@fungi.computer/tourtois 0.0.0-stage → 0.0.1

package/dist/member-avatar.js

@@ -0,0 +1,88 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { SectionHeading } from "@fungi.computer/caps/blocks/section-heading";
+import { memberAvatarSchema, defaultMemberAvatar, } from "@fungi.computer/sprite-zdog/avatar";
+import { AvatarPreview } from "./AvatarPreview.js";
+import { AvatarPicker } from "./AvatarPicker.js";
+import { skipToken, useMutation, useQuery, useQueryClient, } from "@tanstack/react-query";
+import { createContext, useContext, useEffect, useSyncExternalStore, } from "react";
+import { createMemberAvatarCache } from "./member-avatar-cache.js";
+/**
+ * The person's avatar preference. The host's account owns it; this browser
+ * keeps the last value it saw as an offline cache so the sprite draws before,
+ * or without, an account read. Both sources are untrusted and parsed with the
+ * avatar preference schema; anything that does not parse is the defaults.
+ */
+const cache = createMemberAvatarCache(() => localStorage);
+/** Decode the host-granted avatar preference. */
+export const parseMemberAvatar = (value) => memberAvatarSchema.nullable().parse(value);
+/** Account edits and host settings changes invalidate this query. */
+export const accountAvatarQuery = ["tourtois", "account-avatar"];
+const MemberAvatarReaderContext = createContext(null);
+/**
+ * Read the avatar through a host-granted source: an isolated dashboard's
+ * capability, or the host's own account read. Without one, the sprite draws
+ * from this browser's cache.
+ */
+export function MemberAvatarSource({ read, children, }) {
+    return (_jsx(MemberAvatarReaderContext.Provider, { value: read, children: children }));
+}
+/**
+ * The current avatar: the account's value once read (refreshing the
+ * cache), otherwise the cached value, updated across tabs.
+ */
+export function useMemberAvatar() {
+    const read = useContext(MemberAvatarReaderContext);
+    const account = useQuery({
+        queryKey: accountAvatarQuery,
+        queryFn: read === null ? skipToken : ({ signal }) => read(signal),
+        retry: false,
+        staleTime: 60_000,
+    });
+    const fromAccount = account.data;
+    useEffect(() => {
+        if (fromAccount)
+            cache.write(fromAccount);
+    }, [fromAccount]);
+    const local = useSyncExternalStore(cache.subscribe, cache.snapshot, () => defaultMemberAvatar);
+    return fromAccount ?? local;
+}
+/** Save through the host; the cache takes the new value at once. */
+function useSaveMemberAvatar(save) {
+    const client = useQueryClient();
+    return useMutation({
+        onMutate: async (next) => {
+            await client.cancelQueries({ queryKey: accountAvatarQuery });
+            const previous = client.getQueryData(accountAvatarQuery);
+            const local = cache.snapshot();
+            cache.write(next);
+            const optimistic = client.setQueryData(accountAvatarQuery, next);
+            return { previous, local, optimistic };
+        },
+        mutationFn: save,
+        onError: (_cause, _next, snapshot) => {
+            if (snapshot &&
+                client.getQueryData(accountAvatarQuery) === snapshot.optimistic) {
+                client.setQueryData(accountAvatarQuery, snapshot.previous ?? null);
+                cache.write(snapshot.local);
+            }
+        },
+        onSuccess: (saved) => {
+            client.setQueryData(accountAvatarQuery, saved);
+            cache.write(saved);
+        },
+    });
+}
+/** The person's sprite as the shell presents it: saved style and appearance. */
+export function OwnSprite(props) {
+    const saved = useMemberAvatar().avatar;
+    const { renderStyle, ...rest } = props;
+    return (_jsx(AvatarPreview, { avatar: { ...saved, renderStyle: renderStyle ?? saved.renderStyle }, ...rest }));
+}
+/** Host-rendered picker: Apps read the preference but never write account routes. */
+export function AvatarSettings({ save: write }) {
+    const saved = useMemberAvatar();
+    const save = useSaveMemberAvatar(write);
+    return (_jsxs("section", { className: "tourtois-avatar-settings", "aria-labelledby": "tourtois-avatar-heading", children: [_jsx(SectionHeading, { id: "tourtois-avatar-heading", children: "Avatar" }), _jsx("p", { className: "tourtois-settings-lede", children: "Choose your character, colours and drawing style. Changes save automatically." }), save.isError ? (_jsx("p", { role: "alert", children: "Your account did not save this avatar. Your previous avatar was restored. Choose it again to retry." })) : null, _jsx(AvatarPicker, { value: saved, disabled: save.isPending, onChange: (next) => {
+                    save.mutate(next);
+                } })] }));
+}

package/dist/menu-bar.d.ts

@@ -0,0 +1,5 @@
+import type { ReactNode } from "react";
+/** The retained desktop menu strip; each host supplies its own navigation. */
+export declare function ShellMenuBar({ children }: Readonly<{
+    children: ReactNode;
+}>): import("react/jsx-runtime").JSX.Element;

package/dist/menu-bar.js

@@ -0,0 +1,5 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/** The retained desktop menu strip; each host supplies its own navigation. */
+export function ShellMenuBar({ children }) {
+    return (_jsx("header", { className: "tourtois-desktop-menu", "aria-label": "Application menu bar", children: children }));
+}

package/dist/model.d.ts

@@ -0,0 +1,6 @@
+export type TourtoisAgentTarget = Readonly<{
+    agentId: string;
+    label: string;
+}>;
+/** Keep the routed Agent first while deduplicating the directory projection. */
+export declare function orderedAgentTargets(current: TourtoisAgentTarget, decoded: readonly TourtoisAgentTarget[]): readonly TourtoisAgentTarget[];

package/dist/model.js

@@ -0,0 +1,13 @@
+/** Keep the routed Agent first while deduplicating the directory projection. */
+export function orderedAgentTargets(current, decoded) {
+    const seen = new Set([current.agentId]);
+    return [
+        current,
+        ...decoded.filter((agent) => {
+            if (seen.has(agent.agentId))
+                return false;
+            seen.add(agent.agentId);
+            return true;
+        }),
+    ];
+}

package/dist/oyster-platform-controls.d.ts

@@ -0,0 +1,4 @@
+import "@fungi.computer/parakeet/styles.css";
+import "./shell.css";
+import type { MountPlatformControls } from "@fungi.computer/oyster/shell/shell-module";
+export declare const mountPlatformControls: MountPlatformControls;

package/dist/oyster-platform-controls.js

@@ -0,0 +1,107 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+// Tourtois's Settings on a standalone Oyster, which has no Settings of its
+// own: Apps, Connectors and Keys over the Oyster owner routes. The Oyster page
+// mounts this from the picked shell Release's module; a host with its own
+// Settings (the Hub) never calls it.
+import "@fungi.computer/parakeet/styles.css";
+import "./shell.css";
+import { AppError } from "@fungi.computer/agar";
+import { createQueryClient } from "@fungi.computer/agar/query";
+import { workbenchDirectorySchema } from "@fungi.computer/oyster/shell/workbench-directory";
+import { QueryClientProvider } from "@tanstack/react-query";
+import * as S from "effect/Schema";
+import { createRoot } from "react-dom/client";
+import { agentMcpServersViewSchema, createPlatformControls, keyIssueResultSchema, keyRecordSchema, keysViewSchema, PlatformControlsView, } from "./platform-controls.js";
+import { settingsLocationSchema } from "./settings-routes.js";
+async function json(path) {
+    const response = await fetch(path, {
+        credentials: "same-origin",
+        cache: "no-store",
+        redirect: "error",
+    });
+    if (!response.ok)
+        throw new AppError("Oyster data is unavailable", {
+            code: response.status === 401 || response.status === 403
+                ? "CAPABILITY_DENIED"
+                : "HOST_FAILURE",
+            retryable: response.status >= 500,
+        });
+    return S.decodeUnknownSync(S.Json)(await response.json());
+}
+/** One owner-direct request; a refusal carries the host's own message. */
+async function ownerRequest(path, init, refused) {
+    const response = await fetch(path, {
+        ...init,
+        credentials: "same-origin",
+        cache: "no-store",
+        redirect: "error",
+    });
+    if (response.ok)
+        return response;
+    const refusal = S.decodeUnknownOption(S.fromJsonString(S.Struct({ error: S.String })))(await response.text());
+    throw new AppError(refusal._tag === "Some" ? refusal.value.error : refused, {
+        code: response.status === 401 || response.status === 403
+            ? "CAPABILITY_DENIED"
+            : "HOST_FAILURE",
+        retryable: response.status >= 500,
+    });
+}
+/** Owner-direct Agent MCP server custody; the host never returns a token. */
+const agentMcpServers = {
+    list: async () => agentMcpServersViewSchema.parse(await json("/api/agent-mcp-servers")),
+    add: async (agentId, draft) => {
+        await ownerRequest(`/api/agent-mcp-servers/${encodeURIComponent(agentId)}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(draft),
+        }, "The MCP server change was refused");
+    },
+    remove: async (agentId, serverId) => {
+        await ownerRequest(`/api/agent-mcp-servers/${encodeURIComponent(agentId)}/${encodeURIComponent(serverId)}`, { method: "DELETE" }, "The MCP server change was refused");
+    },
+};
+/** Owner-direct Keys custody; a plaintext secret comes back only once, on issue. */
+const keys = {
+    list: async () => keysViewSchema.parse(await json("/api/keys")),
+    issue: async (draft) => {
+        const response = await ownerRequest("/api/keys", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(draft),
+        }, "The key request was refused");
+        return keyIssueResultSchema.parse(await response.json());
+    },
+    revoke: async (keyId, requestId) => {
+        const response = await ownerRequest("/api/keys/revoke", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ keyId, requestId }),
+        }, "The key request was refused");
+        return keyRecordSchema.parse(await response.json());
+    },
+};
+const directory = async () => workbenchDirectorySchema.parse(await json("/api/workbench/directory"));
+export const mountPlatformControls = (root, input) => {
+    const controls = createPlatformControls({
+        sections: ["home", "apps", "connectors", "keys"],
+    });
+    const client = createQueryClient();
+    const settings = createRoot(root);
+    settings.render(_jsx(QueryClientProvider, { client: client, children: _jsx(PlatformControlsView, { teamId: input.teamId, controls: controls, data: { directory, agentMcpServers, keys } }) }));
+    return Promise.resolve({
+        controls: {
+            ...controls,
+            parseSettings: (value) => S.decodeUnknownSync(S.Json)(settingsLocationSchema.parse(value)),
+            openSettings: (value, options) => {
+                controls.openSettings(settingsLocationSchema.parse(value), options);
+            },
+        },
+        suggestDesktopSettings: (surfaceId) => {
+            controls.suggestDesktopSettings({ surfaceId, title: surfaceId });
+        },
+        dispose: () => {
+            settings.unmount();
+            client.clear();
+        },
+    });
+};

package/dist/platform-controls.d.ts

@@ -0,0 +1,84 @@
+import type { WorkbenchDirectory } from "@fungi.computer/oyster/shell/workbench-directory";
+import { type WorkbenchDesktopSettings, type WorkbenchDesktopRegistration } from "@fungi.computer/oyster/shell/workbench";
+import type { AppPermissionOutcome, AppPermissionRequest } from "@fungi.computer/agar";
+import { type AppAccessRequest } from "./AppAccessConsent.js";
+import { createSettingsRouter, type SettingsLocation } from "./settings-routes.js";
+export { parseSettingsLocation } from "./settings-routes.js";
+import type { SettingsSectionPorts } from "./settings-sections.js";
+export type { SettingsSectionPorts, TeamAdministrationPort, } from "./settings-sections.js";
+export { agentMcpServersViewSchema, type AgentMcpServerDraft, type AgentMcpServersPort, type AgentMcpServersView, } from "./AgentMcpServers.js";
+export { keyGrantSchema, keyGrantTargetSchema, keyIssueResultSchema, keyRecordSchema, keysViewSchema, type KeyAppAccessLevel, type KeyAppOption, type KeyGrant, type KeyGrantTarget, type KeyIssueDraft, type KeyIssueResult, type KeyRecord, type KeysPort, type KeysView, } from "./Keys.js";
+/**
+ * Team administration a dashboard may ask for but never performs itself:
+ * System Settings (App permissions, forks, default Apps, Team Git, sprite)
+ * and one-click App access consent. The host renders them with the Team
+ * owner's own authority; the dashboard only opens them and hears that the
+ * Team's Apps changed.
+ */
+export type PlatformControls = Readonly<{
+    openSettings: (location: SettingsLocation) => void;
+    registerDesktopSettings: (handler: WorkbenchDesktopSettings) => Promise<WorkbenchDesktopRegistration>;
+    /** Observe Team App changes these controls made, to refresh a directory. */
+    subscribeChanges: (listener: () => void) => () => void;
+}>;
+/** The mounted App asking for access, identified by its directory surface. */
+export type AppAccessTarget = Readonly<{
+    surfaceId: string;
+    title: string;
+}>;
+/** The host side: the controls plus the consent entry for child Apps. */
+export type PlatformControlsHost = PlatformControls & Readonly<{
+    openSettings: (location: SettingsLocation, options?: Readonly<{
+        restoreFocus: boolean;
+        appInitiated?: boolean;
+    }>) => void;
+    restoreSettingsFocus: () => boolean;
+    desktopConsentReadyAt: () => number;
+    /** A child App can suggest Settings; only the member's Review opens them. */
+    suggestDesktopSettings: (target: AppAccessTarget) => void;
+    requestAppAccess: (target: AppAccessTarget, input: AppPermissionRequest) => Promise<AppPermissionOutcome>;
+    /** View wiring: current location, navigation and the consent handler. */
+    /** Settings the embedding host backs with real data and actions. */
+    sections?: readonly SettingsLocation["category"][] | undefined;
+    router: ReturnType<typeof createSettingsRouter>;
+    navigate: (location: SettingsLocation | null) => void;
+    /** The native dialog has finished closing, including its focus trap. */
+    settingsClosed: () => void;
+    subscribeSettingsClosed: (listener: () => void) => () => void;
+    attach: (handler: PlatformControlsHost["requestAppAccess"]) => () => void;
+    changed: () => void;
+    attachDesktopSettings: (handler: WorkbenchDesktopSettings) => () => void;
+    desktopSettings: WorkbenchDesktopSettings;
+}>;
+/** One host's platform controls; render them with `PlatformControlsView`. */
+export declare function createPlatformControls(options?: Readonly<{
+    sections: readonly SettingsLocation["category"][];
+}>): PlatformControlsHost;
+/** The consent dialog a host's own access policy may ask through. */
+export type AppAccessDialog = Readonly<{
+    /** Ask the member; resolves with their answer once the dialog settles. */
+    ask: (request: Omit<AppAccessRequest, "settle">) => Promise<AppPermissionOutcome>;
+    /** Open an App's Settings instead, as the member's "customize" answer. */
+    customize: (location: SettingsLocation) => "customize";
+}>;
+/**
+ * Data and implemented actions supplied by the embedding host. Every request
+ * runs with the signed-in member's own authority on the host's side; a
+ * dashboard App never receives their credentials, forms or results.
+ */
+export type PlatformControlsData = SettingsSectionPorts & Readonly<{
+    directory(): Promise<WorkbenchDirectory>;
+    /**
+     * Override the owner consent flow below. Omit it to use the built-in
+     * one-click dialog, bounded by the target App's own declared
+     * capabilities; the owner's click in this trusted shell is the only grant
+     * a host without a separate per-App ceiling needs.
+     */
+    requestAppAccess?(target: AppAccessTarget, input: AppPermissionRequest, dialog: AppAccessDialog): Promise<AppPermissionOutcome>;
+}>;
+/** Tourtois owns the same Settings renderer on every embedding host. */
+export declare function PlatformControlsView({ teamId, controls, data, }: {
+    teamId: string;
+    controls: PlatformControlsHost;
+    data: PlatformControlsData;
+}): import("react/jsx-runtime").JSX.Element;

package/dist/platform-controls.js

@@ -0,0 +1,266 @@
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+import { AppError } from "@fungi.computer/agar";
+import { Button } from "@fungi.computer/caps/components/button";
+import { toast } from "@fungi.computer/caps/components/toaster";
+import { desktopGillAdditionSchema, desktopGillSelectionSchema, } from "@fungi.computer/oyster/shell/workbench";
+import { addressKey } from "@fungi.computer/oyster/shell/app-directory";
+import { tourtoisQueryKeys } from "./queries.js";
+import { useQuery } from "@tanstack/react-query";
+import { lazy, Suspense, useEffect, useState, useSyncExternalStore, } from "react";
+import { AppAccessConsent, consentableAgentOperations, consentableComputerOperations, } from "./AppAccessConsent.js";
+import { RouterProvider, useRouterState } from "@tanstack/react-router";
+import { createSettingsRouter, navigateSettings, settingsLocationSchema, } from "./settings-routes.js";
+export { parseSettingsLocation } from "./settings-routes.js";
+import { MemberAvatarSource } from "./member-avatar.js";
+export { agentMcpServersViewSchema, } from "./AgentMcpServers.js";
+export { keyGrantSchema, keyGrantTargetSchema, keyIssueResultSchema, keyRecordSchema, keysViewSchema, } from "./Keys.js";
+/** One host's platform controls; render them with `PlatformControlsView`. */
+export function createPlatformControls(options) {
+    const sections = options?.sections.slice();
+    const requireOffered = (location) => {
+        if (location !== null &&
+            sections !== undefined &&
+            !sections.includes(location.category))
+            throw new AppError("This host does not offer those Settings", {
+                code: "CAPABILITY_DENIED",
+                retryable: false,
+            });
+    };
+    const router = createSettingsRouter();
+    let restoreSettingsFocus = true;
+    let settingsOpen = false;
+    let appInitiated = false;
+    let appReopenAllowedAt = 0;
+    let consentReadyAt = 0;
+    let handler;
+    let desktopHandler;
+    const attachDesktopSettings = (handler) => {
+        desktopHandler = handler;
+        return () => {
+            if (desktopHandler === handler)
+                desktopHandler = undefined;
+        };
+    };
+    const changeListeners = new Set();
+    const settingsCloseListeners = new Set();
+    const navigate = (next) => {
+        requireOffered(next);
+        void navigateSettings(router, next).catch((cause) => {
+            console.error("Settings navigation failed", cause);
+        });
+    };
+    const dismissedSuggestions = new Set();
+    let retireSuggestion;
+    const controls = Object.freeze({
+        sections,
+        attachDesktopSettings,
+        registerDesktopSettings: (handler) => {
+            const detach = attachDesktopSettings(handler);
+            return Promise.resolve({
+                close: () => {
+                    detach();
+                    return Promise.resolve();
+                },
+            });
+        },
+        desktopSettings: {
+            readGill: async (input) => {
+                const request = desktopGillSelectionSchema.parse(input);
+                if (!desktopHandler)
+                    throw new AppError("The desktop is unavailable. Reopen it and try again.", { code: "HOST_FAILURE", retryable: true });
+                return desktopHandler.readGill(request);
+            },
+            addGill: async (input) => {
+                const request = desktopGillAdditionSchema.parse(input);
+                if (!desktopHandler)
+                    throw new AppError("The desktop is unavailable. Reopen it and try again.", { code: "HOST_FAILURE", retryable: true });
+                await desktopHandler.addGill(request);
+            },
+            removeGill: async (input) => {
+                const request = desktopGillSelectionSchema.parse(input);
+                if (!desktopHandler)
+                    throw new AppError("The desktop is unavailable. Reopen it and try again.", { code: "HOST_FAILURE", retryable: true });
+                await desktopHandler.removeGill(request);
+            },
+        },
+        openSettings: (next, options) => {
+            requireOffered(next);
+            if (options?.appInitiated &&
+                (settingsOpen || Date.now() < appReopenAllowedAt))
+                throw new AppError("Close Settings and wait before requesting desktop settings again.", { code: "CAPABILITY_DENIED", retryable: false });
+            if (!settingsOpen) {
+                appInitiated = options?.appInitiated ?? false;
+                consentReadyAt = appInitiated ? Date.now() + 500 : 0;
+            }
+            settingsOpen = true;
+            // Navigation within the same dialog preserves its return-focus owner.
+            restoreSettingsFocus =
+                options?.restoreFocus ??
+                    (router.history.location.pathname === "/closed"
+                        ? true
+                        : restoreSettingsFocus);
+            navigate(next);
+        },
+        restoreSettingsFocus: () => restoreSettingsFocus,
+        desktopConsentReadyAt: () => consentReadyAt,
+        suggestDesktopSettings: (target) => {
+            if (dismissedSuggestions.has(target.surfaceId))
+                return;
+            if (settingsOpen || Date.now() < appReopenAllowedAt)
+                throw new AppError("Close Settings and wait before suggesting desktop widgets again.", {
+                    code: "CAPABILITY_DENIED",
+                    retryable: false,
+                });
+            retireSuggestion?.();
+            let retired = false;
+            const id = toast(`${target.title} suggests desktop widgets`, {
+                toasterId: "app-connections",
+                position: "bottom-right",
+                duration: 10_000,
+                closeButton: true,
+                onDismiss: () => {
+                    if (!retired)
+                        dismissedSuggestions.add(target.surfaceId);
+                },
+                action: (_jsx(Button, { variant: "secondary", size: "xs", "aria-label": "Review desktop widgets", onClick: () => {
+                        // A delayed Review must not replace another dialog or bypass its cooldown.
+                        if (!settingsOpen && Date.now() >= appReopenAllowedAt)
+                            controls.openSettings({
+                                category: "apps",
+                                appKey: target.surfaceId,
+                                section: "desktop",
+                            }, { restoreFocus: false, appInitiated: true });
+                        retire();
+                    }, children: "Review" })),
+            });
+            const retire = () => {
+                // Sonner calls onDismiss for programmatic retirement too.
+                retired = true;
+                toast.dismiss(id);
+            };
+            retireSuggestion = retire;
+        },
+        subscribeChanges: (listener) => {
+            changeListeners.add(listener);
+            return () => {
+                changeListeners.delete(listener);
+            };
+        },
+        requestAppAccess: (target, input) => handler === undefined
+            ? Promise.resolve("declined")
+            : handler(target, input),
+        router,
+        navigate,
+        settingsClosed: () => {
+            settingsOpen = false;
+            if (appInitiated)
+                appReopenAllowedAt = Date.now() + 10_000;
+            appInitiated = false;
+            consentReadyAt = 0;
+            for (const listener of settingsCloseListeners)
+                listener();
+        },
+        subscribeSettingsClosed: (listener) => {
+            settingsCloseListeners.add(listener);
+            return () => {
+                settingsCloseListeners.delete(listener);
+            };
+        },
+        attach: (next) => {
+            handler = next;
+            return () => {
+                if (handler === next)
+                    handler = undefined;
+            };
+        },
+        changed: () => {
+            for (const listener of changeListeners)
+                listener();
+        },
+    });
+    return controls;
+}
+// Settings carry TanStack Form and the permission editors; load them on first
+// open so the Team route does not ship them.
+const SystemSettings = lazy(async () => {
+    const module = await import("./SystemSettings.js");
+    return { default: module.SystemSettings };
+});
+/** Loads settings on first open, then stays mounted so closing runs normally. */
+function DeferredSystemSettings(props) {
+    const [loaded, setLoaded] = useState(false);
+    if (props.location !== null && !loaded)
+        setLoaded(true);
+    return loaded ? (_jsx(Suspense, { fallback: null, children: _jsx(SystemSettings, { ...props }) })) : null;
+}
+/** Tourtois owns the same Settings renderer on every embedding host. */
+export function PlatformControlsView({ teamId, controls, data, }) {
+    const location = useRouterState({
+        router: controls.router,
+        select: (state) => settingsLocationSchema
+            .nullable()
+            .parse(state.matches.at(-1)?.loaderData ?? null),
+    });
+    const restoreFocus = useSyncExternalStore((changed) => controls.router.subscribe("onResolved", changed), controls.restoreSettingsFocus, () => true);
+    const directory = useQuery({
+        queryKey: tourtoisQueryKeys.hostSettings(teamId),
+        queryFn: () => data.directory(),
+        enabled: location !== null,
+    });
+    const [consent, setConsent] = useState(null);
+    useEffect(() => {
+        const dialog = {
+            ask: (request) => new Promise((resolve) => {
+                setConsent({
+                    ...request,
+                    settle: (settled) => {
+                        setConsent(null);
+                        resolve(settled);
+                    },
+                });
+            }),
+            customize: (location) => {
+                controls.openSettings(location);
+                return "customize";
+            },
+        };
+        const requestAppAccess = data.requestAppAccess;
+        return controls.attach(requestAppAccess === undefined
+            ? async (target, input) => {
+                const current = await data.directory();
+                const app = current.apps.find((candidate) => candidate.surfaceId === target.surfaceId);
+                const openSettings = () => dialog.customize({
+                    category: "apps",
+                    appKey: app ? addressKey(app.address) : null,
+                    section: "desktop",
+                });
+                if (app === undefined)
+                    return openSettings();
+                const agents = consentableAgentOperations(input.agents ?? [], app.declaredCapabilities);
+                const computers = consentableComputerOperations(input.computers ?? [], app.declaredCapabilities);
+                if (agents.length === 0 && computers.length === 0)
+                    return openSettings();
+                const outcome = await dialog.ask({
+                    appName: target.title,
+                    agents,
+                    computers,
+                    // This trusted shell only renders for the signed-in owner;
+                    // their Allow click here is the whole grant, since this host
+                    // keeps no further per-App ceiling to persist.
+                    allow: () => Promise.resolve(true),
+                });
+                return outcome === "customize" ? openSettings() : outcome;
+            }
+            : (target, input) => requestAppAccess(target, input, dialog));
+    }, [controls, data]);
+    const settings = (_jsxs(_Fragment, { children: [_jsx(RouterProvider, { router: controls.router }), _jsx(AppAccessConsent, { request: consent }), _jsx(DeferredSystemSettings, { location: location, sections: controls.sections, onNavigate: (next) => {
+                    controls.navigate(next);
+                    // Closing Settings may have changed roles, grants or forks.
+                    if (next === null)
+                        controls.changed();
+                }, apps: directory.data?.apps ?? [], appCount: directory.data?.apps.length ?? null, onAccepted: async () => {
+                    await directory.refetch({ throwOnError: true });
+                    controls.changed();
+                }, desktopSettings: controls.desktopSettings, desktopConsentReadyAt: controls.desktopConsentReadyAt(), onClosed: controls.settingsClosed, restoreFocus: restoreFocus, ports: data })] }));
+    return data.avatar === undefined ? (settings) : (_jsx(MemberAvatarSource, { read: data.avatar.read, children: settings }));
+}

package/dist/queries.d.ts

@@ -0,0 +1,7 @@
+/** Keep host and isolated-workbench reads in distinct cache entries. */
+export declare const tourtoisQueryKeys: {
+    hostSettings: (workspaceId: string) => readonly ["tourtois", "host-settings", string];
+    workbench: () => readonly ["tourtois", "workbench"];
+    workbenchComputers: (teamId: string) => readonly ["tourtois", "workbench-computers", string];
+    appDirectory: (teamId: string) => readonly ["tourtois", "workbench-apps", string];
+};

package/dist/queries.js

@@ -0,0 +1,7 @@
+/** Keep host and isolated-workbench reads in distinct cache entries. */
+export const tourtoisQueryKeys = {
+    hostSettings: (workspaceId) => ["tourtois", "host-settings", workspaceId],
+    workbench: () => ["tourtois", "workbench"],
+    workbenchComputers: (teamId) => ["tourtois", "workbench-computers", teamId],
+    appDirectory: (teamId) => ["tourtois", "workbench-apps", teamId],
+};

package/dist/session-registry.d.ts

@@ -0,0 +1,16 @@
+import type { ShiitakeAgent } from "@fungi.computer/shiitake/client";
+export type SessionClient<TSession> = Pick<ShiitakeAgent, "listSessions" | "createSession"> & Readonly<{
+    close: () => Promise<void>;
+    session: (sessionId: string) => TSession;
+}>;
+export type SessionClientFactory<TSession> = (agentId: string) => SessionClient<TSession>;
+/**
+ * Own one Team's client/session generation from effect setup through cleanup.
+ * The render waits for setup so React StrictMode can rehearse and replace the
+ * generation without handing a child a client that cleanup already closed.
+ */
+export declare function useSessionRegistry<TSession>(teamId: string, createClient: SessionClientFactory<TSession>): {
+    ready: boolean;
+    sessionFor: (agentId: string, sessionId: string) => TSession;
+    selectSession: (agentId: string) => Promise<string>;
+};