@lambdacurry/arbor 0.12.8 → 0.13.0

package/dist/arbor.js

@@ -1613,7 +1613,7 @@ var computerSnapshots = sqliteTable("computer_snapshots", {
   contentDigest: text("content_digest"),
   createdAt: ts("created_at").notNull()
 }, (t) => ({
-  providerRefIdx: uniqueIndex("computer_snapshots_provider_ref_idx").on(t.provider, t.providerRef),
+  providerRefIdx: index("computer_snapshots_provider_ref_idx").on(t.provider, t.providerRef),
   topicBaseIdx: uniqueIndex("computer_snapshots_topic_base_idx").on(t.topicId, t.configKey),
   lineageIdx: uniqueIndex("computer_snapshots_lineage_idx").on(t.lineageKey),
   computerIdx: index("computer_snapshots_computer_idx").on(t.computerId, t.createdAt),
@@ -1801,6 +1801,105 @@ var artifactVersions = sqliteTable("artifact_versions", {
 }, (t) => ({
   artifactVersionUq: uniqueIndex("artifact_versions_artifact_version_uq").on(t.artifactId, t.version)
 }));
+var appBundles = sqliteTable("app_bundles", {
+  id: text("id").primaryKey(),
+  artifactVersionId: text("artifact_version_id").notNull().references(() => artifactVersions.id),
+  spaceId: text("space_id").notNull().references(() => spaces.id),
+  compatibilityDate: text("compatibility_date").notNull(),
+  mainModule: text("main_module").notNull(),
+  modules: text("modules", { mode: "json" }).$type().notNull(),
+  staticAssets: text("static_assets", { mode: "json" }).$type().notNull(),
+  runtimeEntrypoint: text("runtime_entrypoint").$type().notNull(),
+  capabilityRequirements: text("capability_requirements", { mode: "json" }).$type().notNull().default([]),
+  stateSchemaVersion: integer("state_schema_version").notNull().default(0),
+  stateCompatibleFrom: integer("state_compatible_from").notNull().default(0),
+  stateCompatibleThrough: integer("state_compatible_through").notNull().default(0),
+  contentDigest: text("content_digest").notNull(),
+  computerSessionId: text("computer_session_id").references(() => computerSessions.id),
+  snapshotId: text("snapshot_id").references(() => computerSnapshots.id),
+  createdByProfileId: text("created_by_profile_id").notNull().references(() => profiles.id),
+  createdExecutionContextId: text("created_execution_context_id").notNull().references(() => executionContexts.id),
+  idempotencyKey: text("idempotency_key"),
+  idempotencyFingerprint: text("idempotency_fingerprint"),
+  createdAt: ts("created_at").notNull()
+}, (t) => ({
+  sourceDigestIdx: index("app_bundles_source_digest_idx").on(t.artifactVersionId, t.contentDigest),
+  unkeyedSourceDigestUq: uniqueIndex("app_bundles_unkeyed_source_digest_uq").on(t.artifactVersionId, t.contentDigest).where(sql`${t.idempotencyKey} IS NULL`),
+  digestIdx: index("app_bundles_content_digest_idx").on(t.contentDigest),
+  spaceIdx: index("app_bundles_space_idx").on(t.spaceId, t.createdAt),
+  idempotencyUq: uniqueIndex("app_bundles_idempotency_uq").on(t.computerSessionId, t.createdByProfileId, t.idempotencyKey)
+}));
+var apps = sqliteTable("apps", {
+  id: text("id").primaryKey(),
+  orgId: text("org_id").notNull().references(() => orgs.id),
+  spaceId: text("space_id").notNull().references(() => spaces.id),
+  title: text("title").notNull(),
+  slug: text("slug").notNull(),
+  lifecycle: text("lifecycle").$type().notNull().default("active"),
+  access: text("access").$type().notNull(),
+  discovery: text("discovery").$type(),
+  activeDeploymentId: text("active_deployment_id"),
+  runtimeProvider: text("runtime_provider").$type().notNull(),
+  runtimeHealth: text("runtime_health").$type().notNull().default("unknown"),
+  runtimeHealthUpdatedAt: ts("runtime_health_updated_at"),
+  stateMode: text("state_mode").$type().notNull(),
+  stateIdentity: text("state_identity").notNull(),
+  stateGeneration: integer("state_generation").notNull().default(0),
+  currentStateSchemaVersion: integer("current_state_schema_version").notNull().default(0),
+  deploymentRevision: integer("deployment_revision").notNull().default(0),
+  createdByProfileId: text("created_by_profile_id").notNull().references(() => profiles.id),
+  createdExecutionContextId: text("created_execution_context_id").notNull().references(() => executionContexts.id),
+  createdAt: ts("created_at").notNull(),
+  archivedAt: ts("archived_at")
+}, (t) => ({
+  slugUq: uniqueIndex("apps_slug_uq").on(t.slug),
+  spaceIdx: index("apps_space_idx").on(t.spaceId, t.lifecycle, t.createdAt),
+  orgIdx: index("apps_org_idx").on(t.orgId, t.access, t.discovery)
+}));
+var appDeployments = sqliteTable("app_deployments", {
+  id: text("id").primaryKey(),
+  appId: text("app_id").notNull().references(() => apps.id),
+  bundleId: text("bundle_id").notNull().references(() => appBundles.id),
+  version: integer("version").notNull(),
+  contentDigest: text("content_digest").notNull(),
+  status: text("status").$type().notNull().default("candidate"),
+  deployedByProfileId: text("deployed_by_profile_id").notNull().references(() => profiles.id),
+  deployedExecutionContextId: text("deployed_execution_context_id").notNull().references(() => executionContexts.id),
+  idempotencyKey: text("idempotency_key").notNull(),
+  idempotencyFingerprint: text("idempotency_fingerprint").notNull(),
+  providerReceipt: text("provider_receipt", { mode: "json" }).$type(),
+  healthResult: text("health_result", { mode: "json" }).$type(),
+  failureCode: text("failure_code"),
+  createdAt: ts("created_at").notNull(),
+  verifiedAt: ts("verified_at"),
+  activatedAt: ts("activated_at"),
+  supersededAt: ts("superseded_at")
+}, (t) => ({
+  appVersionUq: uniqueIndex("app_deployments_app_version_uq").on(t.appId, t.version),
+  idempotencyUq: uniqueIndex("app_deployments_idempotency_uq").on(t.appId, t.deployedByProfileId, t.idempotencyKey),
+  appIdx: index("app_deployments_app_idx").on(t.appId, t.createdAt),
+  bundleIdx: index("app_deployments_bundle_idx").on(t.bundleId)
+}));
+var appStateResets = sqliteTable("app_state_resets", {
+  id: text("id").primaryKey(),
+  appId: text("app_id").notNull().references(() => apps.id),
+  fromGeneration: integer("from_generation").notNull(),
+  toGeneration: integer("to_generation").notNull(),
+  idempotencyKey: text("idempotency_key").notNull(),
+  resetByProfileId: text("reset_by_profile_id").notNull().references(() => profiles.id),
+  resetExecutionContextId: text("reset_execution_context_id").notNull().references(() => executionContexts.id),
+  providerReceipt: text("provider_receipt", { mode: "json" }).$type().notNull(),
+  createdAt: ts("created_at").notNull()
+}, (t) => ({
+  idempotencyUq: uniqueIndex("app_state_resets_idempotency_uq").on(t.appId, t.resetByProfileId, t.idempotencyKey),
+  appIdx: index("app_state_resets_app_idx").on(t.appId, t.createdAt)
+}));
+var appViewerGrantUses = sqliteTable("app_viewer_grant_uses", {
+  jti: text("jti").primaryKey(),
+  appId: text("app_id").notNull().references(() => apps.id),
+  profileId: text("profile_id").notNull().references(() => profiles.id),
+  consumedAt: ts("consumed_at").notNull()
+});
 var requests = sqliteTable("requests", {
   id: text("id").primaryKey(),
   threadId: text("thread_id").notNull().references(() => threads.id),
@@ -1920,6 +2019,9 @@ var PREVIEW_MIME_TYPES = new Set([
   "font/woff",
   "font/woff2"
 ]);
+// ../core/src/ops/app.ts
+var APP_MAX_MODULE_BYTES = 10 * 1024 * 1024;
+var APP_MAX_ASSET_BYTES = 25 * 1024 * 1024;
 // ../core/src/queries/lane-match.ts
 var STOP_WORDS = new Set("a an and are as at be by for from has have here how i in is it me of on or our the their they this to was what when where which who will with you your".split(" "));
 // ../core/src/queries/activity.ts
@@ -16573,7 +16675,7 @@ var ACTIONS = [
     description: "Replace your organization's sparse computer-default layer without allocating runtime state. Omitted/null values fall back to provider defaults; Space, Topic, and Thread layers may override individual fields.",
     inputSchema: {
       backend: exports_external.enum(["worker-shell", "container"]).nullable().optional().describe("default execution tier, or null to use worker-shell"),
-      containerProfile: exports_external.string().nullable().optional().describe("optional logical Currybox container profile, or null to clear"),
+      containerProfile: exports_external.string().nullable().optional().describe("logical container profile; use bun-typescript-v1 for the pinned Bun monorepo toolchain, or null to clear"),
       setupScript: exports_external.string().nullable().optional().describe("optional setup run when materializing a reusable base, or null to clear"),
       repositories: exports_external.array(exports_external.string()).nullable().optional().describe("default repositories, repeated --repositories; [] clears and null inherits provider default")
     },
@@ -16588,7 +16690,7 @@ var ACTIONS = [
     inputSchema: {
       spaceId: exports_external.string().describe("the Space, spc_…"),
       backend: exports_external.enum(["worker-shell", "container"]).nullable().optional().describe("override execution tier, or null to inherit"),
-      containerProfile: exports_external.string().nullable().optional().describe("optional logical Currybox container profile, or null to clear inherited profile"),
+      containerProfile: exports_external.string().nullable().optional().describe("logical container profile; use bun-typescript-v1 for the pinned Bun monorepo toolchain, or null to clear inherited profile"),
       setupScript: exports_external.string().nullable().optional().describe("optional setup run when materializing a reusable base, or null to clear"),
       repositories: exports_external.array(exports_external.string()).nullable().optional().describe("repository allowlist/default clones; [] clears and null inherits")
     },
@@ -16603,7 +16705,7 @@ var ACTIONS = [
     inputSchema: {
       topicId: exports_external.string().describe("the Topic, top_…"),
       backend: exports_external.enum(["worker-shell", "container"]).nullable().optional().describe("override execution tier, or null to inherit"),
-      containerProfile: exports_external.string().nullable().optional().describe("optional logical Currybox container profile, or null to clear inherited profile"),
+      containerProfile: exports_external.string().nullable().optional().describe("logical container profile; use bun-typescript-v1 for the pinned Bun monorepo toolchain, or null to clear inherited profile"),
       setupScript: exports_external.string().nullable().optional().describe("optional setup run, or null to clear"),
       repositories: exports_external.array(exports_external.string()).nullable().optional().describe("repository allowlist/default clones; [] clears and null inherits")
     },
@@ -16618,7 +16720,7 @@ var ACTIONS = [
     inputSchema: {
       threadId: exports_external.string().describe("the Thread, thr_…"),
       backend: exports_external.enum(["worker-shell", "container"]).nullable().optional().describe("override execution tier, or null to inherit"),
-      containerProfile: exports_external.string().nullable().optional().describe("optional logical Currybox container profile, or null to clear inherited profile"),
+      containerProfile: exports_external.string().nullable().optional().describe("logical container profile; use bun-typescript-v1 for the pinned Bun monorepo toolchain, or null to clear inherited profile"),
       setupScript: exports_external.string().nullable().optional().describe("optional setup run, or null to clear"),
       repositories: exports_external.array(exports_external.string()).nullable().optional().describe("repository allowlist/default clones; [] clears and null inherits")
     },
@@ -16782,6 +16884,26 @@ var ACTIONS = [
     toolset: "loop",
     run: forward("computer_runtime.publish_preview")
   },
+  {
+    name: "computer_publish_app_bundle",
+    title: "Publish an immutable AppBundle",
+    description: "After a Bun container build is green, freeze one Worker entry module plus optional static assets from this Thread computer into a content-addressed AppBundle sourced from an ArtifactVersion. Use the returned bundleId with apps verb=deploy (CLI: app_deploy); uploads complete and verify before Arbor publishes the bundle manifest, and retries require the same idempotencyKey.",
+    inputSchema: {
+      computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      artifactVersionId: exports_external.string().describe("the source ArtifactVersion, artv_…"),
+      entryPath: exports_external.string().describe("absolute TypeScript/JavaScript Worker entry under /workspace"),
+      assetsPath: exports_external.string().optional().describe("optional absolute static-asset directory under /workspace"),
+      runtimeEntrypoint: exports_external.enum(["fetch", "durable-object"]).describe("fetch for stateless Apps; durable-object must export class App"),
+      compatibilityDate: exports_external.string().describe("Cloudflare compatibility date, YYYY-MM-DD"),
+      stateSchemaVersion: exports_external.number().int().min(0).optional().describe("durable schema this release writes; default 0"),
+      stateCompatibleFrom: exports_external.number().int().min(0).optional().describe("oldest durable schema this code can open"),
+      stateCompatibleThrough: exports_external.number().int().min(0).optional().describe("newest durable schema this code can open"),
+      idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this one logical bundle publication")
+    },
+    surfaces: ["computer-mcp", "computer-cli"],
+    toolset: "apps",
+    run: forward("computer_runtime.publish_app_bundle")
+  },
   {
     name: "computer_stop",
     title: "Checkpoint and stop",
@@ -17698,6 +17820,174 @@ var ACTIONS = [
       promote_attachment: "attachment.promote"
     }, (verb, input) => verb === "edit" ? { ...input, verb: Array.isArray(input.patches) ? "patch" : "replace" } : input)
   },
+  {
+    name: "apps",
+    title: "List visible Apps",
+    description: "List Apps available to you: every App in your Spaces plus listed public Apps across the organization. Lifecycle and runtime health are separate fields; unlisted public Apps appear only to their owning Space.",
+    inputSchema: {
+      includeArchived: exports_external.boolean().optional().describe("include archived Apps you are authorized to inspect")
+    },
+    surfaces: ["cli"],
+    toolset: "apps",
+    run: forward("app.list")
+  },
+  {
+    name: "apps",
+    title: "Publish and manage Apps",
+    description: "Manage stable Arbor Apps through one guarded lifecycle (AD-248). verb=list shows Apps visible across your Spaces; get reads the current active release, state generation, and history; create mints the Space-owned identity; deploy health-checks an immutable AppBundle without moving the URL; deployment inspects one candidate; activate and rollback health-check then compare-and-swap the active release; set_access changes Space/public and public discovery immediately; reset_state is the only durable SQLite deletion; archive stops serving but retains history. Read with get immediately before activate, rollback, access, or reset so expectedActiveDeploymentId/expectedGeneration are current; start public Apps as public+unlisted+none and private stateful Apps as space+durable.",
+    inputSchema: {
+      verb: exports_external.enum([
+        "list",
+        "get",
+        "create",
+        "deploy",
+        "deployment",
+        "activate",
+        "rollback",
+        "set_access",
+        "reset_state",
+        "archive"
+      ]).describe("which App lifecycle operation to perform"),
+      includeArchived: exports_external.boolean().optional().describe("list: include authorized archived Apps"),
+      appId: exports_external.string().optional().describe("required for every verb except list and create: the App, app_…"),
+      spaceId: exports_external.string().optional().describe("create: owning Space, spc_…"),
+      title: exports_external.string().min(1).max(160).optional().describe("create: short factual title"),
+      slug: exports_external.string().min(1).max(59).optional().describe("create: stable label in app-<slug>.arborthreads.dev"),
+      access: exports_external.enum(["space", "public"]).optional().describe("create/set_access: gateway access"),
+      discovery: exports_external.enum(["unlisted", "listed"]).nullable().optional().describe("create/set_access: public discovery; Space Apps use null"),
+      stateMode: exports_external.enum(["none", "durable"]).optional().describe("create: none or isolated durable SQLite"),
+      bundleId: exports_external.string().optional().describe("deploy: verified immutable AppBundle, bnd_…"),
+      deploymentId: exports_external.string().optional().describe("deployment/activate/rollback: deployment, dep_…"),
+      expectedActiveDeploymentId: exports_external.string().nullable().optional().describe("activate/rollback: active deployment just read; null only for first activation"),
+      expectedGeneration: exports_external.number().int().min(0).optional().describe("reset_state: durable generation just read"),
+      idempotencyKey: exports_external.string().min(1).max(200).optional().describe("deploy/reset_state: stable key for this one logical mutation")
+    },
+    surfaces: ["mcp"],
+    toolset: "apps",
+    run: dispatch({
+      list: "app.list",
+      get: "app.get",
+      create: "app.create",
+      deploy: "app.deploy",
+      deployment: "app.deployment_get",
+      activate: "app.activate",
+      rollback: "app.rollback",
+      set_access: "app.set_access",
+      reset_state: "app.reset_state",
+      archive: "app.archive"
+    })
+  },
+  {
+    name: "app_get",
+    title: "Read an App",
+    description: "Inspect one App's stable URL, active release, source AppBundle, deployment timeline, runtime health, state identity/generation, and reset history. Read this before deployment, rollback, access, or state changes so your compare-and-swap inputs are current.",
+    inputSchema: { appId: exports_external.string().describe("the App, app_…") },
+    surfaces: ["cli"],
+    toolset: "apps",
+    run: forward("app.get")
+  },
+  {
+    name: "app_create",
+    title: "Create an App",
+    description: "Create a stable first-class App identity in a Space before deploying code. Start small public Apps as public+unlisted+none; use space+durable only when the App needs membership authorization and isolated SQLite state.",
+    inputSchema: {
+      spaceId: exports_external.string().describe("owning Space, spc_…"),
+      title: exports_external.string().min(1).max(160).describe("short factual App title"),
+      slug: exports_external.string().min(1).max(59).describe("stable DNS label used by app-<slug>.arborthreads.dev"),
+      access: exports_external.enum(["space", "public"]).describe("space requires membership; public is anonymous at the gateway"),
+      discovery: exports_external.enum(["unlisted", "listed"]).nullable().optional().describe("public Apps only; default unlisted"),
+      stateMode: exports_external.enum(["none", "durable"]).describe("durable allocates isolated facet SQLite; deployment never resets it")
+    },
+    surfaces: ["cli"],
+    toolset: "apps",
+    run: forward("app.create")
+  },
+  {
+    name: "app_deploy",
+    title: "Prepare an App deployment",
+    description: "Create an immutable candidate from an AppBundle and run the provider health check without changing the stable URL. A failed candidate is recorded with redacted diagnostics and leaves the active release live; call app_activate only after this returns a verified candidate.",
+    inputSchema: {
+      appId: exports_external.string().describe("target App, app_…"),
+      bundleId: exports_external.string().describe("verified immutable AppBundle, bnd_…"),
+      idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this one logical deployment attempt")
+    },
+    surfaces: ["cli"],
+    toolset: "apps",
+    run: forward("app.deploy")
+  },
+  {
+    name: "app_deployment",
+    title: "Inspect an App deployment",
+    description: "Read one deployment's candidate/active/failed/superseded state, source bundle, provider receipt, and redacted health result. Use it when a deployment is pending or failed; provider output never includes credentials.",
+    inputSchema: {
+      appId: exports_external.string().describe("owning App, app_…"),
+      deploymentId: exports_external.string().describe("deployment, dep_…")
+    },
+    surfaces: ["cli"],
+    toolset: "apps",
+    run: forward("app.deployment_get")
+  },
+  {
+    name: "app_activate",
+    title: "Activate a verified deployment",
+    description: "Atomically advance an App's stable URL to a verified candidate after a fresh health check. Pass the active deployment id you just read (or null for the first release); a concurrent change is rejected instead of overwriting it.",
+    inputSchema: {
+      appId: exports_external.string().describe("target App, app_…"),
+      deploymentId: exports_external.string().describe("verified candidate, dep_…"),
+      expectedActiveDeploymentId: exports_external.string().nullable().describe("active deployment from app_get, or null before first activation")
+    },
+    surfaces: ["cli"],
+    toolset: "apps",
+    run: forward("app.activate")
+  },
+  {
+    name: "app_rollback",
+    title: "Roll back App code",
+    description: "Re-activate a superseded deployment while preserving the App's state identity and SQLite data. Durable rollback is refused when the target bundle cannot read the current state schema; reset is a separate destructive operation.",
+    inputSchema: {
+      appId: exports_external.string().describe("target App, app_…"),
+      deploymentId: exports_external.string().describe("superseded deployment to restore, dep_…"),
+      expectedActiveDeploymentId: exports_external.string().describe("current active deployment from app_get")
+    },
+    surfaces: ["cli"],
+    toolset: "apps",
+    run: forward("app.rollback")
+  },
+  {
+    name: "app_set_access",
+    title: "Change App access",
+    description: "Change the gateway policy immediately and record who changed it: space requires a current Space member, while public permits anonymous requests and may be unlisted or listed. This does not redeploy code or pass an Arbor identity into App code.",
+    inputSchema: {
+      appId: exports_external.string().describe("target App, app_…"),
+      access: exports_external.enum(["space", "public"]).describe("new gateway access"),
+      discovery: exports_external.enum(["unlisted", "listed"]).nullable().optional().describe("required concept only for public Apps")
+    },
+    surfaces: ["cli"],
+    toolset: "apps",
+    run: forward("app.set_access")
+  },
+  {
+    name: "app_reset_state",
+    title: "Reset durable App state",
+    description: "Permanently delete one durable App facet's isolated SQLite database as an explicit operation; deploying or rolling back never does this. Read app_get first, pass its expectedGeneration, and use a stable idempotencyKey so retries do not delete a later generation.",
+    inputSchema: {
+      appId: exports_external.string().describe("durable App, app_…"),
+      expectedGeneration: exports_external.number().int().min(0).describe("state generation from app_get"),
+      idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this one deliberate reset")
+    },
+    surfaces: ["cli"],
+    toolset: "apps",
+    run: forward("app.reset_state")
+  },
+  {
+    name: "app_archive",
+    title: "Archive an App",
+    description: "Remove an App from active serving while retaining its stable identity, deployment timeline, receipts, and durable state for audit/recovery. Archive is lifecycle-only: it neither resets state nor deletes release history.",
+    inputSchema: { appId: exports_external.string().describe("target App, app_…") },
+    surfaces: ["cli"],
+    toolset: "apps",
+    run: forward("app.archive")
+  },
   {
     name: "charter",
     title: "Set the guidance surfaces",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.12.8",
+  "version": "0.13.0",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",