@inf-monkeys-tech/monkeys 1.1.16 → 1.1.18

package/lib/esm/runtime/index.mjs

@@ -7321,7 +7321,7 @@ var require__ = __commonJS({
     var discriminator_1 = require_discriminator();
     var json_schema_2020_12_1 = require_json_schema_2020_12();
     var META_SCHEMA_ID = "https://json-schema.org/draft/2020-12/schema";
-    var Ajv20202 = class extends core_1.default {
+    var Ajv20203 = class extends core_1.default {
       constructor(opts = {}) {
         super({
           ...opts,
@@ -7348,11 +7348,11 @@ var require__ = __commonJS({
         return this.opts.defaultMeta = super.defaultMeta() || (this.getSchema(META_SCHEMA_ID) ? META_SCHEMA_ID : void 0);
       }
     };
-    exports.Ajv2020 = Ajv20202;
-    module.exports = exports = Ajv20202;
-    module.exports.Ajv2020 = Ajv20202;
+    exports.Ajv2020 = Ajv20203;
+    module.exports = exports = Ajv20203;
+    module.exports.Ajv2020 = Ajv20203;
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.default = Ajv20202;
+    exports.default = Ajv20203;
     var validate_1 = require_validate();
     Object.defineProperty(exports, "KeywordCxt", { enumerable: true, get: function() {
       return validate_1.KeywordCxt;
@@ -11198,6 +11198,7 @@ var ReleaseDependencyRoleSchema = z13.enum([
   "view",
   "projection",
   "action",
+  "action-program",
   "token",
   "schema",
   "compiler",
@@ -11228,6 +11229,7 @@ var DependencyKindByRole = {
   view: "view",
   projection: "projection",
   action: "domain-command",
+  "action-program": "action-program",
   token: "design-token",
   schema: "schema",
   compiler: "compiler",
@@ -12180,8 +12182,14 @@ var QueryBindingSchema = z13.object({
 }).strict().superRefine((value, context) => {
   if (value.draftRetention) {
     const names = value.draftRetention.identityParameters;
-    if (value.execution !== "server" || new Set(names).size !== names.length || names.some((name) => !Object.prototype.hasOwnProperty.call(value.parameters, name))) {
-      context.addIssue({ code: "custom", path: ["draftRetention"], message: "Draft retention requires distinct declared Server query identity parameters." });
+    if (value.execution !== "server" || new Set(names).size !== names.length || names.some(
+      (name) => !Object.prototype.hasOwnProperty.call(value.parameters, name)
+    )) {
+      context.addIssue({
+        code: "custom",
+        path: ["draftRetention"],
+        message: "Draft retention requires distinct declared Server query identity parameters."
+      });
     }
   }
   if (value.targetProjection) {
@@ -12875,6 +12883,237 @@ var PageDataSchema = QueryBindingSchema.omit({
   cursorWindow: PageCursorWindowSchema.optional(),
   resultStateBindings: z13.array(PageResultStateBindingSchema).max(32).optional()
 }).strict();
+var ACTION_PROGRAM_ABI = "monkeys.action-program/2";
+var ActionProgramBudgetsSchema = z13.object({
+  rpcMs: z13.number().int().positive().max(3e4),
+  concurrentCalls: z13.number().int().positive().max(4),
+  calls: z13.number().int().positive().max(128),
+  messageBytes: z13.number().int().positive().max(1048576),
+  activeMs: z13.number().int().positive().max(12e4),
+  formMs: z13.number().int().positive().max(3e5),
+  wallMs: z13.number().int().positive().max(6e5)
+}).strict();
+var DEFAULT_ACTION_PROGRAM_BUDGETS = Object.freeze({
+  rpcMs: 3e4,
+  concurrentCalls: 4,
+  calls: 128,
+  messageBytes: 1048576,
+  activeMs: 12e4,
+  formMs: 3e5,
+  wallMs: 6e5
+});
+var ProgramSchemaRefSchema = RevisionRefSchema.refine(
+  (ref2) => ref2.kind === "schema",
+  "Expected an exact Schema reference."
+);
+var ActionProgramDependencySchema = z13.object({
+  kind: z13.enum(["query", "command"]),
+  revisionRef: RevisionRefSchema,
+  inputSchemaRevisionRef: ProgramSchemaRefSchema,
+  resultSchemaRevisionRef: ProgramSchemaRefSchema,
+  download: ActionBindingSchema.shape.success.shape.download,
+  // Fixed/identity arguments are injected by the trusted caller, never by guest code.
+  dynamicInputKeys: z13.array(ContractIdentifierSchema).max(128)
+}).strict().superRefine((value, context) => {
+  const expected = value.kind === "query" ? "domain-query-definition" : "domain-command";
+  if (value.revisionRef.kind !== expected)
+    context.addIssue({
+      code: "custom",
+      path: ["revisionRef", "kind"],
+      message: `Expected ${expected}.`
+    });
+  if (new Set(value.dynamicInputKeys).size !== value.dynamicInputKeys.length)
+    context.addIssue({
+      code: "custom",
+      path: ["dynamicInputKeys"],
+      message: "Dynamic input keys must be unique."
+    });
+});
+var ActionProgramDefinitionSchema = z13.object({
+  contract: z13.literal("ActionProgramDefinition"),
+  schemaVersion: z13.literal(1),
+  programId: ContractIdentifierSchema,
+  ownerRepo: ContractIdentifierSchema,
+  tenantScope: TenantScopeSchema,
+  supportedSurface: z13.literal("studio"),
+  inputSchemaRevisionRef: ProgramSchemaRefSchema,
+  resultSchemaRevisionRef: ProgramSchemaRefSchema,
+  entry: z13.literal("main"),
+  abi: z13.literal(ACTION_PROGRAM_ABI),
+  compiler: z13.string().trim().min(1).max(128),
+  target: z13.literal("browser-worker-es2020"),
+  sourceHash: Sha256Schema,
+  compiledHash: Sha256Schema,
+  sourceMapHash: Sha256Schema,
+  dependencies: z13.array(ActionProgramDependencySchema).max(128),
+  effects: z13.array(
+    z13.enum([
+      "form",
+      "toast",
+      "refresh",
+      "download",
+      "state.get",
+      "state.set"
+    ])
+  ).max(6),
+  refreshAliases: z13.array(ContractIdentifierSchema).max(128),
+  stateAliases: z13.array(
+    z13.object({
+      alias: ContractIdentifierSchema,
+      schemaRevisionRef: ProgramSchemaRefSchema
+    }).strict()
+  ).max(128),
+  budgets: ActionProgramBudgetsSchema
+}).strict().superRefine((value, context) => {
+  for (const [name, keys] of [
+    [
+      "dependencies",
+      value.dependencies.map((dep) => `${dep.kind}:${dep.revisionRef.id}`)
+    ],
+    ["effects", value.effects],
+    ["refreshAliases", value.refreshAliases],
+    ["stateAliases", value.stateAliases.map((entry) => entry.alias)]
+  ])
+    if (new Set(keys).size !== keys.length)
+      context.addIssue({
+        code: "custom",
+        path: [name],
+        message: "Program declarations must be unique."
+      });
+  const refs = [
+    value.inputSchemaRevisionRef,
+    value.resultSchemaRevisionRef,
+    ...value.dependencies.flatMap((dep) => [
+      dep.revisionRef,
+      dep.inputSchemaRevisionRef,
+      dep.resultSchemaRevisionRef
+    ]),
+    ...value.stateAliases.map((entry) => entry.schemaRevisionRef)
+  ];
+  refs.forEach((ref2, index) => {
+    if (ref2.visibility === "tenant" && ref2.tenantScope && tenantScopeKey(ref2.tenantScope) !== tenantScopeKey(value.tenantScope))
+      context.addIssue({
+        code: "custom",
+        path: ["dependencies"],
+        message: `Cross-tenant program reference ${index}.`
+      });
+  });
+});
+var ActionProgramArtifactSchema = z13.object({
+  definition: ActionProgramDefinitionSchema,
+  // Hashes use canonicalContentHash of the exact UTF-8 string, not engine bytecode.
+  javascript: z13.string().min(1).max(262144).refine(
+    (value) => new TextEncoder().encode(value).length <= 262144,
+    "Program exceeds 256 KiB."
+  ),
+  sourceMap: z13.string().min(1).max(524288).refine(
+    (value) => new TextEncoder().encode(value).length <= 524288,
+    "Source map exceeds 512 KiB."
+  )
+}).strict();
+var ProgramInputSourceSchema = z13.discriminatedUnion("kind", [
+  ...BindingSourceSchema.options,
+  ExpressionBindingSourceSchema
+]);
+var ProgramBindingShape = {
+  bindingId: ContractIdentifierSchema,
+  inputMapping: z13.record(ContractIdentifierSchema, ProgramInputSourceSchema),
+  dependencyInputs: z13.record(
+    ContractIdentifierSchema,
+    z13.record(ContractIdentifierSchema, ProgramInputSourceSchema)
+  ),
+  accessPolicy: AccessPolicySchema,
+  confirmation: I18nTextSchema.optional(),
+  when: PageExpressionSchema.optional(),
+  concurrencyKeyPath: PageValuePathSchema.min(1),
+  refreshAliases: z13.record(
+    ContractIdentifierSchema,
+    z13.array(ContractIdentifierSchema).min(1).max(128)
+  ),
+  stateAliases: z13.record(ContractIdentifierSchema, ContractIdentifierSchema)
+};
+var PageProgramActionSchema = z13.object({
+  ...ProgramBindingShape,
+  program: ContractIdentifierSchema,
+  port: ContractIdentifierSchema
+}).strict();
+var ProgramBindingSchema = z13.object({
+  ...ProgramBindingShape,
+  source: z13.object({
+    capabilityInstanceId: ContractIdentifierSchema,
+    port: ContractIdentifierSchema
+  }).strict(),
+  sourceIntentSchemaRevisionRef: ProgramSchemaRefSchema,
+  programRevisionRef: RevisionRefSchema.refine(
+    (ref2) => ref2.kind === "action-program",
+    "Expected action-program reference."
+  ),
+  definition: ActionProgramDefinitionSchema
+}).strict();
+function validateProgramBindingTargets(page, context) {
+  const ids = new Set(page.actionBindings.map((binding) => binding.bindingId));
+  const ports = new Set(
+    page.actionBindings.map(
+      (binding) => `${binding.source.capabilityInstanceId}:${binding.source.port}`
+    )
+  );
+  const dataIds = new Set(
+    [...page.ontologyBindings, ...page.queryBindings ?? []].map(
+      (binding) => binding.bindingId
+    )
+  );
+  for (const [index, binding] of (page.programBindings ?? []).entries()) {
+    const issue = (message) => context.addIssue({
+      code: "custom",
+      path: ["programBindings", index],
+      message
+    });
+    const port = `${binding.source.capabilityInstanceId}:${binding.source.port}`;
+    if (ids.has(binding.bindingId) || ports.has(port))
+      issue("Program binding id and event must be exclusive.");
+    ids.add(binding.bindingId);
+    ports.add(port);
+    if (!page.capabilityInstances.some(
+      (instance) => instance.instanceId === binding.source.capabilityInstanceId
+    ))
+      issue("Program source instance is missing.");
+    const exactKeys = (keys, expected) => keys.length === expected.length && keys.every((key) => expected.includes(key));
+    if (!exactKeys(
+      Object.keys(binding.refreshAliases),
+      binding.definition.refreshAliases
+    ) || Object.values(binding.refreshAliases).some(
+      (targets) => targets.some((target) => !dataIds.has(target))
+    ))
+      issue(
+        "Program refresh aliases must resolve exactly to declared data bindings."
+      );
+    if (!exactKeys(
+      Object.keys(binding.stateAliases),
+      binding.definition.stateAliases.map((entry) => entry.alias)
+    ))
+      issue("Program state aliases must match its manifest.");
+    for (const entry of binding.definition.stateAliases) {
+      const state = page.stateDefinitions?.find(
+        (state2) => state2.stateId === binding.stateAliases[entry.alias]
+      );
+      if (!state || !exactRevisionRef(state.schemaRevisionRef, entry.schemaRevisionRef))
+        issue("Program state alias has an incompatible Schema.");
+    }
+    const dependencyIds = binding.definition.dependencies.map(
+      (dep) => dep.revisionRef.id
+    );
+    if (!Object.keys(binding.dependencyInputs).every(
+      (key) => dependencyIds.includes(key)
+    ))
+      issue("Unknown program dependency input mapping.");
+    for (const dep of binding.definition.dependencies) {
+      if (Object.keys(binding.dependencyInputs[dep.revisionRef.id] ?? {}).some(
+        (key) => dep.dynamicInputKeys.includes(key)
+      ))
+        issue("Fixed dependency arguments cannot also be guest-writable.");
+    }
+  }
+}
 var PageActionSchema = ActionBindingSchema.omit({
   commandRevisionRef: true,
   source: true,
@@ -12917,6 +13156,7 @@ var PageNodeSchema = z13.lazy(
     }).strict().optional(),
     data: z13.array(PageDataSchema).optional(),
     actions: z13.array(PageActionSchema).optional(),
+    programActions: z13.array(PageProgramActionSchema).max(128).optional(),
     on: z13.array(PageInteractionSchema).optional(),
     effects: z13.array(PageEventEffectSchema).optional(),
     eventPayloads: z13.array(
@@ -12995,6 +13235,7 @@ var PageSchema = z13.object({
     for (const [field, values, target] of [
       ["data", node.data ?? [], dataIds],
       ["actions", node.actions ?? [], actionIds],
+      ["programActions", node.programActions ?? [], actionIds],
       ["on", node.on ?? [], interactionIds]
     ])
       for (const [index, value] of values.entries()) {
@@ -13048,6 +13289,7 @@ var ResolvedPageSchema = z13.object({
   ontologyBindings: z13.array(PersistedOntologyBindingSchema),
   queryBindings: z13.array(QueryBindingSchema).optional(),
   actionBindings: z13.array(ActionBindingSchema),
+  programBindings: z13.array(ProgramBindingSchema).max(128).optional(),
   pageAccessPolicy: AccessPolicySchema,
   managementAccess: ManagementAccessSchema,
   tokenRevisionRefs: z13.array(RevisionRefSchema).min(1),
@@ -13060,6 +13302,7 @@ var ResolvedPageSchema = z13.object({
     "restricted"
   ])
 }).strict().superRefine((value, context) => {
+  validateProgramBindingTargets(value, context);
   validateDeclaredRouteSurfaces(
     value.supportedSurfaces,
     value.routeClaims,
@@ -13417,6 +13660,35 @@ var ResolvedPageSchema = z13.object({
       )
     );
   }
+  (value.programBindings ?? []).forEach((binding, index) => {
+    const scopes = scopesForNode(
+      instanceNodes.get(binding.source.capabilityInstanceId)
+    );
+    checkScopedSources(binding.inputMapping, scopes, [
+      "programBindings",
+      index,
+      "inputMapping"
+    ]);
+    for (const [id, mapping] of Object.entries(binding.dependencyInputs))
+      checkScopedSources(mapping, scopes, [
+        "programBindings",
+        index,
+        "dependencyInputs",
+        id
+      ]);
+    if (binding.when) {
+      const reads = collectPageExpressionReads(binding.when);
+      checkScopedReads(reads, scopes, ["programBindings", index, "when"]);
+      if (reads.some(
+        (read) => read.root === "state" && !stateIds.has(read.path[0])
+      ))
+        context.addIssue({
+          code: "custom",
+          path: ["programBindings", index, "when"],
+          message: "Program condition references an unknown Page state."
+        });
+    }
+  });
   value.actionBindings.forEach((binding, index) => {
     const scopes = scopesForNode(
       instanceNodes.get(binding.source.capabilityInstanceId)
@@ -13997,7 +14269,10 @@ var ResolvedPageSchema = z13.object({
     const conflictingInteraction = interactionBindings.some(
       (candidate) => candidate.source.capabilityInstanceId === sourceId && candidate.source.port === binding.cursorWindow.pageChangePort
     );
-    const conflictingAction = value.actionBindings.some(
+    const conflictingAction = [
+      ...value.actionBindings,
+      ...value.programBindings ?? []
+    ].some(
       (candidate) => candidate.source.capabilityInstanceId === sourceId && candidate.source.port === binding.cursorWindow.pageChangePort
     );
     if (conflictingInteraction || conflictingAction) {
@@ -14008,6 +14283,20 @@ var ResolvedPageSchema = z13.object({
       });
     }
   });
+  (value.programBindings ?? []).forEach((binding, index) => {
+    validatePageStateSources(binding.inputMapping, [
+      "programBindings",
+      index,
+      "inputMapping"
+    ]);
+    for (const [id, mapping] of Object.entries(binding.dependencyInputs))
+      validatePageStateSources(mapping, [
+        "programBindings",
+        index,
+        "dependencyInputs",
+        id
+      ]);
+  });
   value.actionBindings.forEach((binding, index) => {
     if (!instanceIds.has(binding.source.capabilityInstanceId)) {
       context.addIssue({
@@ -14848,6 +15137,7 @@ var CompatiblePageRuntimeBundleSchema = z13.object({
   ontologyBindings: z13.array(PersistedOntologyBindingSchema),
   queryBindings: z13.array(QueryBindingSchema).default([]),
   actionBindings: z13.array(ActionBindingSchema),
+  programBindings: z13.array(ProgramBindingSchema).max(128).optional(),
   pageAccessPolicy: AccessPolicySchema,
   tokenRevisionRefs: z13.array(RevisionRefSchema),
   performanceBudgetRef: RevisionRefSchema,
@@ -14870,6 +15160,7 @@ var CompatiblePageRuntimeBundleSchema = z13.object({
       message: "Denied capability identities must be unique declared instances."
     });
   }
+  validateProgramBindingTargets(value, context);
   validateRuntimeBundleBase(value, "page-release", context);
   value.routeClaims.forEach((claim, index) => {
     if (claim.surface !== value.surface) {
@@ -18493,6 +18784,17 @@ var pageDependencies = (page, compilerRevisionRef) => [
       }
     ] : []
   ]),
+  ...(page.programBindings ?? []).flatMap((binding) => [
+    {
+      role: "action-program",
+      revisionRef: binding.programRevisionRef
+    },
+    {
+      role: "schema",
+      revisionRef: binding.sourceIntentSchemaRevisionRef
+    },
+    ...programDependencies(binding.definition)
+  ]),
   ...page.actionBindings.flatMap((binding) => [
     { role: "action", revisionRef: binding.commandRevisionRef },
     {
@@ -18724,6 +19026,7 @@ var resolvePage = (input) => {
   const capabilityInstances = [];
   const queryBindings = [];
   const actionBindings = [];
+  const programBindings = [];
   const interactionBindings = [];
   const nodesById = /* @__PURE__ */ new Map();
   const indexNode = (node) => {
@@ -18936,6 +19239,76 @@ var resolvePage = (input) => {
         resultSchemaRevisionRef
       });
     }
+    for (const [index, binding] of (node.programActions ?? []).entries()) {
+      const path = `page.body.${node.id}.programActions[${index}]`;
+      const matches = (input.programRegistry ?? []).filter(
+        (entry) => entry.definition.programId === binding.program
+      );
+      if (matches.length !== 1)
+        throw new DeclarativeControlCompilationError(
+          "DEPENDENCY_MISSING",
+          path,
+          "Expected one exact program registration."
+        );
+      const program = matches[0];
+      const definition = ActionProgramDefinitionSchema.parse(
+        program.definition
+      );
+      assertProgramRegistration(program, page.tenantScope, page.surface, path);
+      const port = registration.outputPorts.find(
+        (candidate) => candidate.name === binding.port
+      );
+      if (!port)
+        throw new DeclarativeControlCompilationError(
+          "PORT_TYPE_MISMATCH",
+          path,
+          "Program source port is not registered."
+        );
+      if ((node.actions ?? []).some((action) => action.port === binding.port) || programBindings.some(
+        (action) => action.source.capabilityInstanceId === node.id && action.source.port === binding.port
+      ))
+        throw new DeclarativeControlCompilationError(
+          "CAPABILITY_BINDING_MISMATCH",
+          path,
+          "A program output port must have one exclusive action binding."
+        );
+      for (const dep of definition.dependencies) {
+        const registrations = dep.kind === "query" ? queryRegistrations : commandRegistrations;
+        const actual = registrations.find(
+          (entry) => sameRevisionRef(entry.revisionRef, dep.revisionRef)
+        );
+        if (!actual || canonicalContentHash(actual.definition) !== dep.revisionRef.contentHash || "sensitiveInputPaths" in actual.definition && !!actual.definition.sensitiveInputPaths?.length || "sensitiveResultPaths" in actual.definition && !!actual.definition.sensitiveResultPaths?.length || ("queryId" in actual.definition ? !sameRevisionRef(
+          actual.definition.inputSchemaRevisionRef,
+          dep.inputSchemaRevisionRef
+        ) || !sameRevisionRef(
+          actual.definition.resultSchemaRevisionRef,
+          dep.resultSchemaRevisionRef
+        ) : actual.definition.inputSchemaRef !== dep.inputSchemaRevisionRef.id || actual.definition.outputSchemaRef !== dep.resultSchemaRevisionRef.id))
+          throw new DeclarativeControlCompilationError(
+            "DEPENDENCY_MISSING",
+            path,
+            "Program capability/schema revision is not registered."
+          );
+      }
+      for (const ref2 of programDependencies(definition).filter((dep) => dep.role === "schema").map((dep) => dep.revisionRef)) {
+        if (!schemaRegistrations.some(
+          (entry) => sameRevisionRef(entry.revisionRef, ref2)
+        ))
+          throw new DeclarativeControlCompilationError(
+            "SCHEMA_DEFINITION_MISMATCH",
+            path,
+            "Program requires an exact registered Schema."
+          );
+      }
+      const { program: _program, port: _port, ...rest } = binding;
+      programBindings.push({
+        ...rest,
+        source: { capabilityInstanceId: node.id, port: binding.port },
+        sourceIntentSchemaRevisionRef: port.schemaRevisionRef,
+        programRevisionRef: program.definitionRevisionRef,
+        definition
+      });
+    }
     for (const [index, binding] of (node.on ?? []).entries()) {
       const port = registration.outputPorts.find(
         (candidate) => candidate.name === binding.port
@@ -19021,6 +19394,7 @@ var resolvePage = (input) => {
     ontologyBindings: [],
     ...queryBindings.length ? { queryBindings } : {},
     actionBindings,
+    ...programBindings.length ? { programBindings } : {},
     pageAccessPolicy: page.access,
     managementAccess: page.managementAccess,
     tokenRevisionRefs,
@@ -19519,27 +19893,47 @@ var compilePageRuntimeBundleInternal = (input, legacy) => {
       );
     }
   });
-  page.actionBindings.forEach((binding, index) => {
-    const instance = page.capabilityInstances.find(
-      (candidate) => candidate.instanceId === binding.source.capabilityInstanceId
-    );
-    const registration = instance && registrationsByPair.get(
-      `${revisionRefKey(instance.capabilityRevisionRef)}:${revisionRefKey(instance.providerRevisionRef)}`
-    );
-    const port = registration?.outputPorts.find(
-      (candidate) => candidate.name === binding.source.port
+  (page.programBindings ?? []).forEach((binding, index) => {
+    const path = `programBindings[${index}]`;
+    const registration = (input.programRegistry ?? []).find(
+      (entry) => sameRevisionRef(entry.definitionRevisionRef, binding.programRevisionRef)
     );
-    if (!port || !sameSchemaContract(
-      port.schemaRevisionRef,
-      binding.sourceIntentSchemaRevisionRef
-    )) {
+    if (!registration || canonicalContentHash(registration.definition) !== canonicalContentHash(binding.definition))
       throw new DeclarativeControlCompilationError(
-        "PORT_TYPE_MISMATCH",
-        `actionBindings[${index}].sourceIntentSchemaRevisionRef`,
-        "Action source intent does not match the registered capability output port."
+        "DEPENDENCY_MISSING",
+        path,
+        "Exact program registration does not match binding."
       );
-    }
+    assertProgramRegistration(
+      registration,
+      page.tenantScope,
+      release.target.surface,
+      path
+    );
   });
+  [...page.actionBindings, ...page.programBindings ?? []].forEach(
+    (binding, index) => {
+      const instance = page.capabilityInstances.find(
+        (candidate) => candidate.instanceId === binding.source.capabilityInstanceId
+      );
+      const registration = instance && registrationsByPair.get(
+        `${revisionRefKey(instance.capabilityRevisionRef)}:${revisionRefKey(instance.providerRevisionRef)}`
+      );
+      const port = registration?.outputPorts.find(
+        (candidate) => candidate.name === binding.source.port
+      );
+      if (!port || !sameSchemaContract(
+        port.schemaRevisionRef,
+        binding.sourceIntentSchemaRevisionRef
+      )) {
+        throw new DeclarativeControlCompilationError(
+          "PORT_TYPE_MISMATCH",
+          `actionBindings[${index}].sourceIntentSchemaRevisionRef`,
+          "Action source intent does not match the registered capability output port."
+        );
+      }
+    }
+  );
   const routeClaims = compileRouteClaims({
     claims: page.routeClaims,
     routeSpaces: input.routeSpaces,
@@ -19693,6 +20087,7 @@ var compilePageRuntimeBundleInternal = (input, legacy) => {
     ontologyBindings: page.ontologyBindings,
     queryBindings: page.queryBindings,
     actionBindings: page.actionBindings,
+    ...page.programBindings?.length ? { programBindings: page.programBindings } : {},
     pageAccessPolicy: page.pageAccessPolicy,
     tokenRevisionRefs: page.tokenRevisionRefs,
     performanceBudgetRef: page.performanceBudgetRef,
@@ -20007,7 +20402,9 @@ var compileNavigationRuntimeBundle = (input) => {
     input.compilerRevisionRef
   );
   const scope = TenantScopeSchema.parse(navigation.tenantScope);
-  const verifiedKernelPageReferences = [...input.verifiedKernelPageReferences ?? []].map((reference, index) => {
+  const verifiedKernelPageReferences = [
+    ...input.verifiedKernelPageReferences ?? []
+  ].map((reference, index) => {
     const parsed = RevisionRefSchema.parse(reference);
     if (release.target.surface !== "kernel" || parsed.visibility !== "tenant" || !parsed.tenantScope?.teamRef?.id.startsWith("kernel-page.") || parsed.ownerRepo !== "monkeys-server" || !["page", "page-release"].includes(parsed.kind)) {
       throw new DeclarativeControlCompilationError(
@@ -20221,8 +20618,14 @@ var compileNavigationRuntimeBundle = (input) => {
     const released = releasedByNodeId.get(node.nodeId);
     const unavailable = unavailableByNodeId.get(node.nodeId);
     if (!registration && node.targetRef.kind === "page" && (unavailable && sameStableRef(unavailable.stableTargetRef, node.targetRef) || released && sameStableRef(released.stableTargetRef, node.targetRef))) {
-      if (!released || !verifiedKernelPageReferenceKeys.has(revisionRefKey(released.targetRevisionRef))) {
-        assertTenantCompatible(node.targetRef, scope, `nodes[${index}].targetRef`);
+      if (!released || !verifiedKernelPageReferenceKeys.has(
+        revisionRefKey(released.targetRevisionRef)
+      )) {
+        assertTenantCompatible(
+          node.targetRef,
+          scope,
+          `nodes[${index}].targetRef`
+        );
       }
       if (unavailable?.accessPolicy && !accessPolicyChainImplies(
         [...ancestors, node.audience],
@@ -20251,7 +20654,10 @@ var compileNavigationRuntimeBundle = (input) => {
     if (!registration || !released && !(currentPage && unavailable && sameStableRef(unavailable.stableTargetRef, node.targetRef)) || !sameStableRef(
       registration.stableTargetRef,
       stableFromRevision(registration.targetRevisionRef)
-    ) || released && !sameStableRef(registration.stableTargetRef, released.stableTargetRef) || !currentPage && released && !sameRevisionRef(
+    ) || released && !sameStableRef(
+      registration.stableTargetRef,
+      released.stableTargetRef
+    ) || !currentPage && released && !sameRevisionRef(
       registration.targetRevisionRef,
       released.targetRevisionRef
     ) || !currentPage && released && registration.kind === "route" && (Boolean(registration.releaseRevisionRef) !== Boolean(released.releaseRevisionRef) || registration.releaseRevisionRef && released.releaseRevisionRef && !sameRevisionRef(
@@ -20513,6 +20919,33 @@ var resolveWorkbenchEntry = (input) => {
     };
   return { status: "forbidden", workbenchId: "" };
 };
+var programDependencies = (definition) => [
+  ...[
+    definition.inputSchemaRevisionRef,
+    definition.resultSchemaRevisionRef,
+    ...definition.stateAliases.map((entry) => entry.schemaRevisionRef)
+  ].map((revisionRef) => ({ role: "schema", revisionRef })),
+  ...definition.dependencies.flatMap((dep) => [
+    {
+      role: dep.kind === "query" ? "query-definition" : "action",
+      revisionRef: dep.revisionRef
+    },
+    { role: "schema", revisionRef: dep.inputSchemaRevisionRef },
+    { role: "schema", revisionRef: dep.resultSchemaRevisionRef }
+  ])
+];
+function assertProgramRegistration(registration, scope, surface, path = "program") {
+  const definition = ActionProgramDefinitionSchema.parse(
+    registration.definition
+  );
+  const ref2 = RevisionRefSchema.parse(registration.definitionRevisionRef);
+  if (ref2.kind !== "action-program" || ref2.id !== definition.programId || ref2.ownerRepo !== definition.ownerRepo || ref2.visibility !== "tenant" || canonicalContentHash(ref2.tenantScope) !== canonicalContentHash(scope) || canonicalContentHash(definition.tenantScope) !== canonicalContentHash(scope) || ref2.schemaVersion !== definition.schemaVersion || ref2.contentHash !== canonicalContentHash(definition) || definition.supportedSurface !== surface)
+    throw new DeclarativeControlCompilationError(
+      "CROSS_TENANT_REFERENCE",
+      path,
+      "Program identity, scope, surface or content hash does not match its exact reference."
+    );
+}
 
 // src/runtime/navigation-availability.ts
 var NAVIGATION_UNAVAILABLE_CAPABILITY_HEADER = "x-monkeys-navigation-capabilities";
@@ -24698,6 +25131,19 @@ var assertDeclarativeCapabilityContract = (entry, request) => {
     throw new TypeError("The historical capability snapshot is not supported by the current runtime contract.");
   }
 };
+var schemasCannotOverlap = (left, right) => {
+  if (left === false || right === false) return true;
+  if (!left || !right || typeof left !== "object" || typeof right !== "object" || Array.isArray(left) || Array.isArray(right)) return false;
+  const a = left;
+  const b = right;
+  if (a.$ref || b.$ref) return false;
+  const values = (schema2) => Object.prototype.hasOwnProperty.call(schema2, "const") ? [schema2.const] : Array.isArray(schema2.enum) ? schema2.enum : void 0;
+  const av = values(a), bv = values(b);
+  if (av && bv && av.every((value) => !bv.some((other) => canonicalContentHash(value) === canonicalContentHash(other)))) return true;
+  if (a.type !== "object" || b.type !== "object") return false;
+  const property = (schema2, key) => schema2.properties?.[key] ?? (schema2.patternProperties ? true : schema2.additionalProperties ?? true);
+  return [...a.required ?? [], ...b.required ?? []].some((key) => schemasCannotOverlap(property(a, key), property(b, key)));
+};
 var acceptsPreviousSchema = (previous, next) => {
   if (canonicalContentHash(previous) === canonicalContentHash(next) || next === true) return true;
   if (previous === false) return true;
@@ -24705,11 +25151,17 @@ var acceptsPreviousSchema = (previous, next) => {
   const withoutAnnotations = (schema2) => Object.fromEntries(Object.entries(schema2).filter(([key]) => !["title", "description", "examples", "$comment"].includes(key)));
   const before = withoutAnnotations(previous);
   const after = withoutAnnotations(next);
+  const branches = (schema2) => Object.keys(schema2).length === 1 ? Array.isArray(schema2.anyOf) ? schema2.anyOf : Array.isArray(schema2.oneOf) ? schema2.oneOf : void 0 : void 0;
+  const oldBranches = branches(before);
+  if (oldBranches) return oldBranches.every((branch) => acceptsPreviousSchema(branch, next));
+  const newBranches = branches(after);
+  if (newBranches) return newBranches.some((branch, index) => acceptsPreviousSchema(previous, branch) && (!after.oneOf || newBranches.every((other, otherIndex) => index === otherIndex || schemasCannotOverlap(previous, other))));
   const {
     properties: oldProperties,
     required: oldRequired,
     additionalProperties: oldAdditional,
     enum: oldEnum,
+    items: oldItems,
     ...oldFixed
   } = before;
   const {
@@ -24717,9 +25169,11 @@ var acceptsPreviousSchema = (previous, next) => {
     required: newRequired,
     additionalProperties: newAdditional,
     enum: newEnum,
+    items: newItems,
     ...newFixed
   } = after;
   if (canonicalContentHash(oldFixed) !== canonicalContentHash(newFixed)) return false;
+  if (!acceptsPreviousSchema(oldItems ?? true, newItems ?? true)) return false;
   if (newEnum && (!oldEnum || oldEnum.some((value) => !newEnum.some((candidate) => canonicalContentHash(candidate) === canonicalContentHash(value))))) return false;
   if ((newRequired ?? []).some((key) => !(oldRequired ?? []).includes(key))) return false;
   const oldExtra = oldAdditional ?? true;
@@ -25900,6 +26354,157 @@ function applyPageStreamEvent(state, input) {
     error: frame.type === "error" ? frame.payload : void 0
   };
 }
+
+// src/runtime/action-program-author.ts
+var import__2 = __toESM(require__());
+function programSchemaType(schema2, path = "$", depth = 0) {
+  if (depth > 32 || !schema2 || typeof schema2 !== "object" || Array.isArray(schema2))
+    throw new Error(`Unsupported schema at ${path}`);
+  const value = schema2;
+  const allowed = /* @__PURE__ */ new Set([
+    "$schema",
+    "$id",
+    "title",
+    "description",
+    "type",
+    "properties",
+    "required",
+    "additionalProperties",
+    "items",
+    "enum",
+    "const",
+    "anyOf",
+    "oneOf",
+    "minLength",
+    "maxLength",
+    "pattern",
+    "format",
+    "minimum",
+    "maximum",
+    "exclusiveMinimum",
+    "exclusiveMaximum",
+    "multipleOf",
+    "minItems",
+    "maxItems",
+    "uniqueItems",
+    "minProperties",
+    "maxProperties",
+    "default",
+    "examples",
+    "readOnly",
+    "writeOnly"
+  ]);
+  for (const key of Object.keys(value))
+    if (!allowed.has(key))
+      throw new Error(`Unsupported schema keyword ${path}.${key}`);
+  const child = (schema3, key) => programSchemaType(schema3, `${path}.${key}`, depth + 1);
+  const literal = (input) => {
+    if (input !== null && !["string", "number", "boolean"].includes(typeof input))
+      throw new Error(`Unsupported literal at ${path}`);
+    return JSON.stringify(input);
+  };
+  if ("const" in value) return literal(value.const);
+  if (Array.isArray(value.enum) && value.enum.length)
+    return value.enum.map(literal).join(" | ");
+  if (Array.isArray(value.anyOf) || Array.isArray(value.oneOf))
+    return (value.anyOf ?? value.oneOf).map((schema3, i) => `(${child(schema3, String(i))})`).join(" | ") || "never";
+  if (Array.isArray(value.type))
+    return value.type.map((type) => child({ ...value, type }, String(type))).join(" | ");
+  switch (value.type) {
+    case "null":
+      return "null";
+    case "boolean":
+      return "boolean";
+    case "string":
+      return "string";
+    case "number":
+    case "integer":
+      return "number";
+    case "array":
+      return `Array<${child(value.items, "items")}>`;
+    case "object": {
+      const properties = value.properties ?? {};
+      if (typeof properties !== "object" || !properties || Array.isArray(properties))
+        throw new Error(`Invalid properties at ${path}`);
+      const required = value.required ?? [];
+      if (!Array.isArray(required) || required.some(
+        (key) => typeof key !== "string" || !Object.prototype.hasOwnProperty.call(properties, key)
+      ))
+        throw new Error(`Unsupported required keys at ${path}`);
+      const fields = Object.entries(properties).map(
+        ([key, schema3]) => `${JSON.stringify(key)}${required.includes(key) ? "" : "?"}: ${child(schema3, key)};`
+      );
+      if (value.additionalProperties !== false) {
+        if (value.additionalProperties !== void 0 && value.additionalProperties !== true)
+          throw new Error(`Unsupported additionalProperties at ${path}`);
+        fields.push("[key: string]: unknown;");
+      }
+      return `{ ${fields.join(" ")} }`;
+    }
+    default:
+      throw new Error(`Schema needs a supported explicit type at ${path}`);
+  }
+}
+function generateActionProgramTypes(definition, schemas) {
+  const resolve = (ref2) => {
+    const matches = schemas.filter(
+      (entry) => sameRevisionRef(entry.definitionRevisionRef, ref2)
+    );
+    if (matches.length !== 1 || canonicalContentHash(matches[0].definition) !== ref2.contentHash)
+      throw new Error(`Missing exact Schema ${ref2.id}`);
+    return programSchemaType(matches[0].definition.document);
+  };
+  const formRefs = new Map(
+    [
+      definition.inputSchemaRevisionRef,
+      definition.resultSchemaRevisionRef,
+      ...definition.dependencies.flatMap((dep) => [
+        dep.inputSchemaRevisionRef,
+        dep.resultSchemaRevisionRef
+      ])
+    ].map((ref2) => [ref2.id, ref2])
+  );
+  for (const ref2 of [
+    definition.inputSchemaRevisionRef,
+    definition.resultSchemaRevisionRef,
+    ...definition.dependencies.flatMap((dep) => [
+      dep.inputSchemaRevisionRef,
+      dep.resultSchemaRevisionRef
+    ])
+  ]) {
+    if (!sameRevisionRef(formRefs.get(ref2.id), ref2))
+      throw new Error("Ambiguous form Schema revision " + ref2.id);
+  }
+  const forms = "{" + [...formRefs].map(([id, ref2]) => JSON.stringify(id) + ": " + resolve(ref2) + ";").join(" ") + "}";
+  const states = "{" + definition.stateAliases.map(
+    (entry) => JSON.stringify(entry.alias) + ": " + resolve(entry.schemaRevisionRef) + ";"
+  ).join(" ") + "}";
+  const refresh = definition.refreshAliases.map((alias) => JSON.stringify(alias)).join(" | ") || "never";
+  const capabilityMap = (kind) => `{
+${definition.dependencies.filter((dep) => dep.kind === kind).map(
+    (dep) => `${JSON.stringify(dep.revisionRef.id)}: {input: ${"Pick<" + resolve(dep.inputSchemaRevisionRef) + ", " + (dep.dynamicInputKeys.map((key) => JSON.stringify(key)).join(" | ") || "never") + ">"}; result: ${resolve(dep.resultSchemaRevisionRef)}};`
+  ).join("\n")}
+}`;
+  return `// Generated from exact program/schema revisions. Do not edit.
+import type { ActionProgramContext } from "@inf-monkeys-tech/monkeys";
+export type Input = ${resolve(definition.inputSchemaRevisionRef)};
+export type Result = ${resolve(definition.resultSchemaRevisionRef)};
+export type Queries = ${capabilityMap("query")};
+export type Commands = ${capabilityMap("command")};
+export type BaseContext = ActionProgramContext<Queries, Commands, ${forms}, ${states}, ${refresh}>;
+export type Context = Omit<BaseContext, "ui" | "state"> & {ui: Pick<BaseContext["ui"], ${definition.effects.filter((effect) => !effect.startsWith("state.")).map((effect) => JSON.stringify(effect)).join(" | ") || "never"}>; state: Pick<BaseContext["state"], ${definition.effects.filter((effect) => effect.startsWith("state.")).map((effect) => JSON.stringify(effect.slice(6))).join(" | ") || "never"}>};
+export type Program = (context: Context, input: Input) => Promise<Result>;
+`;
+}
+function compileProgramValueValidator(schema2, documents = []) {
+  const ajv2 = new import__2.default({ strict: false, allErrors: false, coerceTypes: false, removeAdditional: false, useDefaults: false });
+  const ids = /* @__PURE__ */ new Set();
+  for (const document of documents) if (typeof document.$id === "string" && document.$id !== schema2.$id && !ids.has(document.$id)) {
+    ajv2.addSchema(document);
+    ids.add(document.$id);
+  }
+  return ajv2.compile(schema2);
+}
 export {
   APPLICATION_HANDOFF_QUERY_PARAMETER,
   DEFAULT_CONDUCTOR_OWNER_EMAIL,
@@ -25918,6 +26523,7 @@ export {
   assertCompatibleCapabilityUpgrade,
   assertDeclarativeCapabilityContract,
   assertMonkeysThemeTokensComplete,
+  assertProgramRegistration,
   assertThemeTokensDocumentStructure,
   assertViewProviderContract,
   buildApplicationHandoffUrl,
@@ -25940,6 +26546,7 @@ export {
   compileProductAccessDeclaration,
   compileProductDeclaration,
   compileProductRuntimeCatalog,
+  compileProgramValueValidator,
   compileRenderTree,
   compileRouteClaims,
   compileTargetRenderModelValidator,
@@ -25971,6 +26578,7 @@ export {
   designCapabilityCatalogArtifactHash,
   evaluatePageExpression,
   extractOpenApiCapabilityManifests,
+  generateActionProgramTypes,
   isCompiledMenuItemSelected,
   isDeclarativeRuntimeEnabled,
   legacyRouteTakeoverAuthorizationHash,
@@ -25983,6 +26591,8 @@ export {
   parseExactProductDeclarativeCapabilityRegistration,
   parseWorkflowColumnBinding,
   permissionAlternativePolicyAllows,
+  programDependencies,
+  programSchemaType,
   projectAgentSessionEvents,
   projectCurrentNavigationPages,
   projectNavigationCompatibility,