@k2b/cloud 0.6.0 → 0.8.0

package/src/_internal/capabilities.ts

@@ -10,6 +10,8 @@ import {
   type CapabilityActionManifest,
   type CapabilityActionReviewResult,
   CapabilityActionReviewSchema,
+  type CapabilityCommandManifest,
+  CapabilityCommandManifestSchema,
   type CapabilityDefinitions,
   type CapabilityError,
   CapabilityErrorSchema,
@@ -190,12 +192,14 @@ const compileSchemaPresentation = (
 
 const compileOperationPresentation = (
   value: unknown,
-  operation: CapabilityQueryManifest | CapabilityActionManifest,
+  operation: CapabilityQueryManifest | CapabilityActionManifest | CapabilityCommandManifest,
   label: string,
 ): CapabilityOperationPresentationTranslation => {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
   const translation = value as Record<string, unknown>;
-  const allowed = new Set(["title", "description", "input", "data", "searchTags"]);
+  const allowed = new Set(
+    "path" in operation ? ["title", "description", "input"] : ["title", "description", "input", "data", "searchTags"],
+  );
   const extra = Object.keys(translation).find((key) => !allowed.has(key));
   if (extra) throw new Error(`${label} contains unsupported field "${extra}"`);
   if (translation.title !== undefined) {
@@ -238,7 +242,7 @@ const compileOperationPresentation = (
     );
   }
   const input = compileSchemaPresentation(translation.input, operation.inputSchema, `${label}.input`);
-  const data = compileSchemaPresentation(translation.data, operation.dataSchema, `${label}.data`);
+  const data = "dataSchema" in operation ? compileSchemaPresentation(translation.data, operation.dataSchema, `${label}.data`) : undefined;
   return {
     ...(typeof translation.title === "string" ? { title: translation.title.trim() } : {}),
     ...(typeof translation.description === "string" ? { description: translation.description.trim() } : {}),
@@ -263,6 +267,7 @@ export const compileCapabilityPresentation = (manifest: CapabilityManifest, valu
   const types = new Map(manifest.types.map((type) => [type.localId, type]));
   const queries = new Map(manifest.queries.map((operation) => [operation.localId, operation]));
   const actions = new Map(manifest.actions.map((operation) => [operation.localId, operation]));
+  const commands = new Map(manifest.commands.map((operation) => [operation.localId, operation]));
   const translations: Record<string, CapabilityPresentationTranslation> = {};
   for (const [locale, rawTranslation] of Object.entries(catalog.translations as Record<string, unknown>)) {
     const canonical = canonicalLocale(locale);
@@ -273,7 +278,7 @@ export const compileCapabilityPresentation = (manifest: CapabilityManifest, valu
       throw new Error(`Capability presentation translation ${canonical} must be an object`);
     }
     const raw = rawTranslation as Record<string, unknown>;
-    const extra = Object.keys(raw).find((key) => key !== "types" && key !== "queries" && key !== "actions");
+    const extra = Object.keys(raw).find((key) => key !== "types" && key !== "queries" && key !== "actions" && key !== "commands");
     if (extra) throw new Error(`Capability presentation translation ${canonical} contains unsupported field "${extra}"`);
     const compileGroup = <T>(
       group: unknown,
@@ -311,10 +316,12 @@ export const compileCapabilityPresentation = (manifest: CapabilityManifest, valu
     });
     const translatedQueries = compileGroup(raw.queries, queries, "Query", compileOperationPresentation);
     const translatedActions = compileGroup(raw.actions, actions, "Action", compileOperationPresentation);
+    const translatedCommands = compileGroup(raw.commands, commands, "Command", compileOperationPresentation);
     translations[canonical] = {
       ...(translatedTypes ? { types: translatedTypes } : {}),
       ...(translatedQueries ? { queries: translatedQueries } : {}),
       ...(translatedActions ? { actions: translatedActions } : {}),
+      ...(translatedCommands ? { commands: translatedCommands } : {}),
     };
   }
   return { baseLocale, translations };
@@ -406,7 +413,7 @@ const normalizeSearchTags = (definition: CapabilityQueryDefinition, label: strin
       ...(aliases.length > 0 ? { aliases } : {}),
     };
   });
-  return { tags };
+  return { tags, ...(definition.universalSearch.scopeTypes ? { scopeTypes: [...new Set(definition.universalSearch.scopeTypes)] } : {}) };
 };
 
 const compileOperationSchemas = (definition: CapabilityQueryDefinition | CapabilityActionDefinition, label: string) => {
@@ -426,7 +433,11 @@ const compileOperationSchemas = (definition: CapabilityQueryDefinition | Capabil
     inputSchema,
     dataSchema,
     resultZodSchema,
-    schemaHash: capabilityHash({ inputSchema, dataSchema }),
+    schemaHash: capabilityHash({
+      inputSchema,
+      dataSchema,
+      ...(definition.stream ? { stream: { direction: definition.stream.direction, maxBytes: definition.stream.maxBytes } } : {}),
+    }),
   };
 };
 
@@ -462,6 +473,13 @@ export const compileCapabilities = (appId: string, definitions: CapabilityDefini
   for (const [localId, definition] of Object.entries(definitions.queries ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
     registerLocalId(localId, "Query");
     const label = `Query ${localId}`;
+    if (
+      definition.stream &&
+      ((definition.stream.direction === "write" && !("idempotency" in definition)) || definition.stream.maxBytes <= 0)
+    )
+      throw new Error(`${label}: write streams require an Action and a positive byte budget`);
+    if (definition.stream?.direction === "write" && "idempotency" in definition && definition.idempotency !== "required")
+      throw new Error(`${label}: write streams require idempotency`);
     const schemas = compileOperationSchemas(definition, label);
     if (definition.universalSearch) {
       const expectedInput = projectSchema(UniversalSearchInputSchema, "Universal Search input", "input");
@@ -480,9 +498,13 @@ export const compileCapabilities = (appId: string, definitions: CapabilityDefini
       inputSchema: schemas.inputSchema,
       dataSchema: schemas.dataSchema,
       schemaHash: schemas.schemaHash,
+      ...(definition.stream ? { stream: { direction: definition.stream.direction, maxBytes: definition.stream.maxBytes } } : {}),
       openWorld: definition.openWorld,
       universalSearch: normalizeSearchTags(definition, label),
     } satisfies CapabilityQueryManifest;
+    for (const type of manifest.universalSearch?.scopeTypes ?? []) {
+      if (!typeIds.has(qualifiedId(appId, type))) throw new Error(`${label} declares an unknown search scope type ${type}`);
+    }
     queries.set(localId, {
       definition,
       manifest,
@@ -499,12 +521,41 @@ export const compileCapabilities = (appId: string, definitions: CapabilityDefini
   for (const [localId, definition] of Object.entries(definitions.actions ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
     registerLocalId(localId, "Action");
     const label = `Action ${localId}`;
+    // Declaration rule, documented in docs/platform/capabilities.md:
+    // destructive means irreversible or externally visible. An irreversible or
+    // open-world effect must always be reviewable and safely repeatable, and
+    // must never be approved once and then replayed silently.
+    if (definition.destructive && !definition.review) {
+      throw new Error(`${label} is destructive and must declare review()`);
+    }
+    if (definition.destructive && definition.idempotency !== "required") {
+      throw new Error(`${label} is destructive and must declare idempotency: "required"`);
+    }
+    if (definition.openWorld && !definition.review) {
+      throw new Error(`${label} is open-world and must declare review()`);
+    }
+    if (definition.openWorld && definition.idempotency !== "required") {
+      throw new Error(`${label} is open-world and must declare idempotency: "required"`);
+    }
     if (definition.approval === "rememberable" && definition.openWorld) {
       throw new Error(`${label} cannot remember approval for an open-world effect`);
     }
+    if (definition.approval === "rememberable" && definition.destructive) {
+      throw new Error(`${label} cannot remember approval for a destructive effect`);
+    }
+    if (definition.approval === "none" && (definition.destructive || definition.openWorld)) {
+      throw new Error(`${label} cannot skip approval for destructive or open-world effects`);
+    }
     if (definition.approval === "rememberable" && !definition.review) {
       throw new Error(`${label} must provide a review before approval can be remembered`);
     }
+    if (
+      definition.stream &&
+      ((definition.stream.direction === "write" && !("idempotency" in definition)) || definition.stream.maxBytes <= 0)
+    )
+      throw new Error(`${label}: write streams require an Action and a positive byte budget`);
+    if (definition.stream?.direction === "write" && "idempotency" in definition && definition.idempotency !== "required")
+      throw new Error(`${label}: write streams require idempotency`);
     const schemas = compileOperationSchemas(definition, label);
     const manifest = {
       localId,
@@ -513,6 +564,7 @@ export const compileCapabilities = (appId: string, definitions: CapabilityDefini
       inputSchema: schemas.inputSchema,
       dataSchema: schemas.dataSchema,
       schemaHash: schemas.schemaHash,
+      ...(definition.stream ? { stream: { direction: definition.stream.direction, maxBytes: definition.stream.maxBytes } } : {}),
       destructive: definition.destructive,
       openWorld: definition.openWorld,
       idempotency: definition.idempotency,
@@ -526,12 +578,30 @@ export const compileCapabilities = (appId: string, definitions: CapabilityDefini
     });
   }
 
+  const commands = Object.entries(definitions.commands ?? {})
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([localId, definition]) => {
+      registerLocalId(localId, "Command");
+      const inputSchema = projectSchema(definition.input, `Command ${localId} input`, "input");
+      assertClosedObjectInput(inputSchema, `Command ${localId} input`);
+      return CapabilityCommandManifestSchema.parse({
+        localId,
+        title: definition.title.trim(),
+        description: definition.description.trim(),
+        icon: definition.icon,
+        keywords: [...(definition.keywords ?? [])],
+        inputSchema,
+        path: definition.path,
+      });
+    });
+
   const manifestBase = {
     protocolVersion: CAPABILITY_PROTOCOL_VERSION,
     appId,
     types,
     queries: [...queries.values()].map((entry) => entry.manifest),
     actions: [...actions.values()].map((entry) => entry.manifest),
+    commands,
   };
   const manifest = CapabilityManifestSchema.parse({
     ...manifestBase,
@@ -614,6 +684,7 @@ export const resolveCapabilityManifestPresentation = (
           ...(operation.universalSearch
             ? {
                 universalSearch: {
+                  ...operation.universalSearch,
                   tags: operation.universalSearch.tags.map((tag) => {
                     const tagCopy = copy.searchTags?.[tag.tag];
                     return tagCopy
@@ -625,6 +696,17 @@ export const resolveCapabilityManifestPresentation = (
             : {}),
         };
       }),
+      commands: current.commands.map((operation) => {
+        const copy = translation.commands?.[operation.localId];
+        return copy
+          ? {
+              ...operation,
+              title: copy.title ?? operation.title,
+              description: copy.description ?? operation.description,
+              inputSchema: applySchemaPresentation(operation.inputSchema, copy.input),
+            }
+          : operation;
+      }),
       actions: current.actions.map((operation) => {
         const copy = translation.actions?.[operation.localId];
         return copy
@@ -668,10 +750,20 @@ export const parseCapabilityManifest = (value: unknown, expectedAppId: string):
       );
     }
     assertClosedObjectInput(inputSchema, `Operation ${operation.localId} input`);
-    const expectedSchemaHash = capabilityHash({ inputSchema: operation.inputSchema, dataSchema: operation.dataSchema });
+    if (operation.stream?.direction === "write" && (!("idempotency" in operation) || operation.idempotency !== "required")) {
+      throw new Error(`Operation ${operation.localId} write streams require an idempotent Action`);
+    }
+    const expectedSchemaHash = capabilityHash({
+      inputSchema: operation.inputSchema,
+      dataSchema: operation.dataSchema,
+      ...(operation.stream ? { stream: operation.stream } : {}),
+    });
     if (operation.schemaHash !== expectedSchemaHash)
       throw new Error(`Operation ${operation.localId} schemaHash does not match its schemas`);
     if ("universalSearch" in operation && operation.universalSearch) {
+      for (const type of operation.universalSearch.scopeTypes ?? []) {
+        if (!manifest.types.some((entry) => entry.localId === type)) throw new Error(`Unknown search scope type ${type}`);
+      }
       const expectedInput = projectSchema(UniversalSearchInputSchema, "Universal Search input", "input");
       const expectedData = projectSchema(UniversalSearchDataSchema, "Universal Search data", "output");
       if (
@@ -682,6 +774,11 @@ export const parseCapabilityManifest = (value: unknown, expectedAppId: string):
       }
     }
   }
+  for (const command of manifest.commands) {
+    registerLocalId(command.localId, "Command");
+    z.fromJSONSchema(structuredClone(command.inputSchema));
+    assertClosedObjectInput(command.inputSchema, `Command ${command.localId} input`);
+  }
   const queries = new Map(manifest.queries.map((query) => [query.localId, query]));
   for (const type of manifest.types) {
     if (!type.reader) continue;
@@ -787,6 +884,12 @@ export const capabilityManifestEvolutionIssues = (previous: CapabilityManifest,
     else if (type.reader && current.reader !== type.reader) issues.push(`Type ${type.localId} reader changed`);
   }
 
+  const nextCommands = new Map(next.commands.map((command) => [command.localId, command]));
+  for (const command of previous.commands) {
+    const current = nextCommands.get(command.localId);
+    if (!current) issues.push(`Command ${command.localId} was removed`);
+    else issues.push(...schemaEvolutionIssues(command.inputSchema, current.inputSchema, `Command ${command.localId} input`, "input"));
+  }
   const nextQueries = new Map(next.queries.map((operation) => [operation.localId, operation]));
   const nextActions = new Map(next.actions.map((operation) => [operation.localId, operation]));
   for (const operation of previous.queries) {
@@ -982,11 +1085,32 @@ export const invokeCompiledCapability = async (params: {
       },
     };
   }
+  if ("universalSearch" in operation.manifest && operation.manifest.universalSearch) {
+    const search = UniversalSearchInputSchema.parse(input.data);
+    if (
+      search.scope &&
+      !(operation.manifest.universalSearch.scopeTypes ?? []).some(
+        (type) => qualifiedId(params.compiled.manifest.appId, type) === search.scope!.type,
+      )
+    )
+      return { ok: false, error: { code: "VALIDATION_FAILED", message: "Unsupported search scope", status: 400 } };
+  }
   try {
     const invoked = await operation.definition.run(input.data, context);
     if (!invoked.ok) {
       return normalizeProviderError(invoked.error, "Capability returned an invalid error", params.onUnexpectedError);
     }
+    const stream = invoked.data.stream;
+    if (
+      stream &&
+      (Buffer.byteLength(stream.id) > 2048 ||
+        !operation.definition.stream ||
+        stream.direction !== operation.definition.stream.direction ||
+        stream.size > operation.definition.stream.maxBytes ||
+        Date.parse(stream.expiresAt) <= Date.now() ||
+        Date.parse(stream.expiresAt) > Date.now() + 86_400_000)
+    )
+      return invalidProviderError("Stream is outside its declared policy or 24 hour lifetime");
     const validated = validateCapabilityResult(params.compiled, operation, invoked.data, params.onUnexpectedError);
     return validated.ok
       ? ({

package/src/_internal/capability-streams.ts

@@ -0,0 +1,81 @@
+import { isServiceError } from "@k2b/stdlib";
+import { exactStream } from "../capabilities/stream-body";
+import type { CapabilityExecutionContext } from "../contracts/capabilities";
+import {
+  CAPABILITY_MAX_RESULT_BYTES,
+  CapabilityStreamSchema,
+  CapabilityStreamStatusSchema,
+  capabilityResultSchema,
+} from "../contracts/capabilities";
+import type { CompiledCapabilities } from "./capabilities";
+
+const failure = (status: number, code: string, message: string) => Response.json({ code, message }, { status });
+export async function invokeCapabilityStream(params: {
+  compiled: CompiledCapabilities;
+  kind: "queries" | "actions";
+  localId: string;
+  verb: string;
+  request: Request;
+  context: CapabilityExecutionContext;
+}): Promise<Response> {
+  const operation = params.compiled[params.kind].get(params.localId);
+  const definition = operation?.definition.stream;
+  if (!operation || !definition) return failure(404, "STREAM_NOT_FOUND", "Stream operation not found");
+  const offer = params.request.headers.get("x-cloud-stream-offer");
+  if (!offer || offer.length > 24000) return failure(400, "STREAM_INVALID", "Invalid stream offer");
+  const receipt = (value: unknown) => {
+    const parsed = capabilityResultSchema(operation.definition.data).parse(value);
+    if (parsed.stream) throw new Error("Stream receipts cannot issue another stream");
+    return parsed;
+  };
+  try {
+    const stream = CapabilityStreamSchema.parse(JSON.parse(Buffer.from(offer, "base64url").toString()));
+    if (stream.direction !== definition.direction || stream.size > definition.maxBytes || Date.parse(stream.expiresAt) <= Date.now())
+      return failure(410, "STREAM_EXPIRED", "Stream expired or outside its byte budget");
+    if (definition.direction === "read") {
+      if (params.verb !== "read") return failure(403, "STREAM_DENIED", "Read-only stream");
+      const response = await definition.read(stream, params.context);
+      if (!response.ok || !response.body) {
+        await response.body?.cancel();
+        return failure(502, "STREAM_FAILED", "Source could not be read");
+      }
+      return new Response(exactStream(response.body, stream.size), {
+        headers: { "content-type": stream.mediaType, "cache-control": "no-store" },
+      });
+    }
+    let result: unknown;
+    if (params.verb === "write") {
+      const body = exactStream(
+        params.request.body ??
+          new ReadableStream({
+            start(c) {
+              c.close();
+            },
+          }),
+        stream.size,
+      );
+      try {
+        const value = await definition.write(stream, body, params.context);
+        result = receipt(value);
+      } finally {
+        if (!body.locked) await body.cancel().catch(() => undefined);
+      }
+    } else if (params.verb === "status") {
+      const status = CapabilityStreamStatusSchema.parse(await definition.status(stream, params.context));
+      if (status.state === "completed") receipt(status.result);
+      result = status;
+    } else if (params.verb === "abort") {
+      await definition.abort(stream, params.context);
+      const status = CapabilityStreamStatusSchema.parse(await definition.status(stream, params.context));
+      if (status.state === "completed") receipt(status.result);
+      result = status;
+    } else return failure(400, "STREAM_INVALID", "Unknown stream operation");
+    const json = JSON.stringify(result);
+    if (Buffer.byteLength(json) > CAPABILITY_MAX_RESULT_BYTES)
+      return failure(502, "STREAM_FAILED", "Stream receipt is too large; inspect status before retrying");
+    return new Response(json, { headers: { "content-type": "application/json", "cache-control": "no-store" } });
+  } catch (error) {
+    if (isServiceError(error)) return failure(error.status, error.code, error.message);
+    return failure(409, "STREAM_FAILED", "Transfer failed; inspect status before retrying a write");
+  }
+}