(context.backgroundLane));
 }
 const member = z.strictObject(hostActorSchema.def.options[0].shape);
-const revision = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const revision = z.lazy(() => z.number().int().positive().max(Number.MAX_SAFE_INTEGER));
 /** Identity and observed revisions only. Unknown fields, including bearer material, refuse. */
-export const backgroundWakeSchema = z
+export const backgroundWakeSchema = z.lazy(() => z
     .strictObject({
     installationId: z.string().min(1).max(256),
     actor: member,
@@ -130,7 +130,7 @@ export const backgroundWakeSchema = z
 })
     .refine((wake) => wake.lane === actorLane(wake.actor), {
     message: "Wake lane must name its member",
-});
+}));
 /** The App can settle a refused lane without receiving any binding authority. */
 export const backgroundRefusalCodeSchema = z.enum([
     "access_changed",

package/dist/git-representation.d.ts

@@ -10,4 +10,4 @@ export declare const gitRefUpdateSchema: z.ZodObject<{
     after: z.ZodString;
 }, z.core.$strict>;
 /** Host push event IDs include the Computer and local event identity. */
-export declare const gitPushEventIdSchema: z.ZodString;
+export declare const gitPushEventIdSchema: z.ZodLazy<z.ZodString>;

package/dist/git-representation.js

@@ -13,4 +13,4 @@ export const gitRefUpdateSchema = z.strictObject({
     after: gitSha1Schema,
 });
 /** Host push event IDs include the Computer and local event identity. */
-export const gitPushEventIdSchema = z.string().min(1).max(512);
+export const gitPushEventIdSchema = z.lazy(() => z.string().min(1).max(512));

package/dist/internal/app-release-schema.d.ts

@@ -1468,6 +1468,9 @@ export declare const decodeReleaseLifecycleStoreResult: (input: unknown, options
                             pending?: true | undefined;
                             hidden?: true | undefined;
                             anonymous?: true | undefined;
+                            present?: Readonly<{
+                                verb: string;
+                            }> | undefined;
                         }>>>;
                         toolFamily?: Readonly<{
                             name: string;

package/dist/internal/public-website-authority.d.ts

@@ -226,6 +226,9 @@ export declare const decodePublicWebsiteAuthorityStoreResult: (input: unknown, o
                                 pending?: true | undefined;
                                 hidden?: true | undefined;
                                 anonymous?: true | undefined;
+                                present?: Readonly<{
+                                    verb: string;
+                                }> | undefined;
                             }>>>;
                             toolFamily?: Readonly<{
                                 name: string;

package/docs/api/index.md

@@ -2563,6 +2563,7 @@ const appCapabilityIds: readonly [
   "agent.list",
   "agent.manage",
   "agent.rename",
+  "agent.avatar",
   "agent.toolPolicy",
   "agent.read",
   "agent.send",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/puffball",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "author": "Levi <levi@technomancy.dev>",
   "description": "Immutable App/Release catalog with verified public website delivery",
   "type": "module",
@@ -112,7 +112,7 @@
     "@fungi.computer/cloudflare-worker-bundler": "0.2.3-fungi.0",
     "zod": "4.4.3",
     "@fungi.computer/watchdog": "0.0.1",
-    "@fungi.computer/gills": "0.0.1"
+    "@fungi.computer/gills": "0.1.0"
   },
   "devDependencies": {
     "@cloudflare/vitest-plugin": "1.1.2",