@inf-monkeys-tech/monkeys 1.1.17 → 1.1.18

package/lib/esm/index.mjs

@@ -7321,7 +7321,7 @@ var require__ = __commonJS({
     var discriminator_1 = require_discriminator();
     var json_schema_2020_12_1 = require_json_schema_2020_12();
     var META_SCHEMA_ID = "https://json-schema.org/draft/2020-12/schema";
-    var Ajv20202 = class extends core_1.default {
+    var Ajv20203 = class extends core_1.default {
       constructor(opts = {}) {
         super({
           ...opts,
@@ -7348,11 +7348,11 @@ var require__ = __commonJS({
         return this.opts.defaultMeta = super.defaultMeta() || (this.getSchema(META_SCHEMA_ID) ? META_SCHEMA_ID : void 0);
       }
     };
-    exports.Ajv2020 = Ajv20202;
-    module.exports = exports = Ajv20202;
-    module.exports.Ajv2020 = Ajv20202;
+    exports.Ajv2020 = Ajv20203;
+    module.exports = exports = Ajv20203;
+    module.exports.Ajv2020 = Ajv20203;
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.default = Ajv20202;
+    exports.default = Ajv20203;
     var validate_1 = require_validate();
     Object.defineProperty(exports, "KeywordCxt", { enumerable: true, get: function() {
       return validate_1.KeywordCxt;
@@ -10437,6 +10437,7 @@ var ReleaseDependencyRoleSchema = z15.enum([
   "view",
   "projection",
   "action",
+  "action-program",
   "token",
   "schema",
   "compiler",
@@ -10467,6 +10468,7 @@ var DependencyKindByRole = {
   view: "view",
   projection: "projection",
   action: "domain-command",
+  "action-program": "action-program",
   token: "design-token",
   schema: "schema",
   compiler: "compiler",
@@ -11419,8 +11421,14 @@ var QueryBindingSchema = z15.object({
 }).strict().superRefine((value, context) => {
   if (value.draftRetention) {
     const names = value.draftRetention.identityParameters;
-    if (value.execution !== "server" || new Set(names).size !== names.length || names.some((name) => !Object.prototype.hasOwnProperty.call(value.parameters, name))) {
-      context.addIssue({ code: "custom", path: ["draftRetention"], message: "Draft retention requires distinct declared Server query identity parameters." });
+    if (value.execution !== "server" || new Set(names).size !== names.length || names.some(
+      (name) => !Object.prototype.hasOwnProperty.call(value.parameters, name)
+    )) {
+      context.addIssue({
+        code: "custom",
+        path: ["draftRetention"],
+        message: "Draft retention requires distinct declared Server query identity parameters."
+      });
     }
   }
   if (value.targetProjection) {
@@ -12114,6 +12122,237 @@ var PageDataSchema = QueryBindingSchema.omit({
   cursorWindow: PageCursorWindowSchema.optional(),
   resultStateBindings: z15.array(PageResultStateBindingSchema).max(32).optional()
 }).strict();
+var ACTION_PROGRAM_ABI = "monkeys.action-program/2";
+var ActionProgramBudgetsSchema = z15.object({
+  rpcMs: z15.number().int().positive().max(3e4),
+  concurrentCalls: z15.number().int().positive().max(4),
+  calls: z15.number().int().positive().max(128),
+  messageBytes: z15.number().int().positive().max(1048576),
+  activeMs: z15.number().int().positive().max(12e4),
+  formMs: z15.number().int().positive().max(3e5),
+  wallMs: z15.number().int().positive().max(6e5)
+}).strict();
+var DEFAULT_ACTION_PROGRAM_BUDGETS = Object.freeze({
+  rpcMs: 3e4,
+  concurrentCalls: 4,
+  calls: 128,
+  messageBytes: 1048576,
+  activeMs: 12e4,
+  formMs: 3e5,
+  wallMs: 6e5
+});
+var ProgramSchemaRefSchema = RevisionRefSchema.refine(
+  (ref2) => ref2.kind === "schema",
+  "Expected an exact Schema reference."
+);
+var ActionProgramDependencySchema = z15.object({
+  kind: z15.enum(["query", "command"]),
+  revisionRef: RevisionRefSchema,
+  inputSchemaRevisionRef: ProgramSchemaRefSchema,
+  resultSchemaRevisionRef: ProgramSchemaRefSchema,
+  download: ActionBindingSchema.shape.success.shape.download,
+  // Fixed/identity arguments are injected by the trusted caller, never by guest code.
+  dynamicInputKeys: z15.array(ContractIdentifierSchema).max(128)
+}).strict().superRefine((value, context) => {
+  const expected = value.kind === "query" ? "domain-query-definition" : "domain-command";
+  if (value.revisionRef.kind !== expected)
+    context.addIssue({
+      code: "custom",
+      path: ["revisionRef", "kind"],
+      message: `Expected ${expected}.`
+    });
+  if (new Set(value.dynamicInputKeys).size !== value.dynamicInputKeys.length)
+    context.addIssue({
+      code: "custom",
+      path: ["dynamicInputKeys"],
+      message: "Dynamic input keys must be unique."
+    });
+});
+var ActionProgramDefinitionSchema = z15.object({
+  contract: z15.literal("ActionProgramDefinition"),
+  schemaVersion: z15.literal(1),
+  programId: ContractIdentifierSchema,
+  ownerRepo: ContractIdentifierSchema,
+  tenantScope: TenantScopeSchema,
+  supportedSurface: z15.literal("studio"),
+  inputSchemaRevisionRef: ProgramSchemaRefSchema,
+  resultSchemaRevisionRef: ProgramSchemaRefSchema,
+  entry: z15.literal("main"),
+  abi: z15.literal(ACTION_PROGRAM_ABI),
+  compiler: z15.string().trim().min(1).max(128),
+  target: z15.literal("browser-worker-es2020"),
+  sourceHash: Sha256Schema,
+  compiledHash: Sha256Schema,
+  sourceMapHash: Sha256Schema,
+  dependencies: z15.array(ActionProgramDependencySchema).max(128),
+  effects: z15.array(
+    z15.enum([
+      "form",
+      "toast",
+      "refresh",
+      "download",
+      "state.get",
+      "state.set"
+    ])
+  ).max(6),
+  refreshAliases: z15.array(ContractIdentifierSchema).max(128),
+  stateAliases: z15.array(
+    z15.object({
+      alias: ContractIdentifierSchema,
+      schemaRevisionRef: ProgramSchemaRefSchema
+    }).strict()
+  ).max(128),
+  budgets: ActionProgramBudgetsSchema
+}).strict().superRefine((value, context) => {
+  for (const [name, keys] of [
+    [
+      "dependencies",
+      value.dependencies.map((dep) => `${dep.kind}:${dep.revisionRef.id}`)
+    ],
+    ["effects", value.effects],
+    ["refreshAliases", value.refreshAliases],
+    ["stateAliases", value.stateAliases.map((entry) => entry.alias)]
+  ])
+    if (new Set(keys).size !== keys.length)
+      context.addIssue({
+        code: "custom",
+        path: [name],
+        message: "Program declarations must be unique."
+      });
+  const refs = [
+    value.inputSchemaRevisionRef,
+    value.resultSchemaRevisionRef,
+    ...value.dependencies.flatMap((dep) => [
+      dep.revisionRef,
+      dep.inputSchemaRevisionRef,
+      dep.resultSchemaRevisionRef
+    ]),
+    ...value.stateAliases.map((entry) => entry.schemaRevisionRef)
+  ];
+  refs.forEach((ref2, index) => {
+    if (ref2.visibility === "tenant" && ref2.tenantScope && tenantScopeKey(ref2.tenantScope) !== tenantScopeKey(value.tenantScope))
+      context.addIssue({
+        code: "custom",
+        path: ["dependencies"],
+        message: `Cross-tenant program reference ${index}.`
+      });
+  });
+});
+var ActionProgramArtifactSchema = z15.object({
+  definition: ActionProgramDefinitionSchema,
+  // Hashes use canonicalContentHash of the exact UTF-8 string, not engine bytecode.
+  javascript: z15.string().min(1).max(262144).refine(
+    (value) => new TextEncoder().encode(value).length <= 262144,
+    "Program exceeds 256 KiB."
+  ),
+  sourceMap: z15.string().min(1).max(524288).refine(
+    (value) => new TextEncoder().encode(value).length <= 524288,
+    "Source map exceeds 512 KiB."
+  )
+}).strict();
+var ProgramInputSourceSchema = z15.discriminatedUnion("kind", [
+  ...BindingSourceSchema.options,
+  ExpressionBindingSourceSchema
+]);
+var ProgramBindingShape = {
+  bindingId: ContractIdentifierSchema,
+  inputMapping: z15.record(ContractIdentifierSchema, ProgramInputSourceSchema),
+  dependencyInputs: z15.record(
+    ContractIdentifierSchema,
+    z15.record(ContractIdentifierSchema, ProgramInputSourceSchema)
+  ),
+  accessPolicy: AccessPolicySchema,
+  confirmation: I18nTextSchema.optional(),
+  when: PageExpressionSchema.optional(),
+  concurrencyKeyPath: PageValuePathSchema.min(1),
+  refreshAliases: z15.record(
+    ContractIdentifierSchema,
+    z15.array(ContractIdentifierSchema).min(1).max(128)
+  ),
+  stateAliases: z15.record(ContractIdentifierSchema, ContractIdentifierSchema)
+};
+var PageProgramActionSchema = z15.object({
+  ...ProgramBindingShape,
+  program: ContractIdentifierSchema,
+  port: ContractIdentifierSchema
+}).strict();
+var ProgramBindingSchema = z15.object({
+  ...ProgramBindingShape,
+  source: z15.object({
+    capabilityInstanceId: ContractIdentifierSchema,
+    port: ContractIdentifierSchema
+  }).strict(),
+  sourceIntentSchemaRevisionRef: ProgramSchemaRefSchema,
+  programRevisionRef: RevisionRefSchema.refine(
+    (ref2) => ref2.kind === "action-program",
+    "Expected action-program reference."
+  ),
+  definition: ActionProgramDefinitionSchema
+}).strict();
+function validateProgramBindingTargets(page, context) {
+  const ids = new Set(page.actionBindings.map((binding) => binding.bindingId));
+  const ports = new Set(
+    page.actionBindings.map(
+      (binding) => `${binding.source.capabilityInstanceId}:${binding.source.port}`
+    )
+  );
+  const dataIds = new Set(
+    [...page.ontologyBindings, ...page.queryBindings ?? []].map(
+      (binding) => binding.bindingId
+    )
+  );
+  for (const [index, binding] of (page.programBindings ?? []).entries()) {
+    const issue = (message) => context.addIssue({
+      code: "custom",
+      path: ["programBindings", index],
+      message
+    });
+    const port = `${binding.source.capabilityInstanceId}:${binding.source.port}`;
+    if (ids.has(binding.bindingId) || ports.has(port))
+      issue("Program binding id and event must be exclusive.");
+    ids.add(binding.bindingId);
+    ports.add(port);
+    if (!page.capabilityInstances.some(
+      (instance) => instance.instanceId === binding.source.capabilityInstanceId
+    ))
+      issue("Program source instance is missing.");
+    const exactKeys = (keys, expected) => keys.length === expected.length && keys.every((key) => expected.includes(key));
+    if (!exactKeys(
+      Object.keys(binding.refreshAliases),
+      binding.definition.refreshAliases
+    ) || Object.values(binding.refreshAliases).some(
+      (targets) => targets.some((target) => !dataIds.has(target))
+    ))
+      issue(
+        "Program refresh aliases must resolve exactly to declared data bindings."
+      );
+    if (!exactKeys(
+      Object.keys(binding.stateAliases),
+      binding.definition.stateAliases.map((entry) => entry.alias)
+    ))
+      issue("Program state aliases must match its manifest.");
+    for (const entry of binding.definition.stateAliases) {
+      const state = page.stateDefinitions?.find(
+        (state2) => state2.stateId === binding.stateAliases[entry.alias]
+      );
+      if (!state || !exactRevisionRef(state.schemaRevisionRef, entry.schemaRevisionRef))
+        issue("Program state alias has an incompatible Schema.");
+    }
+    const dependencyIds = binding.definition.dependencies.map(
+      (dep) => dep.revisionRef.id
+    );
+    if (!Object.keys(binding.dependencyInputs).every(
+      (key) => dependencyIds.includes(key)
+    ))
+      issue("Unknown program dependency input mapping.");
+    for (const dep of binding.definition.dependencies) {
+      if (Object.keys(binding.dependencyInputs[dep.revisionRef.id] ?? {}).some(
+        (key) => dep.dynamicInputKeys.includes(key)
+      ))
+        issue("Fixed dependency arguments cannot also be guest-writable.");
+    }
+  }
+}
 var PageActionSchema = ActionBindingSchema.omit({
   commandRevisionRef: true,
   source: true,
@@ -12156,6 +12395,7 @@ var PageNodeSchema = z15.lazy(
     }).strict().optional(),
     data: z15.array(PageDataSchema).optional(),
     actions: z15.array(PageActionSchema).optional(),
+    programActions: z15.array(PageProgramActionSchema).max(128).optional(),
     on: z15.array(PageInteractionSchema).optional(),
     effects: z15.array(PageEventEffectSchema).optional(),
     eventPayloads: z15.array(
@@ -12234,6 +12474,7 @@ var PageSchema = z15.object({
     for (const [field, values, target] of [
       ["data", node.data ?? [], dataIds],
       ["actions", node.actions ?? [], actionIds],
+      ["programActions", node.programActions ?? [], actionIds],
       ["on", node.on ?? [], interactionIds]
     ])
       for (const [index, value] of values.entries()) {
@@ -12287,6 +12528,7 @@ var ResolvedPageSchema = z15.object({
   ontologyBindings: z15.array(PersistedOntologyBindingSchema),
   queryBindings: z15.array(QueryBindingSchema).optional(),
   actionBindings: z15.array(ActionBindingSchema),
+  programBindings: z15.array(ProgramBindingSchema).max(128).optional(),
   pageAccessPolicy: AccessPolicySchema,
   managementAccess: ManagementAccessSchema,
   tokenRevisionRefs: z15.array(RevisionRefSchema).min(1),
@@ -12299,6 +12541,7 @@ var ResolvedPageSchema = z15.object({
     "restricted"
   ])
 }).strict().superRefine((value, context) => {
+  validateProgramBindingTargets(value, context);
   validateDeclaredRouteSurfaces(
     value.supportedSurfaces,
     value.routeClaims,
@@ -12656,6 +12899,35 @@ var ResolvedPageSchema = z15.object({
       )
     );
   }
+  (value.programBindings ?? []).forEach((binding, index) => {
+    const scopes = scopesForNode(
+      instanceNodes.get(binding.source.capabilityInstanceId)
+    );
+    checkScopedSources(binding.inputMapping, scopes, [
+      "programBindings",
+      index,
+      "inputMapping"
+    ]);
+    for (const [id, mapping] of Object.entries(binding.dependencyInputs))
+      checkScopedSources(mapping, scopes, [
+        "programBindings",
+        index,
+        "dependencyInputs",
+        id
+      ]);
+    if (binding.when) {
+      const reads = collectPageExpressionReads(binding.when);
+      checkScopedReads(reads, scopes, ["programBindings", index, "when"]);
+      if (reads.some(
+        (read) => read.root === "state" && !stateIds.has(read.path[0])
+      ))
+        context.addIssue({
+          code: "custom",
+          path: ["programBindings", index, "when"],
+          message: "Program condition references an unknown Page state."
+        });
+    }
+  });
   value.actionBindings.forEach((binding, index) => {
     const scopes = scopesForNode(
       instanceNodes.get(binding.source.capabilityInstanceId)
@@ -13236,7 +13508,10 @@ var ResolvedPageSchema = z15.object({
     const conflictingInteraction = interactionBindings.some(
       (candidate) => candidate.source.capabilityInstanceId === sourceId && candidate.source.port === binding.cursorWindow.pageChangePort
     );
-    const conflictingAction = value.actionBindings.some(
+    const conflictingAction = [
+      ...value.actionBindings,
+      ...value.programBindings ?? []
+    ].some(
       (candidate) => candidate.source.capabilityInstanceId === sourceId && candidate.source.port === binding.cursorWindow.pageChangePort
     );
     if (conflictingInteraction || conflictingAction) {
@@ -13247,6 +13522,20 @@ var ResolvedPageSchema = z15.object({
       });
     }
   });
+  (value.programBindings ?? []).forEach((binding, index) => {
+    validatePageStateSources(binding.inputMapping, [
+      "programBindings",
+      index,
+      "inputMapping"
+    ]);
+    for (const [id, mapping] of Object.entries(binding.dependencyInputs))
+      validatePageStateSources(mapping, [
+        "programBindings",
+        index,
+        "dependencyInputs",
+        id
+      ]);
+  });
   value.actionBindings.forEach((binding, index) => {
     if (!instanceIds.has(binding.source.capabilityInstanceId)) {
       context.addIssue({
@@ -14087,6 +14376,7 @@ var CompatiblePageRuntimeBundleSchema = z15.object({
   ontologyBindings: z15.array(PersistedOntologyBindingSchema),
   queryBindings: z15.array(QueryBindingSchema).default([]),
   actionBindings: z15.array(ActionBindingSchema),
+  programBindings: z15.array(ProgramBindingSchema).max(128).optional(),
   pageAccessPolicy: AccessPolicySchema,
   tokenRevisionRefs: z15.array(RevisionRefSchema),
   performanceBudgetRef: RevisionRefSchema,
@@ -14109,6 +14399,7 @@ var CompatiblePageRuntimeBundleSchema = z15.object({
       message: "Denied capability identities must be unique declared instances."
     });
   }
+  validateProgramBindingTargets(value, context);
   validateRuntimeBundleBase(value, "page-release", context);
   value.routeClaims.forEach((claim, index) => {
     if (claim.surface !== value.surface) {
@@ -21390,6 +21681,38 @@ var pageStreamRoutes = {
 };
 var PageStreamControlResultSchema = z30.object({ requestId: z30.string().uuid(), accepted: z30.literal(true) }).strict();
 
+// src/contracts/action-program-http.ts
+import { z as z31 } from "zod";
+var PrepareActionProgramRequestSchema = z31.object({
+  artifact: ActionProgramArtifactSchema,
+  expectedVersion: z31.number().int().min(0)
+}).strict();
+var RegisterActionProgramRequestSchema = PrepareActionProgramRequestSchema.extend({
+  planHash: Sha256Schema,
+  idempotencyKey: ContractIdentifierSchema
+}).strict();
+var ReadActionProgramRequestSchema = z31.object({ revisionRef: RevisionRefSchema }).strict();
+var RuntimeProgramLoadRequestSchema = z31.object({
+  context: DeclarativeRuntimeActionExecuteIntentSchema
+}).strict();
+var RuntimeProgramCallRequestSchema = RuntimeProgramLoadRequestSchema.extend({
+  kind: z31.enum(["query", "command"]),
+  dependencyId: ContractIdentifierSchema,
+  args: JsonObjectSchema,
+  stepKey: z31.string().min(1).max(128),
+  recoveryOnly: z31.literal(true).optional()
+}).strict();
+var RuntimeProgramLoadResultSchema = z31.object({
+  artifact: ActionProgramArtifactSchema,
+  input: JsonObjectSchema,
+  schemas: z31.array(z31.object({ revisionRef: RevisionRefSchema, document: JsonObjectSchema }).strict()).max(512)
+}).strict();
+var RuntimeProgramCallResultSchema = z31.object({ value: JsonObjectSchema }).strict();
+var RuntimeProgramDownloadResultSchema = z31.discriminatedUnion("kind", [
+  z31.object({ kind: z31.literal("native"), download: DeclarativeNativeDownloadSchema }).strict(),
+  z31.object({ kind: z31.literal("text-artifact"), fileName: z31.string().min(1).max(255), mimeType: z31.enum(["application/json", "text/plain", "text/csv"]), content: z31.string().max(1048576) }).strict()
+]);
+
 // src/schemas/index.ts
 var canonicalContractSchemas = {
   "aggregate-commit-request": AggregateCommitRequestSchema,
@@ -21423,6 +21746,8 @@ var canonicalContractSchemas = {
   "domain-event": DomainEventSchema,
   "domain-command": DomainCommandSchema,
   "domain-command-definition": DomainCommandDefinitionSchema,
+  "action-program-definition": ActionProgramDefinitionSchema,
+  "action-program-artifact": ActionProgramArtifactSchema,
   "data-continuity-envelope": DataContinuityEnvelopeSchema,
   "domain-query-definition": DomainQueryDefinitionSchema,
   "declarative-control-ontology-definition": DeclarativeControlOntologyDefinitionSchema,
@@ -23024,6 +23349,17 @@ var pageDependencies = (page, compilerRevisionRef) => [
       }
     ] : []
   ]),
+  ...(page.programBindings ?? []).flatMap((binding) => [
+    {
+      role: "action-program",
+      revisionRef: binding.programRevisionRef
+    },
+    {
+      role: "schema",
+      revisionRef: binding.sourceIntentSchemaRevisionRef
+    },
+    ...programDependencies(binding.definition)
+  ]),
   ...page.actionBindings.flatMap((binding) => [
     { role: "action", revisionRef: binding.commandRevisionRef },
     {
@@ -23255,6 +23591,7 @@ var resolvePage = (input) => {
   const capabilityInstances = [];
   const queryBindings = [];
   const actionBindings = [];
+  const programBindings = [];
   const interactionBindings = [];
   const nodesById = /* @__PURE__ */ new Map();
   const indexNode = (node) => {
@@ -23467,6 +23804,76 @@ var resolvePage = (input) => {
         resultSchemaRevisionRef
       });
     }
+    for (const [index, binding] of (node.programActions ?? []).entries()) {
+      const path = `page.body.${node.id}.programActions[${index}]`;
+      const matches = (input.programRegistry ?? []).filter(
+        (entry) => entry.definition.programId === binding.program
+      );
+      if (matches.length !== 1)
+        throw new DeclarativeControlCompilationError(
+          "DEPENDENCY_MISSING",
+          path,
+          "Expected one exact program registration."
+        );
+      const program = matches[0];
+      const definition = ActionProgramDefinitionSchema.parse(
+        program.definition
+      );
+      assertProgramRegistration(program, page.tenantScope, page.surface, path);
+      const port = registration.outputPorts.find(
+        (candidate) => candidate.name === binding.port
+      );
+      if (!port)
+        throw new DeclarativeControlCompilationError(
+          "PORT_TYPE_MISMATCH",
+          path,
+          "Program source port is not registered."
+        );
+      if ((node.actions ?? []).some((action) => action.port === binding.port) || programBindings.some(
+        (action) => action.source.capabilityInstanceId === node.id && action.source.port === binding.port
+      ))
+        throw new DeclarativeControlCompilationError(
+          "CAPABILITY_BINDING_MISMATCH",
+          path,
+          "A program output port must have one exclusive action binding."
+        );
+      for (const dep of definition.dependencies) {
+        const registrations = dep.kind === "query" ? queryRegistrations : commandRegistrations;
+        const actual = registrations.find(
+          (entry) => sameRevisionRef(entry.revisionRef, dep.revisionRef)
+        );
+        if (!actual || canonicalContentHash(actual.definition) !== dep.revisionRef.contentHash || "sensitiveInputPaths" in actual.definition && !!actual.definition.sensitiveInputPaths?.length || "sensitiveResultPaths" in actual.definition && !!actual.definition.sensitiveResultPaths?.length || ("queryId" in actual.definition ? !sameRevisionRef(
+          actual.definition.inputSchemaRevisionRef,
+          dep.inputSchemaRevisionRef
+        ) || !sameRevisionRef(
+          actual.definition.resultSchemaRevisionRef,
+          dep.resultSchemaRevisionRef
+        ) : actual.definition.inputSchemaRef !== dep.inputSchemaRevisionRef.id || actual.definition.outputSchemaRef !== dep.resultSchemaRevisionRef.id))
+          throw new DeclarativeControlCompilationError(
+            "DEPENDENCY_MISSING",
+            path,
+            "Program capability/schema revision is not registered."
+          );
+      }
+      for (const ref2 of programDependencies(definition).filter((dep) => dep.role === "schema").map((dep) => dep.revisionRef)) {
+        if (!schemaRegistrations.some(
+          (entry) => sameRevisionRef(entry.revisionRef, ref2)
+        ))
+          throw new DeclarativeControlCompilationError(
+            "SCHEMA_DEFINITION_MISMATCH",
+            path,
+            "Program requires an exact registered Schema."
+          );
+      }
+      const { program: _program, port: _port, ...rest } = binding;
+      programBindings.push({
+        ...rest,
+        source: { capabilityInstanceId: node.id, port: binding.port },
+        sourceIntentSchemaRevisionRef: port.schemaRevisionRef,
+        programRevisionRef: program.definitionRevisionRef,
+        definition
+      });
+    }
     for (const [index, binding] of (node.on ?? []).entries()) {
       const port = registration.outputPorts.find(
         (candidate) => candidate.name === binding.port
@@ -23552,6 +23959,7 @@ var resolvePage = (input) => {
     ontologyBindings: [],
     ...queryBindings.length ? { queryBindings } : {},
     actionBindings,
+    ...programBindings.length ? { programBindings } : {},
     pageAccessPolicy: page.access,
     managementAccess: page.managementAccess,
     tokenRevisionRefs,
@@ -24050,27 +24458,47 @@ var compilePageRuntimeBundleInternal = (input, legacy) => {
       );
     }
   });
-  page.actionBindings.forEach((binding, index) => {
-    const instance = page.capabilityInstances.find(
-      (candidate) => candidate.instanceId === binding.source.capabilityInstanceId
+  (page.programBindings ?? []).forEach((binding, index) => {
+    const path = `programBindings[${index}]`;
+    const registration = (input.programRegistry ?? []).find(
+      (entry) => sameRevisionRef(entry.definitionRevisionRef, binding.programRevisionRef)
     );
-    const registration = instance && registrationsByPair.get(
-      `${revisionRefKey(instance.capabilityRevisionRef)}:${revisionRefKey(instance.providerRevisionRef)}`
-    );
-    const port = registration?.outputPorts.find(
-      (candidate) => candidate.name === binding.source.port
-    );
-    if (!port || !sameSchemaContract(
-      port.schemaRevisionRef,
-      binding.sourceIntentSchemaRevisionRef
-    )) {
+    if (!registration || canonicalContentHash(registration.definition) !== canonicalContentHash(binding.definition))
       throw new DeclarativeControlCompilationError(
-        "PORT_TYPE_MISMATCH",
-        `actionBindings[${index}].sourceIntentSchemaRevisionRef`,
-        "Action source intent does not match the registered capability output port."
+        "DEPENDENCY_MISSING",
+        path,
+        "Exact program registration does not match binding."
       );
-    }
+    assertProgramRegistration(
+      registration,
+      page.tenantScope,
+      release.target.surface,
+      path
+    );
   });
+  [...page.actionBindings, ...page.programBindings ?? []].forEach(
+    (binding, index) => {
+      const instance = page.capabilityInstances.find(
+        (candidate) => candidate.instanceId === binding.source.capabilityInstanceId
+      );
+      const registration = instance && registrationsByPair.get(
+        `${revisionRefKey(instance.capabilityRevisionRef)}:${revisionRefKey(instance.providerRevisionRef)}`
+      );
+      const port = registration?.outputPorts.find(
+        (candidate) => candidate.name === binding.source.port
+      );
+      if (!port || !sameSchemaContract(
+        port.schemaRevisionRef,
+        binding.sourceIntentSchemaRevisionRef
+      )) {
+        throw new DeclarativeControlCompilationError(
+          "PORT_TYPE_MISMATCH",
+          `actionBindings[${index}].sourceIntentSchemaRevisionRef`,
+          "Action source intent does not match the registered capability output port."
+        );
+      }
+    }
+  );
   const routeClaims = compileRouteClaims({
     claims: page.routeClaims,
     routeSpaces: input.routeSpaces,
@@ -24224,6 +24652,7 @@ var compilePageRuntimeBundleInternal = (input, legacy) => {
     ontologyBindings: page.ontologyBindings,
     queryBindings: page.queryBindings,
     actionBindings: page.actionBindings,
+    ...page.programBindings?.length ? { programBindings: page.programBindings } : {},
     pageAccessPolicy: page.pageAccessPolicy,
     tokenRevisionRefs: page.tokenRevisionRefs,
     performanceBudgetRef: page.performanceBudgetRef,
@@ -24538,7 +24967,9 @@ var compileNavigationRuntimeBundle = (input) => {
     input.compilerRevisionRef
   );
   const scope = TenantScopeSchema.parse(navigation.tenantScope);
-  const verifiedKernelPageReferences = [...input.verifiedKernelPageReferences ?? []].map((reference, index) => {
+  const verifiedKernelPageReferences = [
+    ...input.verifiedKernelPageReferences ?? []
+  ].map((reference, index) => {
     const parsed = RevisionRefSchema.parse(reference);
     if (release.target.surface !== "kernel" || parsed.visibility !== "tenant" || !parsed.tenantScope?.teamRef?.id.startsWith("kernel-page.") || parsed.ownerRepo !== "monkeys-server" || !["page", "page-release"].includes(parsed.kind)) {
       throw new DeclarativeControlCompilationError(
@@ -24752,8 +25183,14 @@ var compileNavigationRuntimeBundle = (input) => {
     const released = releasedByNodeId.get(node.nodeId);
     const unavailable = unavailableByNodeId.get(node.nodeId);
     if (!registration && node.targetRef.kind === "page" && (unavailable && sameStableRef(unavailable.stableTargetRef, node.targetRef) || released && sameStableRef(released.stableTargetRef, node.targetRef))) {
-      if (!released || !verifiedKernelPageReferenceKeys.has(revisionRefKey(released.targetRevisionRef))) {
-        assertTenantCompatible(node.targetRef, scope, `nodes[${index}].targetRef`);
+      if (!released || !verifiedKernelPageReferenceKeys.has(
+        revisionRefKey(released.targetRevisionRef)
+      )) {
+        assertTenantCompatible(
+          node.targetRef,
+          scope,
+          `nodes[${index}].targetRef`
+        );
       }
       if (unavailable?.accessPolicy && !accessPolicyChainImplies(
         [...ancestors, node.audience],
@@ -24782,7 +25219,10 @@ var compileNavigationRuntimeBundle = (input) => {
     if (!registration || !released && !(currentPage && unavailable && sameStableRef(unavailable.stableTargetRef, node.targetRef)) || !sameStableRef(
       registration.stableTargetRef,
       stableFromRevision(registration.targetRevisionRef)
-    ) || released && !sameStableRef(registration.stableTargetRef, released.stableTargetRef) || !currentPage && released && !sameRevisionRef(
+    ) || released && !sameStableRef(
+      registration.stableTargetRef,
+      released.stableTargetRef
+    ) || !currentPage && released && !sameRevisionRef(
       registration.targetRevisionRef,
       released.targetRevisionRef
     ) || !currentPage && released && registration.kind === "route" && (Boolean(registration.releaseRevisionRef) !== Boolean(released.releaseRevisionRef) || registration.releaseRevisionRef && released.releaseRevisionRef && !sameRevisionRef(
@@ -25044,6 +25484,33 @@ var resolveWorkbenchEntry = (input) => {
     };
   return { status: "forbidden", workbenchId: "" };
 };
+var programDependencies = (definition) => [
+  ...[
+    definition.inputSchemaRevisionRef,
+    definition.resultSchemaRevisionRef,
+    ...definition.stateAliases.map((entry) => entry.schemaRevisionRef)
+  ].map((revisionRef) => ({ role: "schema", revisionRef })),
+  ...definition.dependencies.flatMap((dep) => [
+    {
+      role: dep.kind === "query" ? "query-definition" : "action",
+      revisionRef: dep.revisionRef
+    },
+    { role: "schema", revisionRef: dep.inputSchemaRevisionRef },
+    { role: "schema", revisionRef: dep.resultSchemaRevisionRef }
+  ])
+];
+function assertProgramRegistration(registration, scope, surface, path = "program") {
+  const definition = ActionProgramDefinitionSchema.parse(
+    registration.definition
+  );
+  const ref2 = RevisionRefSchema.parse(registration.definitionRevisionRef);
+  if (ref2.kind !== "action-program" || ref2.id !== definition.programId || ref2.ownerRepo !== definition.ownerRepo || ref2.visibility !== "tenant" || canonicalContentHash(ref2.tenantScope) !== canonicalContentHash(scope) || canonicalContentHash(definition.tenantScope) !== canonicalContentHash(scope) || ref2.schemaVersion !== definition.schemaVersion || ref2.contentHash !== canonicalContentHash(definition) || definition.supportedSurface !== surface)
+    throw new DeclarativeControlCompilationError(
+      "CROSS_TENANT_REFERENCE",
+      path,
+      "Program identity, scope, surface or content hash does not match its exact reference."
+    );
+}
 
 // src/runtime/navigation-availability.ts
 var NAVIGATION_UNAVAILABLE_CAPABILITY_HEADER = "x-monkeys-navigation-capabilities";
@@ -26163,6 +26630,19 @@ var assertDeclarativeCapabilityContract = (entry, request) => {
     throw new TypeError("The historical capability snapshot is not supported by the current runtime contract.");
   }
 };
+var schemasCannotOverlap = (left, right) => {
+  if (left === false || right === false) return true;
+  if (!left || !right || typeof left !== "object" || typeof right !== "object" || Array.isArray(left) || Array.isArray(right)) return false;
+  const a = left;
+  const b = right;
+  if (a.$ref || b.$ref) return false;
+  const values = (schema2) => Object.prototype.hasOwnProperty.call(schema2, "const") ? [schema2.const] : Array.isArray(schema2.enum) ? schema2.enum : void 0;
+  const av = values(a), bv = values(b);
+  if (av && bv && av.every((value) => !bv.some((other) => canonicalContentHash(value) === canonicalContentHash(other)))) return true;
+  if (a.type !== "object" || b.type !== "object") return false;
+  const property = (schema2, key) => schema2.properties?.[key] ?? (schema2.patternProperties ? true : schema2.additionalProperties ?? true);
+  return [...a.required ?? [], ...b.required ?? []].some((key) => schemasCannotOverlap(property(a, key), property(b, key)));
+};
 var acceptsPreviousSchema = (previous, next) => {
   if (canonicalContentHash(previous) === canonicalContentHash(next) || next === true) return true;
   if (previous === false) return true;
@@ -26170,6 +26650,11 @@ var acceptsPreviousSchema = (previous, next) => {
   const withoutAnnotations = (schema2) => Object.fromEntries(Object.entries(schema2).filter(([key]) => !["title", "description", "examples", "$comment"].includes(key)));
   const before = withoutAnnotations(previous);
   const after = withoutAnnotations(next);
+  const branches = (schema2) => Object.keys(schema2).length === 1 ? Array.isArray(schema2.anyOf) ? schema2.anyOf : Array.isArray(schema2.oneOf) ? schema2.oneOf : void 0 : void 0;
+  const oldBranches = branches(before);
+  if (oldBranches) return oldBranches.every((branch) => acceptsPreviousSchema(branch, next));
+  const newBranches = branches(after);
+  if (newBranches) return newBranches.some((branch, index) => acceptsPreviousSchema(previous, branch) && (!after.oneOf || newBranches.every((other, otherIndex) => index === otherIndex || schemasCannotOverlap(previous, other))));
   const {
     properties: oldProperties,
     required: oldRequired,
@@ -27143,7 +27628,159 @@ function applyPageStreamEvent(state, input) {
     error: frame.type === "error" ? frame.payload : void 0
   };
 }
+
+// src/runtime/action-program-author.ts
+var import__2 = __toESM(require__());
+function programSchemaType(schema2, path = "$", depth = 0) {
+  if (depth > 32 || !schema2 || typeof schema2 !== "object" || Array.isArray(schema2))
+    throw new Error(`Unsupported schema at ${path}`);
+  const value = schema2;
+  const allowed = /* @__PURE__ */ new Set([
+    "$schema",
+    "$id",
+    "title",
+    "description",
+    "type",
+    "properties",
+    "required",
+    "additionalProperties",
+    "items",
+    "enum",
+    "const",
+    "anyOf",
+    "oneOf",
+    "minLength",
+    "maxLength",
+    "pattern",
+    "format",
+    "minimum",
+    "maximum",
+    "exclusiveMinimum",
+    "exclusiveMaximum",
+    "multipleOf",
+    "minItems",
+    "maxItems",
+    "uniqueItems",
+    "minProperties",
+    "maxProperties",
+    "default",
+    "examples",
+    "readOnly",
+    "writeOnly"
+  ]);
+  for (const key of Object.keys(value))
+    if (!allowed.has(key))
+      throw new Error(`Unsupported schema keyword ${path}.${key}`);
+  const child = (schema3, key) => programSchemaType(schema3, `${path}.${key}`, depth + 1);
+  const literal = (input) => {
+    if (input !== null && !["string", "number", "boolean"].includes(typeof input))
+      throw new Error(`Unsupported literal at ${path}`);
+    return JSON.stringify(input);
+  };
+  if ("const" in value) return literal(value.const);
+  if (Array.isArray(value.enum) && value.enum.length)
+    return value.enum.map(literal).join(" | ");
+  if (Array.isArray(value.anyOf) || Array.isArray(value.oneOf))
+    return (value.anyOf ?? value.oneOf).map((schema3, i) => `(${child(schema3, String(i))})`).join(" | ") || "never";
+  if (Array.isArray(value.type))
+    return value.type.map((type) => child({ ...value, type }, String(type))).join(" | ");
+  switch (value.type) {
+    case "null":
+      return "null";
+    case "boolean":
+      return "boolean";
+    case "string":
+      return "string";
+    case "number":
+    case "integer":
+      return "number";
+    case "array":
+      return `Array<${child(value.items, "items")}>`;
+    case "object": {
+      const properties = value.properties ?? {};
+      if (typeof properties !== "object" || !properties || Array.isArray(properties))
+        throw new Error(`Invalid properties at ${path}`);
+      const required = value.required ?? [];
+      if (!Array.isArray(required) || required.some(
+        (key) => typeof key !== "string" || !Object.prototype.hasOwnProperty.call(properties, key)
+      ))
+        throw new Error(`Unsupported required keys at ${path}`);
+      const fields = Object.entries(properties).map(
+        ([key, schema3]) => `${JSON.stringify(key)}${required.includes(key) ? "" : "?"}: ${child(schema3, key)};`
+      );
+      if (value.additionalProperties !== false) {
+        if (value.additionalProperties !== void 0 && value.additionalProperties !== true)
+          throw new Error(`Unsupported additionalProperties at ${path}`);
+        fields.push("[key: string]: unknown;");
+      }
+      return `{ ${fields.join(" ")} }`;
+    }
+    default:
+      throw new Error(`Schema needs a supported explicit type at ${path}`);
+  }
+}
+function generateActionProgramTypes(definition, schemas) {
+  const resolve = (ref2) => {
+    const matches = schemas.filter(
+      (entry) => sameRevisionRef(entry.definitionRevisionRef, ref2)
+    );
+    if (matches.length !== 1 || canonicalContentHash(matches[0].definition) !== ref2.contentHash)
+      throw new Error(`Missing exact Schema ${ref2.id}`);
+    return programSchemaType(matches[0].definition.document);
+  };
+  const formRefs = new Map(
+    [
+      definition.inputSchemaRevisionRef,
+      definition.resultSchemaRevisionRef,
+      ...definition.dependencies.flatMap((dep) => [
+        dep.inputSchemaRevisionRef,
+        dep.resultSchemaRevisionRef
+      ])
+    ].map((ref2) => [ref2.id, ref2])
+  );
+  for (const ref2 of [
+    definition.inputSchemaRevisionRef,
+    definition.resultSchemaRevisionRef,
+    ...definition.dependencies.flatMap((dep) => [
+      dep.inputSchemaRevisionRef,
+      dep.resultSchemaRevisionRef
+    ])
+  ]) {
+    if (!sameRevisionRef(formRefs.get(ref2.id), ref2))
+      throw new Error("Ambiguous form Schema revision " + ref2.id);
+  }
+  const forms = "{" + [...formRefs].map(([id, ref2]) => JSON.stringify(id) + ": " + resolve(ref2) + ";").join(" ") + "}";
+  const states = "{" + definition.stateAliases.map(
+    (entry) => JSON.stringify(entry.alias) + ": " + resolve(entry.schemaRevisionRef) + ";"
+  ).join(" ") + "}";
+  const refresh = definition.refreshAliases.map((alias) => JSON.stringify(alias)).join(" | ") || "never";
+  const capabilityMap = (kind) => `{
+${definition.dependencies.filter((dep) => dep.kind === kind).map(
+    (dep) => `${JSON.stringify(dep.revisionRef.id)}: {input: ${"Pick<" + resolve(dep.inputSchemaRevisionRef) + ", " + (dep.dynamicInputKeys.map((key) => JSON.stringify(key)).join(" | ") || "never") + ">"}; result: ${resolve(dep.resultSchemaRevisionRef)}};`
+  ).join("\n")}
+}`;
+  return `// Generated from exact program/schema revisions. Do not edit.
+import type { ActionProgramContext } from "@inf-monkeys-tech/monkeys";
+export type Input = ${resolve(definition.inputSchemaRevisionRef)};
+export type Result = ${resolve(definition.resultSchemaRevisionRef)};
+export type Queries = ${capabilityMap("query")};
+export type Commands = ${capabilityMap("command")};
+export type BaseContext = ActionProgramContext<Queries, Commands, ${forms}, ${states}, ${refresh}>;
+export type Context = Omit<BaseContext, "ui" | "state"> & {ui: Pick<BaseContext["ui"], ${definition.effects.filter((effect) => !effect.startsWith("state.")).map((effect) => JSON.stringify(effect)).join(" | ") || "never"}>; state: Pick<BaseContext["state"], ${definition.effects.filter((effect) => effect.startsWith("state.")).map((effect) => JSON.stringify(effect.slice(6))).join(" | ") || "never"}>};
+export type Program = (context: Context, input: Input) => Promise<Result>;
+`;
+}
+function compileProgramValueValidator(schema2, documents = []) {
+  const ajv2 = new import__2.default({ strict: false, allErrors: false, coerceTypes: false, removeAdditional: false, useDefaults: false });
+  const ids = /* @__PURE__ */ new Set();
+  for (const document of documents) if (typeof document.$id === "string" && document.$id !== schema2.$id && !ids.has(document.$id)) {
+    ajv2.addSchema(document);
+    ids.add(document.$id);
+  }
+  return ajv2.compile(schema2);
+}
 export {
+  ACTION_PROGRAM_ABI,
   AGENT_MODE_CAPABILITIES,
   AGENT_SESSION_CAPABILITY_EVIDENCE,
   AGENT_SESSION_COMMAND_POLICIES,
@@ -27151,6 +27788,10 @@ export {
   APPLICATION_HANDOFF_QUERY_PARAMETER,
   AccessPolicySchema,
   ActionBindingSchema,
+  ActionProgramArtifactSchema,
+  ActionProgramBudgetsSchema,
+  ActionProgramDefinitionSchema,
+  ActionProgramDependencySchema,
   ActionResultBindingEffectSchema,
   ActionResultBindingEffectSourceSchema,
   ActionResultClipboardEffectSchema,
@@ -27290,6 +27931,7 @@ export {
   DECLARATIVE_CONTROL_ONTOLOGY_DEFINITIONS,
   DECLARATIVE_CONTROL_SCHEMA_VERSION,
   DECLARATIVE_MIGRATION_ERROR_CODES,
+  DEFAULT_ACTION_PROGRAM_BUDGETS,
   DEFAULT_AGENT_WORKBENCH_SIDEBAR_SECTIONS,
   DEFAULT_CONDUCTOR_OWNER_EMAIL,
   DataContinuityEnvelopeSchema,
@@ -27516,6 +28158,7 @@ export {
   PageNavigationProjectionSchema,
   PageNodeSchema,
   PageOperatorSchema,
+  PageProgramActionSchema,
   PagePropertyBindingSchema,
   PageReleaseSchema,
   PageRendererProjectionSchema,
@@ -27544,6 +28187,7 @@ export {
   PermissionBundleSchema,
   PermissionDefinitionSchema,
   PersistedOntologyBindingSchema,
+  PrepareActionProgramRequestSchema,
   ProductAccessDeclarationSchema,
   ProductBodySchema,
   ProductContextSchema,
@@ -27551,6 +28195,7 @@ export {
   ProductDeclarativeAuthoringCatalogSchema,
   ProductDeclarativeCapabilityRegistrationSchema,
   ProductSurfaceSchema,
+  ProgramBindingSchema,
   ProjectionSpecSchema,
   PublicationPlanOperationSchema,
   PublicationPlanSchema,
@@ -27571,6 +28216,7 @@ export {
   RadarScoreProjectionSchema,
   RadarSelectionSchema,
   RadarWritebackRecordSchema,
+  ReadActionProgramRequestSchema,
   ReadablePageRuntimeBundleSchema,
   RecordEditorDraftOperationSchema,
   RecordEditorDraftSchema,
@@ -27579,6 +28225,7 @@ export {
   RecordEditorSubmissionSnapshotSchema,
   RecordEditorValidationDetailsSchema,
   ReferenceVisibilitySchema,
+  RegisterActionProgramRequestSchema,
   RegisteredServiceDomainQueryDataSourceSchema,
   ReleaseDependencyRoleSchema,
   ReleaseDependencySchema,
@@ -27609,6 +28256,11 @@ export {
   RoutePathTemplateSchema,
   RouteSpaceParameterSchema,
   RouteSpaceSchema,
+  RuntimeProgramCallRequestSchema,
+  RuntimeProgramCallResultSchema,
+  RuntimeProgramDownloadResultSchema,
+  RuntimeProgramLoadRequestSchema,
+  RuntimeProgramLoadResultSchema,
   SavedRadarQuerySchema,
   SchemaDefinitionSchema,
   ScopedIdentityRefSchema,
@@ -27708,6 +28360,7 @@ export {
   assertDeclarativeCapabilityContract,
   assertMonkeysThemeTokensComplete,
   assertPageValueBudget,
+  assertProgramRegistration,
   assertThemeTokensDocumentStructure,
   assertViewProviderContract,
   buildApplicationHandoffUrl,
@@ -27735,6 +28388,7 @@ export {
   compileProductAccessDeclaration,
   compileProductDeclaration,
   compileProductRuntimeCatalog,
+  compileProgramValueValidator,
   compileRenderTree,
   compileRouteClaims,
   compileTargetRenderModelValidator,
@@ -27768,6 +28422,7 @@ export {
   evaluatePageExpression,
   extractOpenApiCapabilityManifests,
   findUnsupportedAgentSessionCapabilities,
+  generateActionProgramTypes,
   getAgentModeCapabilities,
   getAgentSessionCommandPolicy,
   getAgentSessionRuntimeCapabilities,
@@ -27789,6 +28444,8 @@ export {
   parseExactProductDeclarativeCapabilityRegistration,
   parseWorkflowColumnBinding,
   permissionAlternativePolicyAllows,
+  programDependencies,
+  programSchemaType,
   projectAgentSessionEvents,
   projectCurrentNavigationPages,
   projectNavigationCompatibility,