@fungi.computer/tourtois 0.1.0 → 0.2.1

package/README.md

@@ -123,6 +123,25 @@ layout. [src/shell-module.ts](src/shell-module.ts) is the `mountShell` entry,
 can supply. The agent tools are in [backend/methods.ts](backend/methods.ts), and
 [package.json](package.json) declares what the shell asks of its host.
 
+### Open windows and new versions
+
+The directory refreshes every 15 seconds while the desktop is visible, as well
+as on host change notifications. A changed active Release leaves the existing
+App mounted and offers **New version available — Reload** in its existing window
+footer. The footer already owns host status; the header remains the App's
+navigation and window controls.
+
+Reload uses Oyster's ordinary window replacement and asks the mounted App's
+close veto before disposing it. Refusal leaves the old window and the Reload
+offer intact. Acceptance mounts the active Release; closing and reopening also
+uses the active Release without a notice. This does not transfer unsaved memory
+or preserve obsolete backend authority. Permission changes and explicit
+selection-changed recovery retain their existing reconciliation behavior.
+
+With the Tourtois workbench running, `pnpm test:window-new-version` exercises
+the directory change, footer action and reopen at desktop and phone widths.
+`test/window-status-bar.test.tsx` proves the Reload close veto.
+
 ## License
 
 MIT. See [LICENSE](LICENSE).

package/dist/AppAccessConsent.d.ts

@@ -1,5 +1,5 @@
 import type { AgentAccessOperation, AppPermissionOutcome, ComputerAccessOperation } from "@fungi.computer/agar";
-import type { AppAgentPermission, AppComputerPermission } from "@fungi.computer/oyster/shell/app-directory";
+import type { AppAgentPermission, AppComputerPermission } from "@fungi.computer/nacre/app-directory";
 export declare const consentableAgentOperations: (requested: readonly AgentAccessOperation[], declared: readonly string[]) => readonly AgentAccessOperation[];
 export declare const consentableComputerOperations: (requested: readonly ComputerAccessOperation[], declared: readonly string[]) => readonly ComputerAccessOperation[];
 /** The all-Team-Agents grant that adds `offered` to the current policy. */
@@ -13,6 +13,11 @@ export type AppAccessRequest = Readonly<{
     appName: string;
     agents: readonly AgentAccessOperation[];
     computers: readonly ComputerAccessOperation[];
+    /** A host refusal is visible and cannot be converted into an Allow. */
+    refusal?: Readonly<{
+        code: string;
+        message: string;
+    }>;
     /** Save the grant through the owner's own authority; resolves false when it failed. */
     allow: () => Promise<boolean>;
     settle: (outcome: AppPermissionOutcome) => void;

package/dist/AppAccessConsent.js

@@ -98,12 +98,12 @@ export function AppAccessConsent({ request, }) {
                                 ? `Let ${request.appName} work with your ${resources(request, "Agents", "Computers")}?`
                                 : "" }), _jsx(DialogDescription, { children: request
                                 ? `${request.appName} can ${describe([...request.agents, ...request.computers])} for every ${resources(request, "Agent", "Computer")} in this Oyster. You can change this later in System Settings.`
-                                : "" }), failed ? (_jsx("p", { role: "alert", children: "Access could not be saved. Try again." })) : null, _jsxs(DialogFooter, { children: [_jsx(Button, { variant: "ghost", disabled: saving, onClick: () => {
+                                : "" }), request?.refusal !== undefined ? (_jsx("p", { role: "alert", "data-refusal-code": request.refusal.code, children: request.refusal.message })) : null, failed ? (_jsx("p", { role: "alert", children: "Access could not be saved. Try again." })) : null, _jsxs(DialogFooter, { children: [_jsx(Button, { variant: "ghost", disabled: saving, onClick: () => {
                                         settle("customize");
                                     }, children: "Customize\u2026" }), _jsx(Button, { variant: "ghost", disabled: saving, onClick: () => {
                                         settle("declined");
-                                    }, children: "Not now" }), _jsx(Button, { disabled: saving || request === null, onClick: () => {
-                                        if (request === null)
+                                    }, children: "Not now" }), _jsx(Button, { disabled: saving || request === null || request.refusal !== undefined, onClick: () => {
+                                        if (request === null || request.refusal !== undefined)
                                             return;
                                         setSaving(true);
                                         setFailed(false);
@@ -111,8 +111,7 @@ export function AppAccessConsent({ request, }) {
                                             if (saved)
                                                 settle("granted");
                                             else {
-                                                setSaving(false);
-                                                setFailed(true);
+                                                settle("declined");
                                             }
                                         }, () => {
                                             setSaving(false);

package/dist/AppDesktopSettings.d.ts

@@ -1,5 +1,5 @@
-import type { WorkbenchDesktopSettings } from "@fungi.computer/oyster/shell/workbench";
-import type { AppDirectoryEntry, AppDirectoryGill } from "@fungi.computer/oyster/shell/app-directory";
+import type { WorkbenchDesktopSettings } from "@fungi.computer/nacre/workbench";
+import type { AppDirectoryEntry, AppDirectoryGill } from "@fungi.computer/nacre/app-directory";
 export type AppDesktopSettingsApp = Pick<AppDirectoryEntry, "surfaceId" | "availability"> & Readonly<{
     gills: readonly AppDirectoryGill[];
 }>;

package/dist/AppPane.d.ts

@@ -1,5 +1,5 @@
 import { type AppStatusAction } from "@fungi.computer/agar";
-import { createAppWindowManager, type AppWindowProjection } from "./app-windows.js";
+import { createAppWindowManager, type AppWindowProjection, type AppLaunchDescriptor } from "./app-windows.js";
 import { type AppDirectoryApp } from "./app-launch.js";
 /** The focused window's App-level settings; its Computer lives in its status bar. */
 export declare function FocusedWindowControls({ app, onOpenSettings, onOpenPermissions, projection, }: {
@@ -8,8 +8,9 @@ export declare function FocusedWindowControls({ app, onOpenSettings, onOpenPermi
     onOpenPermissions: () => void;
     projection: AppWindowProjection;
 }): import("react/jsx-runtime").JSX.Element | null;
-export declare function AppPane({ projection, icon, manager, onError, index, focusWindow, afterHide, onBack, onSelectComputer, }: {
+export declare function AppPane({ projection, nextLaunch, icon, manager, onError, index, focusWindow, afterHide, onBack, onSelectComputer, }: {
     projection: AppWindowProjection;
+    nextLaunch?: AppLaunchDescriptor | null;
     icon: string | null | undefined;
     manager: ReturnType<typeof createAppWindowManager>;
     onError: (message: string) => void;
@@ -24,9 +25,13 @@ export declare function AppPane({ projection, icon, manager, onError, index, foc
  * One window's status bar, owned by the shell like its title bar: the
  * window's Computer first (only the person changes it, here), then the items
  * the App declared as data. The shell renders every item with Caps pieces and
- * hands the person's use back to the App. A window with neither has no bar.
+ * hands the person's use back to the App. Release availability shares this
+ * existing footer instead of competing with App navigation in the header.
+ * Reload sits beside the App's far-end readouts. Phone chrome keeps one row:
+ * a shorter notice takes precedence over Inkcap's low-value file count, never
+ * over the App's save state. Desktop presentation stays unchanged.
  */
-export declare function WindowStatusBar({ projection, onSelectComputer, onAction, surface, computerPickerOpen, onComputerPickerOpenChange, }: {
+export declare function WindowStatusBar({ projection, onSelectComputer, onAction, surface, computerPickerOpen, onComputerPickerOpenChange, onReload, }: {
     projection: AppWindowProjection;
     onSelectComputer: (computerId: string) => void;
     onAction: (action: AppStatusAction) => void;
@@ -34,4 +39,6 @@ export declare function WindowStatusBar({ projection, onSelectComputer, onAction
     surface?: () => HTMLElement | null;
     computerPickerOpen?: boolean;
     onComputerPickerOpenChange?: (open: boolean) => void;
+    /** Uses the window manager's ordinary, veto-respecting replacement. */
+    onReload?: (() => void) | undefined;
 }): import("react/jsx-runtime").JSX.Element | null;

package/dist/AppPane.js

@@ -1,7 +1,8 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { IconButton } from "@fungi.computer/caps/components/icon-button";
-import { AppStatusBar, StatusBarPicker, } from "@fungi.computer/caps/blocks/app-status-bar";
+import { AppStatusBar, AppStatusItem, StatusBarChip, StatusBarPicker, } from "@fungi.computer/caps/blocks/app-status-bar";
 import { Sigil } from "@fungi.computer/sigils";
+import { describeAppError } from "@fungi.computer/agar/errors";
 import { WindowActions, WindowBody, WindowFrame, WindowHeader, } from "@fungi.computer/caps/components/window";
 import { Settings, ShieldCheck } from "lucide-react";
 import { WindowStatusItem } from "./status-bar.js";
@@ -42,9 +43,11 @@ function headerContent(navigation, popover, activate) {
 }
 const windowStatusLabel = (projection) => {
     if (projection.status === "error")
-        return `${projection.launch.title} unavailable`;
+        return describeAppError(projection.error).message;
     if (projection.status === "loading")
         return `${projection.launch.title} opening…`;
+    if (projection.status === "getting-ready")
+        return "Getting ready…";
     return projection.launch.title;
 };
 /** The focused window's App-level settings; its Computer lives in its status bar. */
@@ -53,7 +56,7 @@ export function FocusedWindowControls({ app, onOpenSettings, onOpenPermissions,
         return null;
     return (_jsxs("div", { className: "tourtois-focused-controls", role: "group", "aria-label": `${projection.launch.title} settings`, children: [_jsx(IconButton, { size: "responsive", "aria-label": `Permissions for ${projection.launch.title}`, title: "App permissions", icon: _jsx(ShieldCheck, {}), onClick: onOpenPermissions }), _jsx(IconButton, { size: "responsive", "aria-label": `Settings for ${projection.launch.title}`, title: "App settings", icon: _jsx(Settings, {}), onClick: onOpenSettings })] }));
 }
-export function AppPane({ projection, icon, manager, onError, index, focusWindow, afterHide, onBack, onSelectComputer, }) {
+export function AppPane({ projection, nextLaunch, icon, manager, onError, index, focusWindow, afterHide, onBack, onSelectComputer, }) {
     const containerRef = useRef(null);
     const popover = useLayer("popover");
     const [computerPickerOpen, setComputerPickerOpen] = useState(false);
@@ -170,9 +173,21 @@ export function AppPane({ projection, icon, manager, onError, index, focusWindow
                                 console.error("App workbench operation failed", cause);
                                 onError("App could not be minimized.");
                             });
-                        }, onClose: close }) }) }), projection.status === "loading" ? (_jsxs("div", { className: "tourtois-app-loading", role: "status", children: [_jsx(AppIcon, { roles: projection.launch.roles, icon: icon }), _jsxs("div", { children: [_jsxs("strong", { children: ["Opening ", projection.launch.title, "\u2026"] }), _jsx("span", { children: "Preparing this App for your workspace." })] })] })) : null, projection.status === "error" &&
+                        }, onClose: close }) }) }), projection.status === "loading" ||
+                projection.status === "getting-ready" ? (_jsxs("div", { className: "tourtois-app-loading", role: "status", children: [_jsx(AppIcon, { roles: projection.launch.roles, icon: icon }), _jsxs("div", { children: [_jsx("strong", { children: projection.status === "getting-ready"
+                                    ? "Getting ready…"
+                                    : `Opening ${projection.launch.title}…` }), _jsx("span", { children: "Preparing this App for your workspace." })] })] })) : null, projection.status === "error" &&
                 !(projection.error instanceof AppError &&
-                    projection.error.code === "DISCONNECTED") ? (_jsx("p", { className: "tourtois-window-status", role: "status", children: windowStatusLabel(projection) })) : null, _jsx(WindowBody, { ref: containerRef, className: "tourtois-pane-body", hidden: projection.status === "error" }), _jsx(WindowStatusBar, { projection: projection, computerPickerOpen: computerPickerOpen, onComputerPickerOpenChange: setComputerPickerOpen, onSelectComputer: (computerId) => {
+                    projection.error.code === "DISCONNECTED") ? (_jsx("p", { className: "tourtois-window-status", role: "status", children: windowStatusLabel(projection) })) : null, _jsx(WindowBody, { ref: containerRef, className: "tourtois-pane-body", hidden: projection.status === "error" }), _jsx(WindowStatusBar, { projection: projection, onReload: nextLaunch && nextLaunch.releaseId !== projection.launch.releaseId
+                    ? () => {
+                        void manager
+                            .replace(projection.windowId, nextLaunch)
+                            .catch((cause) => {
+                            console.error("App reload failed", cause);
+                            onError("App could not be reloaded.");
+                        });
+                    }
+                    : undefined, computerPickerOpen: computerPickerOpen, onComputerPickerOpenChange: setComputerPickerOpen, onSelectComputer: (computerId) => {
                     onSelectComputer(projection.windowId, computerId);
                 }, surface: () => containerRef.current, onAction: (action) => {
                     void manager
@@ -187,13 +202,30 @@ export function AppPane({ projection, icon, manager, onError, index, focusWindow
  * One window's status bar, owned by the shell like its title bar: the
  * window's Computer first (only the person changes it, here), then the items
  * the App declared as data. The shell renders every item with Caps pieces and
- * hands the person's use back to the App. A window with neither has no bar.
+ * hands the person's use back to the App. Release availability shares this
+ * existing footer instead of competing with App navigation in the header.
+ * Reload sits beside the App's far-end readouts. Phone chrome keeps one row:
+ * a shorter notice takes precedence over Inkcap's low-value file count, never
+ * over the App's save state. Desktop presentation stays unchanged.
  */
-export function WindowStatusBar({ projection, onSelectComputer, onAction, surface, computerPickerOpen, onComputerPickerOpenChange, }) {
+export function WindowStatusBar({ projection, onSelectComputer, onAction, surface, computerPickerOpen, onComputerPickerOpenChange, onReload, }) {
     const popover = useLayer("popover");
+    const [phone, setPhone] = useState(false);
+    useEffect(() => {
+        // Match Caps' phone status-bar breakpoint, including its touch targets.
+        const media = window.matchMedia("(max-width: 640px)");
+        const update = () => {
+            setPhone(media.matches);
+        };
+        update();
+        media.addEventListener("change", update);
+        return () => {
+            media.removeEventListener("change", update);
+        };
+    }, []);
     const { computers, title } = projection.launch;
     const items = projection.statusItems;
-    if (computers === undefined && items.length === 0)
+    if (computers === undefined && items.length === 0 && !onReload)
         return null;
     const anchorFor = (key) => {
         const origin = surface?.()?.getBoundingClientRect();
@@ -207,7 +239,12 @@ export function WindowStatusBar({ projection, onSelectComputer, onAction, surfac
     };
     const render = (item) => (_jsx(WindowStatusItem, { item: item, container: popover, onAction: onAction, anchorFor: anchorFor }, item.id));
     const end = items.filter((item) => item.end === true);
-    const start = items.filter((item) => item.end !== true);
+    const start = items.filter((item) => item.end !== true &&
+        !(phone &&
+            projection.launch.appId === "inkcap" &&
+            item.kind === "text" &&
+            item.id === "documents"));
+    const appReadouts = end.length === 0 ? undefined : end.map(render);
     return (_jsx(AppStatusBar, { className: "tourtois-window-status-bar", "aria-label": `${title} status`, attachment: computers === undefined ? undefined : (_jsx(StatusBarPicker, { ...(computerPickerOpen === undefined
                 ? {}
                 : { open: computerPickerOpen }), ...(onComputerPickerOpenChange === undefined
@@ -215,5 +252,8 @@ export function WindowStatusBar({ projection, onSelectComputer, onAction, surfac
                 : { onOpenChange: onComputerPickerOpenChange }), noun: "Computer", pluralNoun: "Computers", accessibleLabel: `Choose Computer for ${title}`, icon: _jsx(Sigil, { name: "computer", size: 16 }), options: computers.map((computer) => ({
                 id: computer.computerId,
                 label: computer.name,
-            })), value: launchComputerId(projection.launch.href), emptyMessage: "No Computers are granted to this App", disabled: projection.status === "loading", onSelect: onSelectComputer })), end: end.length === 0 ? undefined : end.map(render), children: start.length === 0 ? undefined : start.map(render) }));
+            })), value: launchComputerId(projection.launch.href), emptyMessage: "No Computers are granted to this App", disabled: projection.status === "loading" ||
+                projection.status === "getting-ready", onSelect: onSelectComputer })), end: onReload ? (_jsxs("span", { className: phone
+                ? "flex min-w-0 items-center gap-xs"
+                : "flex min-w-0 flex-wrap items-center gap-xs", children: [appReadouts, _jsxs(AppStatusItem, { children: [_jsx("span", { role: "status", children: phone ? "Update ready" : "New version available" }), _jsx(StatusBarChip, { label: "Reload", "aria-label": `Reload ${title}`, onClick: onReload })] })] })) : (appReadouts), children: start.length === 0 ? undefined : start.map(render) }));
 }

package/dist/AppWorkbench.d.ts

@@ -2,7 +2,7 @@ import type { DesktopMethods } from "./desktop-api.js";
 import type { AppOpenInput } from "@fungi.computer/agar/apps";
 import { type AppBarItem } from "@fungi.computer/caps/blocks/app-bar";
 import { type ReactNode, type RefObject } from "react";
-import type { WorkbenchDirectory } from "@fungi.computer/oyster/shell/workbench-directory";
+import type { WorkbenchDirectory } from "@fungi.computer/nacre/workbench-directory";
 import { type ComputerOption } from "./app-launch.js";
 import type { PlatformControls } from "./platform-controls.js";
 import type { AppStorage } from "@fungi.computer/agar/storage";

package/dist/AppWorkbench.js

@@ -7,7 +7,7 @@ import { WindowSnapPreview } from "@fungi.computer/caps/components/window";
 import { MaosaicoRegion, useLayer, useMaosaicoLayout, } from "@fungi.computer/maosaico";
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState, useSyncExternalStore, } from "react";
 import { createPortal } from "react-dom";
-import { addressKey } from "@fungi.computer/oyster/shell/app-directory";
+import { addressKey } from "@fungi.computer/nacre/app-directory";
 import { reconcileAppDirectory, reconcileAppWindowFromDirectory, } from "./app-directory-reconciliation.js";
 import { useAppDirectory } from "./app-directory.js";
 import { AppIcon } from "./app-icon.js";
@@ -238,7 +238,9 @@ export function AppWorkbench({ paneLayerRef, phone, teamId, teamName, initialCom
         void refetchApps();
     }), [platform, refetchApps]);
     const launchFor = (installation, currentLaunch) => {
-        return createAppLaunchDescriptor(installation, currentLaunch ? launchComputerId(currentLaunch.href) : initialComputerId, window.location.origin, computers, computersUnavailable);
+        return createAppLaunchDescriptor(installation, currentLaunch
+            ? launchComputerId(currentLaunch.href)
+            : (appsQuery.data?.computer?.computerId ?? initialComputerId), window.location.origin, computers, computersUnavailable);
     };
     const refreshAppDirectory = async (launch) => {
         const attempts = selectionRefreshes.current.get(launch.windowId) ?? 0;
@@ -546,9 +548,12 @@ export function AppWorkbench({ paneLayerRef, phone, teamId, teamName, initialCom
                                 return app ? (launchFor(app)?.computers ?? []) : [];
                             }, storage: desktopStorage, methods: desktopMethods, transport: gills, onRetryApps: () => {
                                 void appsQuery.refetch();
-                            } }) }), _jsxs(MaosaicoRegion, { layer: "windows", style: { height: "100%", pointerEvents: "none" }, ref: paneLayerRef, className: "tourtois-pane-layer", "data-layout-mode": mode, children: [appProjection.windows.map((projection, index) => (_jsx(AppPane, { index: index, focusWindow: focusWindow, afterHide: afterHide, onBack: goBack, manager: appWindows, projection: projection, icon: directory.find((app) => app.surfaceId === projection.launch.surfaceId)?.icon, onError: setAppStatus, onSelectComputer: (windowId, computerId) => {
-                                    void selectWindowComputer(windowId, computerId);
-                                } }, projection.windowId))), extraPanes?.({ activeId, order, focus }), layout.snapPreview && (_jsx(WindowSnapPreview, { "data-snap-side": layout.snapPreview.side, style: {
+                            } }) }), _jsxs(MaosaicoRegion, { layer: "windows", style: { height: "100%", pointerEvents: "none" }, ref: paneLayerRef, className: "tourtois-pane-layer", "data-layout-mode": mode, children: [appProjection.windows.map((projection, index) => {
+                                const app = directory.find((item) => item.surfaceId === projection.launch.surfaceId);
+                                return (_jsx(AppPane, { index: index, focusWindow: focusWindow, afterHide: afterHide, onBack: goBack, manager: appWindows, projection: projection, nextLaunch: app ? launchFor(app, projection.launch) : null, icon: app?.icon, onError: setAppStatus, onSelectComputer: (windowId, computerId) => {
+                                        void selectWindowComputer(windowId, computerId);
+                                    } }, projection.windowId));
+                            }), extraPanes?.({ activeId, order, focus }), layout.snapPreview && (_jsx(WindowSnapPreview, { "data-snap-side": layout.snapPreview.side, style: {
                                     left: layout.snapPreview.frame.x,
                                     top: layout.snapPreview.frame.y,
                                     width: layout.snapPreview.frame.width,

package/dist/AvatarPreview.d.ts

@@ -1,5 +1,12 @@
+import type { SpriteService } from "@fungi.computer/sprite";
 import type { Avatar } from "@fungi.computer/sprite/avatar";
-import type { CSSProperties } from "react";
+import { type CSSProperties } from "react";
+/**
+ * Replaces the shared Shiitake sprite service for every preview below it;
+ * a host or test that must not draw live sprites supplies a fake. Absent, previews
+ * use Parakeet's shared service.
+ */
+export declare const AvatarSpriteServiceContext: import("react").Context<SpriteService | undefined>;
 /** Member and picker previews use Parakeet's shared avatar mapper and service. */
 export declare function AvatarPreview({ avatar, activity, expression, className, style, }: {
     avatar: Avatar;

package/dist/AvatarPreview.js

@@ -1,6 +1,14 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { ShiitakeAvatar } from "@fungi.computer/parakeet/agent-head";
+import { createContext, useContext } from "react";
+/**
+ * Replaces the shared Shiitake sprite service for every preview below it;
+ * a host or test that must not draw live sprites supplies a fake. Absent, previews
+ * use Parakeet's shared service.
+ */
+export const AvatarSpriteServiceContext = createContext(undefined);
 /** Member and picker previews use Parakeet's shared avatar mapper and service. */
 export function AvatarPreview({ avatar, activity = "idle", expression = avatar.expression, className, style, }) {
-    return (_jsx("span", { className: className, style: { display: "block", ...style }, "aria-hidden": "true", children: _jsx(ShiitakeAvatar, { avatar: avatar, className: "h-full w-full", state: { activity, expression } }) }));
+    const service = useContext(AvatarSpriteServiceContext);
+    return (_jsx("span", { className: className, style: { display: "block", ...style }, "aria-hidden": "true", children: _jsx(ShiitakeAvatar, { avatar: avatar, className: "h-full w-full", ...(service ? { service } : {}), state: { activity, expression } }) }));
 }

package/dist/Keys.d.ts

@@ -1,131 +1,52 @@
-import * as z from "zod";
-/** One App's level a key may hold: read-only, or read and change. */
-declare const keyAppAccessLevelSchema: z.ZodEnum<{
-    read: "read";
-    write: "write";
+import type { Grant } from "@fungi.computer/ear-tag/grants";
+import type { IssueKeyInput, KeySummary, UpdateGrantsInput } from "@fungi.computer/ear-tag/keys";
+import { type ComponentType } from "react";
+export type KeyAppOption = Readonly<{
+    installationId: string;
+    displayName: string;
 }>;
-export type KeyAppAccessLevel = z.output<typeof keyAppAccessLevelSchema>;
-/** What a grant reaches: every installed App (including future installs), or named ones. */
-export declare const keyGrantTargetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    kind: z.ZodLiteral<"all">;
-}, z.core.$strict>, z.ZodObject<{
-    kind: z.ZodLiteral<"selected">;
-    installationIds: z.ZodArray<z.ZodString>;
-}, z.core.$strict>], "kind">;
-export type KeyGrantTarget = z.output<typeof keyGrantTargetSchema>;
-/** One App-scoped grant a key holds. */
-export declare const keyGrantSchema: z.ZodObject<{
-    level: z.ZodEnum<{
-        read: "read";
-        write: "write";
-    }>;
-    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        kind: z.ZodLiteral<"all">;
-    }, z.core.$strict>, z.ZodObject<{
-        kind: z.ZodLiteral<"selected">;
-        installationIds: z.ZodArray<z.ZodString>;
-    }, z.core.$strict>], "kind">;
-}, z.core.$strict>;
-export type KeyGrant = z.output<typeof keyGrantSchema>;
-/** One key as the host lists it; its secret never comes back after issuing. */
-export declare const keyRecordSchema: z.ZodObject<{
-    keyId: z.ZodString;
-    name: z.ZodString;
-    grants: z.ZodArray<z.ZodObject<{
-        level: z.ZodEnum<{
-            read: "read";
-            write: "write";
-        }>;
-        target: z.ZodDiscriminatedUnion<[z.ZodObject<{
-            kind: z.ZodLiteral<"all">;
-        }, z.core.$strict>, z.ZodObject<{
-            kind: z.ZodLiteral<"selected">;
-            installationIds: z.ZodArray<z.ZodString>;
-        }, z.core.$strict>], "kind">;
-    }, z.core.$strict>>;
-    computerAccess: z.ZodBoolean;
-    expiresAt: z.ZodNullable<z.ZodNumber>;
-    createdAt: z.ZodNumber;
-    lastUsedAt: z.ZodNullable<z.ZodNumber>;
-    revokedAt: z.ZodNullable<z.ZodNumber>;
-}, z.core.$strict>;
-export type KeyRecord = z.output<typeof keyRecordSchema>;
-/** Every key this owner has issued. */
-export declare const keysViewSchema: z.ZodObject<{
-    keys: z.ZodArray<z.ZodObject<{
-        keyId: z.ZodString;
-        name: z.ZodString;
-        grants: z.ZodArray<z.ZodObject<{
-            level: z.ZodEnum<{
-                read: "read";
-                write: "write";
-            }>;
-            target: z.ZodDiscriminatedUnion<[z.ZodObject<{
-                kind: z.ZodLiteral<"all">;
-            }, z.core.$strict>, z.ZodObject<{
-                kind: z.ZodLiteral<"selected">;
-                installationIds: z.ZodArray<z.ZodString>;
-            }, z.core.$strict>], "kind">;
-        }, z.core.$strict>>;
-        computerAccess: z.ZodBoolean;
-        expiresAt: z.ZodNullable<z.ZodNumber>;
-        createdAt: z.ZodNumber;
-        lastUsedAt: z.ZodNullable<z.ZodNumber>;
-        revokedAt: z.ZodNullable<z.ZodNumber>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-export type KeysView = z.output<typeof keysViewSchema>;
-/** What the owner submits to issue one key. */
-export type KeyIssueDraft = Readonly<{
+export type KeyTargetOption = Readonly<{
+    id: string;
     name: string;
-    grants: readonly KeyGrant[];
-    computerAccess: boolean;
-    expiresAt: number | null;
 }>;
-/** The plaintext secret, shown exactly once, plus the issued record. */
-export declare const keyIssueResultSchema: z.ZodObject<{
-    plaintext: z.ZodString;
-    key: z.ZodObject<{
-        keyId: z.ZodString;
-        name: z.ZodString;
-        grants: z.ZodArray<z.ZodObject<{
-            level: z.ZodEnum<{
-                read: "read";
-                write: "write";
-            }>;
-            target: z.ZodDiscriminatedUnion<[z.ZodObject<{
-                kind: z.ZodLiteral<"all">;
-            }, z.core.$strict>, z.ZodObject<{
-                kind: z.ZodLiteral<"selected">;
-                installationIds: z.ZodArray<z.ZodString>;
-            }, z.core.$strict>], "kind">;
-        }, z.core.$strict>>;
-        computerAccess: z.ZodBoolean;
-        expiresAt: z.ZodNullable<z.ZodNumber>;
-        createdAt: z.ZodNumber;
-        lastUsedAt: z.ZodNullable<z.ZodNumber>;
-        revokedAt: z.ZodNullable<z.ZodNumber>;
-    }, z.core.$strict>;
-}, z.core.$strict>;
-export type KeyIssueResult = z.output<typeof keyIssueResultSchema>;
-/** The host's owner-direct custody for Keys. */
+/** Presentation supplied by the host, not another capability catalog. */
+export type KeyGrantOption = Readonly<{
+    capability: string;
+    label: string;
+    /** Omit for capabilities which have no selected-target form. */
+    targets?: readonly KeyTargetOption[];
+}>;
+export type KeyIssueDraft = Pick<IssueKeyInput<string>, "name" | "grants" | "expiresAt">;
+export type KeysView = Readonly<{
+    keys: readonly KeySummary<string>[];
+}>;
+export type KeyIssueResult = Readonly<{
+    plaintext: string;
+    key: KeySummary<string>;
+}>;
+export type KeyChange = Readonly<{
+    key: KeySummary<string>;
+    notice: string;
+    /** Replay the same command, never generate another mutation identity. */
+    retry: boolean;
+}>;
+export type KeyGrantPreviewProps = Readonly<{
+    grants: readonly Grant[];
+    onReady: (ready: boolean) => void;
+}>;
+/** Hosts decode their current transport with their own Ear Tag vocabulary. */
 export type KeysPort = Readonly<{
+    scope: string;
+    expiry: "required" | "optional";
+    options(apps: readonly KeyAppOption[], signal: AbortSignal): Promise<readonly KeyGrantOption[]>;
     list(): Promise<KeysView>;
     issue(draft: KeyIssueDraft): Promise<KeyIssueResult>;
-    revoke(keyId: string, requestId: string): Promise<KeyRecord>;
-}>;
-/** One App this Oyster has installed, as the Keys page needs it. */
-export type KeyAppOption = Readonly<{
-    installationId: string;
-    displayName: string;
+    updateGrants?(input: UpdateGrantsInput<string>): Promise<KeyChange>;
+    revoke(keyId: string, requestId: string): Promise<KeyChange>;
+    Preview?: ComponentType<KeyGrantPreviewProps>;
 }>;
-/**
- * The Keys settings on a standalone host: issue, list and revoke keys that
- * act with the owner's own access, limited to the Apps, level and expiry
- * chosen here. A key never gets its own identity; it narrows the owner's.
- */
-export declare function Keys({ port, apps, }: {
+/** Scope changes remount the secret-once state as well as separating query caches. */
+export declare function Keys(props: {
     port: KeysPort;
     apps: readonly KeyAppOption[];
 }): import("react/jsx-runtime").JSX.Element;
-export {};