@vendoai/apps 0.4.0

package/dist/open.js

@@ -0,0 +1,245 @@
+import { VENDO_TREE_FORMAT_V2, VendoError, validateTreeV2, } from "@vendoai/core";
+import { detectPinDrift, pinComponentName } from "./pins.js";
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+// Query paths come from the app document — model-written or imported from an untrusted
+// .vendoapp artifact — so a pointer segment that names a prototype key must never resolve.
+const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+const decodePointer = (pointer) => {
+    if (pointer === "")
+        return [];
+    if (!pointer.startsWith("/"))
+        return null;
+    const encoded = pointer.slice(1).split("/");
+    if (encoded.some((part) => /~(?![01])/u.test(part)))
+        return null;
+    const parts = encoded.map((part) => part.replaceAll("~1", "/").replaceAll("~0", "~"));
+    if (parts.some((part) => UNSAFE_KEYS.has(part)))
+        return null;
+    return parts;
+};
+const arrayIndex = (part) => /^(0|[1-9][0-9]*)$/.test(part) ? Number(part) : null;
+const child = (target, part) => {
+    if (Array.isArray(target)) {
+        const index = arrayIndex(part);
+        return index === null ? undefined : target[index];
+    }
+    return target[part];
+};
+const assignChild = (target, part, value) => {
+    if (Array.isArray(target)) {
+        const index = arrayIndex(part);
+        if (index === null || !Number.isSafeInteger(index) || index > target.length)
+            return false;
+        target[index] = value;
+        return true;
+    }
+    target[part] = value;
+    return true;
+};
+const setQueryData = (data, pointer, value) => {
+    const parts = decodePointer(pointer);
+    if (parts === null)
+        return false;
+    if (parts.length === 0) {
+        if (!isObject(value))
+            return false;
+        const replacement = structuredClone(value);
+        for (const key of Object.keys(data))
+            delete data[key];
+        for (const [key, item] of Object.entries(replacement)) {
+            if (!UNSAFE_KEYS.has(key))
+                data[key] = item;
+        }
+        return true;
+    }
+    let target = data;
+    for (let index = 0; index < parts.length - 1; index += 1) {
+        const part = parts[index];
+        const next = parts[index + 1];
+        if (part === undefined || next === undefined)
+            return false;
+        let current = child(target, part);
+        if (!isObject(current) && !Array.isArray(current)) {
+            current = arrayIndex(next) === null ? {} : [];
+            if (!assignChild(target, part, current))
+                return false;
+        }
+        target = current;
+    }
+    const final = parts.at(-1);
+    if (final === undefined)
+        return false;
+    return assignChild(target, final, structuredClone(value));
+};
+/** A v2 query's result lives at `"/" + name` by definition (v2 spec §2). */
+const queryPointer = (query) => `/${query.name}`;
+/**
+ * Start queries as soon as they appear. Results may arrive in any order, but
+ * every emitted/final data model is rebuilt in source order so later queries
+ * retain the same deterministic last-write behavior as the old serial loop.
+ */
+export const createProgressiveQueryResolver = (caller, app, ctx, onData) => {
+    const states = [];
+    const pending = new Set();
+    let baseData = {};
+    let resolvedData = {};
+    const recompute = (notify = true) => {
+        const data = structuredClone(baseData);
+        for (const state of states) {
+            if (!state.settled || state.result === undefined)
+                continue;
+            if (state.result.status !== "ok")
+                continue;
+            setQueryData(data, queryPointer(state.query), state.result.output);
+        }
+        resolvedData = data;
+        if (notify)
+            onData?.(structuredClone(data));
+    };
+    const start = (query, index) => {
+        const key = JSON.stringify(query);
+        const state = { key, query: structuredClone(query), settled: false };
+        states[index] = state;
+        const task = caller
+            .callQuery(app, query.tool, query.input ?? {}, ctx)
+            .then((result) => {
+            if (states[index] !== state)
+                return;
+            state.result = result;
+            state.settled = true;
+            recompute();
+        })
+            .catch((error) => {
+            if (states[index] !== state)
+                return;
+            state.settled = true;
+            state.error = error;
+            recompute();
+        });
+        pending.add(task);
+        void task.finally(() => pending.delete(task));
+    };
+    return {
+        update(tree) {
+            baseData = structuredClone(tree.data ?? {});
+            const queries = tree.queries ?? [];
+            if (states.length > queries.length)
+                states.length = queries.length;
+            queries.forEach((query, index) => {
+                const key = JSON.stringify(query);
+                if (states[index]?.key !== key)
+                    start(query, index);
+            });
+            recompute(false);
+        },
+        async complete() {
+            while (pending.size > 0)
+                await Promise.all([...pending]);
+            recompute(false);
+            return structuredClone(resolvedData);
+        },
+    };
+};
+/**
+ * 06-apps §§8–9 — the in-client venue field and the pin-drift report are
+ * SERVER-AUTHORITATIVE. The stored tree is model-written or imported from an
+ * untrusted `.vendoapp`, so a forged `inClient` or `pinDrift` riding the
+ * document must never reach the client: strip both before the verified
+ * verdict and the computed drift (when any) are attached — and strip at
+ * persist time too (the runtime shares this helper), streamed or at rest.
+ */
+export const stripServerAuthoritativeFields = (payload) => {
+    delete payload.inClient;
+    delete payload.pinDrift;
+    return payload;
+};
+/** 06-apps §8 — jail furnishing for forked pins rides inside the tagged tree
+ *  payload (UIPayload is forward-compatible). */
+const attachPinFurnishings = (tree, app, pinBaselines) => {
+    const furnishings = Object.fromEntries((app.pins ?? []).flatMap((pin) => {
+        const baseline = pinBaselines.find((candidate) => candidate.slot === pin.slot && candidate.hash === pin.base);
+        if (baseline === undefined)
+            return [];
+        return [[pinComponentName(pin.slot), {
+                    ...(baseline.sourceImports === undefined ? {} : { sourceImports: structuredClone(baseline.sourceImports) }),
+                    ...(baseline.subSources === undefined ? {} : { subSources: structuredClone(baseline.subSources) }),
+                    ...(baseline.sampleProps === undefined ? {} : { sampleProps: structuredClone(baseline.sampleProps) }),
+                    ...(baseline.styles === undefined ? {} : { styles: structuredClone(baseline.styles) }),
+                }]];
+    }));
+    if (Object.keys(furnishings).length > 0) {
+        tree.furnishings = furnishings;
+    }
+};
+/** Wave 4 — the one refusal for every layer-3 path while the flag is off. */
+export const servedAppsDisabledError = () => new VendoError("not-implemented", "served (layer-3) app surfaces are experimental and disabled for this project — enable them with createVendo({ apps: { experimentalServedApps: true } }) (AppsConfig.experimentalServedApps) to let a machine serve the app surface", { experiment: "servedApps", flag: "experimentalServedApps" });
+/** Wave 9 — the one refusal for NEW layer-2 box work while machines are off
+ *  (same house pattern as {@link servedAppsDisabledError}). The escalation
+ *  ladder only lands here when no automation can express the request, so the
+ *  message says exactly that instead of silently degrading to a broken
+ *  automation. Already-provisioned machines are never gated by this — only
+ *  new graduation/provisioning is. */
+export const machinesDisabledError = () => new VendoError("not-implemented", "this request needs custom server code (a box machine), and machine-backed (layer-2) execution is experimental and disabled for this project — enable it with createVendo({ apps: { experimentalMachines: true } }) (AppsConfig.experimentalMachines); scheduled/triggered work that tools can express rides the automations engine without it", { experiment: "machines", flag: "experimentalMachines" });
+/** 06-apps §§1–2 — construct the open surface. */
+export const createAppOpener = (caller, pinBaselines = [], inClientVenue, served) => async (app, ctx) => {
+    if (app.ui === "http") {
+        // execution-v2 Wave 4 — the layer-3 served surface, host-gated behind the
+        // experimental flag: opening a served app while the flag is off refuses
+        // with the SAME typed error as generation (a served app that exists from
+        // elsewhere is refused too, not just new builds).
+        if (served === undefined || !served.enabled) {
+            throw servedAppsDisabledError();
+        }
+        // A served document without a machine has NO surface anywhere (a v1-era
+        // import or a de-graduated doc): say so instead of a confusing wake error.
+        if (app.machine === undefined) {
+            throw new VendoError("validation", "this served app has no machine — its surface is gone; re-graduate it with an edit or re-create the app");
+        }
+        // Wake-on-open: a sleeping machine resumes here (the accepted wake
+        // latency; the host shows its ordinary loading state — no v1 cover or
+        // screenshot machinery).
+        return { kind: "http", url: await served.urlFor(app) };
+    }
+    if (app.tree === undefined) {
+        throw new VendoError("validation", "tree app has no ui payload");
+    }
+    // v2 spec §§1–2 — the canonical vendo-genui/v2 tree: validate, resolve
+    // queries (results at "/" + name), and serve with document components at
+    // payload level (the v2 renderer lifts them into the shared walk).
+    if (app.tree.formatVersion === VENDO_TREE_FORMAT_V2) {
+        const validation = validateTreeV2(app.tree);
+        if (!validation.ok)
+            throw new VendoError("validation", validation.error.message);
+        const tree = stripServerAuthoritativeFields(structuredClone(validation.tree));
+        const inClient = await inClientVenue?.(app);
+        if (inClient !== undefined) {
+            tree.inClient = inClient;
+        }
+        const pinDrift = detectPinDrift(app, pinBaselines);
+        if (pinDrift.length > 0) {
+            tree.pinDrift = pinDrift;
+        }
+        attachPinFurnishings(tree, app, pinBaselines);
+        const queries = createProgressiveQueryResolver(caller, app, ctx);
+        queries.update(tree);
+        tree.data = await queries.complete();
+        const payload = {
+            ...tree,
+            ...(app.components === undefined ? {} : { components: structuredClone(app.components) }),
+            // W4b — the stamped per-island tool manifests ride the payload beside
+            // the sources; the renderer exposes ONLY these tools to each island.
+            ...(app.componentTools === undefined ? {} : { componentTools: structuredClone(app.componentTools) }),
+        };
+        return app.components === undefined
+            ? { kind: "tree", payload }
+            : { kind: "tree", payload, components: structuredClone(app.components) };
+    }
+    // 01-core §8 — an unregistered format tag is a contained failure: the payload
+    // passes through untouched (no query resolution) and the renderer shows the
+    // notice. v2 is the only registered tree format (v1 is discarded).
+    const payload = stripServerAuthoritativeFields(structuredClone(app.tree));
+    return app.components === undefined
+        ? { kind: "tree", payload }
+        : { kind: "tree", payload, components: structuredClone(app.components) };
+};
+//# sourceMappingURL=open.js.map

package/dist/open.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open.js","sourceRoot":"","sources":["../src/open.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,UAAU,EACV,cAAc,GAOf,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAmC,MAAM,WAAW,CAAC;AAG9F,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAiC,EAAE,CACjE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,uFAAuF;AACvF,2FAA2F;AAC3F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAEvE,MAAM,aAAa,GAAG,CAAC,OAAe,EAAmB,EAAE;IACzD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACtF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAGF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEzG,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAE,IAAY,EAAoB,EAAE;IACtE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAqB,EAAE,IAAY,EAAE,KAAW,EAAW,EAAE;IAChF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1F,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,IAA0B,EAAE,OAAe,EAAE,KAAW,EAAW,EAAE;IACzF,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC3D,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;QACxD,CAAC;QACD,MAAM,GAAG,OAAwB,CAAC;IACpC,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,YAAY,GAAG,CAAC,KAAkB,EAAU,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;AAetE;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,MAAiB,EACjB,GAAgB,EAChB,GAAe,EACf,MAA6C,EACnB,EAAE;IAC5B,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACzC,IAAI,QAAQ,GAAyB,EAAE,CAAC;IACxC,IAAI,YAAY,GAAyB,EAAE,CAAC;IAE5C,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,IAAI,EAAQ,EAAE;QACxC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC3D,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI;gBAAE,SAAS;YAC3C,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,IAAI,MAAM;YAAE,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAkB,EAAE,KAAa,EAAQ,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,KAAK,GAAe,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM;aAChB,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC;aAClD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO;YACpC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;YACtB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACrB,SAAS,EAAE,CAAC;QACd,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO;YACpC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACrB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;YACpB,SAAS,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;QACL,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,IAAI;YACT,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YACnE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,GAAG;oBAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,SAAS,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YACzD,SAAS,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,eAAe,CAAC,YAAY,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAmB,OAAU,EAAK,EAAE;IAChF,OAAQ,OAAkC,CAAC,QAAQ,CAAC;IACpD,OAAQ,OAAkC,CAAC,QAAQ,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF;iDACiD;AACjD,MAAM,oBAAoB,GAAG,CAC3B,IAAY,EACZ,GAAgB,EAChB,YAAoC,EAC9B,EAAE;IACR,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACtE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9G,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;oBACnC,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC3G,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAClG,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBACrG,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;iBACvF,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC,CAAC;IACJ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,IAAqD,CAAC,WAAW,GAAG,WAAW,CAAC;IACnF,CAAC;AACH,CAAC,CAAC;AAYF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAe,EAAE,CAAC,IAAI,UAAU,CACrE,iBAAiB,EACjB,oOAAoO,EACpO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAC7D,CAAC;AAEF;;;;;sCAKsC;AACtC,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAe,EAAE,CAAC,IAAI,UAAU,CACnE,iBAAiB,EACjB,+UAA+U,EAC/U,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,CACzD,CAAC;AAEF,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAAiB,EACjB,eAAuC,EAAE,EACzC,aAA6E,EAC7E,MAAsB,EACyC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACrF,IAAI,GAAG,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACtB,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,kDAAkD;QAClD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,uBAAuB,EAAE,CAAC;QAClC,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,UAAU,CAClB,YAAY,EACZ,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,yBAAyB;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IACnE,CAAC;IACD,uEAAuE;IACvE,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,oBAAoB,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,8BAA8B,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAkD,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAA0C,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAClE,CAAC;QACD,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,8BAA8B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG;YACd,GAAG,IAAI;YACP,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxF,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;SAC7E,CAAC;QAC1B,OAAO,GAAG,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,OAAO,GAAG,8BAA8B,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,UAAU,KAAK,SAAS;QACjC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAC7E,CAAC,CAAC"}

package/dist/parked-action.d.ts

@@ -0,0 +1,51 @@
+import { type AppId, type ApprovalId, type RunContext, type StoreAdapter, type ToolCall } from "@vendoai/core";
+/**
+ * W0 — parked in-app actions (the approve→resume engine seam).
+ *
+ * A mutating in-app action (`runtime.call`) that the guard sends to approval
+ * returns `pending-approval` to the surface — the action shows "Running". The
+ * guard parks the approval; deciding it approved makes the EXACT same call
+ * eligible for a one-shot approved replay (guard `#consumeApprovedCall`), but
+ * only if someone re-dispatches it. Nobody did — so every gated mutation
+ * stalled at "Running" forever (held-out gate C4/C11).
+ *
+ * This collection records the exact parked call (its guard-minted id, args, and
+ * the app-venue context it ran in) keyed by the approval that gates it, so the
+ * runtime's `onApprovalDecision` subscriber can re-dispatch it the instant the
+ * owner approves — the SAME onApprovalDecision seam exposure/egress already
+ * ride. A parked record exists exactly while its approval is undecided; both
+ * decisions clear it (approve re-dispatches then clears; deny just clears —
+ * fail closed, the effect never lands).
+ *
+ * Hygiene mirrors the egress/exposure stores: records live in their own
+ * collection keyed by app id (a copy's fresh id has none) and are cleared with
+ * the app on delete.
+ */
+export interface ParkedAction {
+    /** The guard approval that gates this call. */
+    approvalId: ApprovalId;
+    appId: AppId;
+    /** The app owner's principal subject — the only principal who may approve. */
+    owner: string;
+    /**
+     * The EXACT call the guard parked: its guard-minted id, tool, and args. The
+     * approved replay matches on call id + args + descriptor, so this must be
+     * re-dispatched byte-for-byte — a fresh call id would re-park, not run.
+     */
+    call: ToolCall;
+    /** The app-venue context the call ran in (venue/presence/appId/subject) — the
+     *  approved replay also pins these, so re-dispatch reuses them verbatim. */
+    ctx: RunContext;
+}
+export interface ParkedActions {
+    /** Park one in-app action on its guard approval (re-parking overwrites). */
+    put(action: ParkedAction): Promise<void>;
+    /** The action riding a specific guard approval id, or null if none. */
+    byApproval(approvalId: ApprovalId): Promise<ParkedAction | null>;
+    /** Clear the parked action for one approval (its approval was decided, either way). */
+    remove(approvalId: ApprovalId): Promise<void>;
+    /** Delete every parked action for one app (app deletion cleanup). */
+    clearForApp(appId: AppId): Promise<void>;
+}
+export declare const createParkedActions: (store: StoreAdapter) => ParkedActions;
+//# sourceMappingURL=parked-action.d.ts.map

package/dist/parked-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parked-action.d.ts","sourceRoot":"","sources":["../src/parked-action.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,QAAQ,EAEd,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,EAAE,QAAQ,CAAC;IACf;gFAC4E;IAC5E,GAAG,EAAE,UAAU,CAAC;CACjB;AASD,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,uEAAuE;IACvE,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACjE,uFAAuF;IACvF,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,qEAAqE;IACrE,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,eAAO,MAAM,mBAAmB,GAAI,OAAO,YAAY,KAAG,aAuBzD,CAAC"}

package/dist/parked-action.js

@@ -0,0 +1,29 @@
+import { listAllRecords } from "./persistence.js";
+const COLLECTION = "vendo_parked_action";
+const parkedData = (record) => record.data;
+const listAll = (store, refs) => listAllRecords(store.records(COLLECTION), { refs });
+export const createParkedActions = (store) => {
+    const collection = store.records(COLLECTION);
+    return {
+        async put(action) {
+            await collection.put({
+                id: action.approvalId,
+                data: action,
+                refs: { subject: action.owner, app_id: action.appId, approval: action.approvalId },
+            });
+        },
+        async byApproval(approvalId) {
+            const record = await collection.get(approvalId);
+            return record === null ? null : parkedData(record);
+        },
+        async remove(approvalId) {
+            await collection.delete(approvalId);
+        },
+        async clearForApp(appId) {
+            for (const record of await listAll(store, { app_id: appId })) {
+                await collection.delete(record.id);
+            }
+        },
+    };
+};
+//# sourceMappingURL=parked-action.js.map

package/dist/parked-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parked-action.js","sourceRoot":"","sources":["../src/parked-action.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAyClD,MAAM,UAAU,GAAG,qBAAqB,CAAC;AAEzC,MAAM,UAAU,GAAG,CAAC,MAAmB,EAAgB,EAAE,CAAC,MAAM,CAAC,IAAoB,CAAC;AAEtF,MAAM,OAAO,GAAG,CAAC,KAAmB,EAAE,IAA4B,EAA0B,EAAE,CAC5F,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAatD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAmB,EAAiB,EAAE;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,UAAU,CAAC,GAAG,CAAC;gBACnB,EAAE,EAAE,MAAM,CAAC,UAAU;gBACrB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;aACnF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,UAAU;YACzB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAChD,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,MAAM,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,KAAK,MAAM,MAAM,IAAI,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBAC7D,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/persistence.d.ts

@@ -0,0 +1,41 @@
+import { type AppDocument, type AppId, type RecordQuery, type RecordStore, type VendoRecord } from "@vendoai/core";
+/** Drain a cursor-paginated listing. A page that repeats its cursor (or drops
+ *  it) terminates the loop, so a misbehaving adapter cannot spin forever. */
+export declare const listAllRecords: (records: RecordStore, query?: Omit<RecordQuery, "cursor">) => Promise<VendoRecord[]>;
+export declare const validateDocument: (input: unknown, appId: AppId) => AppDocument;
+/** The vendo_apps row shape (02-store §2: id, subject, enabled, doc). The
+ *  store's reserved records("vendo_apps") routing speaks exactly this — the
+ *  document alone is NOT the row; ownership and the automations arm/disarm
+ *  bit ride beside it. */
+export interface AppRowData {
+    subject: string;
+    enabled: boolean;
+    doc: AppDocument;
+}
+/** Trigger edits invalidate enable-time capture, cursor, and webhook state.
+ *  Canonical comparison — key order must not cause a spurious disarm. */
+export declare const enabledAfterDocumentEdit: (previous: AppDocument, next: AppDocument, enabled: boolean) => boolean;
+export declare const rowFromRecord: (record: VendoRecord) => AppRowData;
+export declare const documentFromRecord: (record: VendoRecord) => AppDocument;
+export interface AppRecordWrite {
+    id: AppId;
+    data: AppRowData;
+    refs: {
+        subject: string;
+        trigger_kind?: string;
+    };
+}
+export declare const appRecordInput: (app: AppDocument, subject: string, enabled?: boolean) => AppRecordWrite;
+/**
+ * Wave 7 — mint the next `machine.envStaleAt` marker, strictly greater than
+ * the previous one. Two grant flips in the same millisecond must never mint
+ * EQUAL markers: a wake that read the first would clear the second's marker
+ * after injecting the older env, losing the newer flip (e.g. a revocation).
+ * Marks serialize through the app row's CAS, so bumping past the previous
+ * marker is enough.
+ */
+export declare const nextEnvStaleAt: (previous?: string) => string;
+/** Bounded read-mutate-CAS on the app row; the store's revision receipt
+ *  arbitrates racers (adapters without atomic/revision fall back to put). */
+export declare const updateAppRow: (records: RecordStore, appId: AppId, mutate: (doc: AppDocument) => AppDocument) => Promise<AppDocument>;
+//# sourceMappingURL=persistence.d.ts.map

package/dist/persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.d.ts","sourceRoot":"","sources":["../src/persistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAEvB;6EAC6E;AAC7E,eAAO,MAAM,cAAc,GACzB,SAAS,WAAW,EACpB,QAAO,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAM,KACtC,OAAO,CAAC,WAAW,EAAE,CAUvB,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,OAAO,OAAO,EAAE,OAAO,KAAK,KAAG,WAS/D,CAAC;AAEF;;;0BAG0B;AAC1B,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,WAAW,CAAC;CAClB;AAED;yEACyE;AACzE,eAAO,MAAM,wBAAwB,GACnC,UAAU,WAAW,EACrB,MAAM,WAAW,EACjB,SAAS,OAAO,KACf,OAIF,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,QAAQ,WAAW,KAAG,UAenD,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,QAAQ,WAAW,KAAG,WAC9B,CAAC;AAE5B,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,eAAO,MAAM,cAAc,GACzB,KAAK,WAAW,EAChB,SAAS,MAAM,EACf,iBAAe,KACd,cAMD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,WAAW,MAAM,KAAG,MAIlD,CAAC;AAEF;6EAC6E;AAC7E,eAAO,MAAM,YAAY,GACvB,SAAS,WAAW,EACpB,OAAO,KAAK,EACZ,QAAQ,CAAC,GAAG,EAAE,WAAW,KAAK,WAAW,KACxC,OAAO,CAAC,WAAW,CAcrB,CAAC"}

package/dist/persistence.js

@@ -0,0 +1,86 @@
+import { VendoError, canonicalJson, validateAppDocument, } from "@vendoai/core";
+/** Drain a cursor-paginated listing. A page that repeats its cursor (or drops
+ *  it) terminates the loop, so a misbehaving adapter cannot spin forever. */
+export const listAllRecords = async (records, query = {}) => {
+    const found = [];
+    let cursor;
+    do {
+        const page = await records.list(cursor === undefined ? query : { ...query, cursor });
+        found.push(...page.records);
+        if (page.cursor === undefined || page.cursor === cursor)
+            break;
+        cursor = page.cursor;
+    } while (cursor !== undefined);
+    return found;
+};
+export const validateDocument = (input, appId) => {
+    const result = validateAppDocument(input);
+    if (!result.ok || result.app.id !== appId) {
+        const reason = result.ok
+            ? `document id ${result.app.id} does not match its app row`
+            : result.error.message;
+        throw new VendoError("validation", `invalid app document for ${appId}`, { appId, reason });
+    }
+    return structuredClone(result.app);
+};
+/** Trigger edits invalidate enable-time capture, cursor, and webhook state.
+ *  Canonical comparison — key order must not cause a spurious disarm. */
+export const enabledAfterDocumentEdit = (previous, next, enabled) => {
+    const canon = (trigger) => trigger === undefined ? "" : canonicalJson(trigger);
+    return canon(previous.trigger) === canon(next.trigger) && enabled;
+};
+export const rowFromRecord = (record) => {
+    const data = record.data;
+    if (data === null || typeof data !== "object"
+        || typeof data.subject !== "string"
+        || typeof data.enabled !== "boolean"
+        || data.doc === undefined) {
+        throw new VendoError("validation", `invalid app row for ${record.id}`, { appId: record.id });
+    }
+    return {
+        subject: data.subject,
+        enabled: data.enabled,
+        doc: validateDocument(data.doc, record.id),
+    };
+};
+export const documentFromRecord = (record) => rowFromRecord(record).doc;
+export const appRecordInput = (app, subject, enabled = false) => ({
+    id: app.id,
+    data: { subject, enabled, doc: validateDocument(app, app.id) },
+    // trigger_kind indexes apps by trigger kind for the automations tick/emit. The reserved
+    // vendo_apps store derives the same value from a column; a generic StoreAdapter keeps this.
+    refs: { subject, ...(app.trigger === undefined ? {} : { trigger_kind: app.trigger.on.kind }) },
+});
+/**
+ * Wave 7 — mint the next `machine.envStaleAt` marker, strictly greater than
+ * the previous one. Two grant flips in the same millisecond must never mint
+ * EQUAL markers: a wake that read the first would clear the second's marker
+ * after injecting the older env, losing the newer flip (e.g. a revocation).
+ * Marks serialize through the app row's CAS, so bumping past the previous
+ * marker is enough.
+ */
+export const nextEnvStaleAt = (previous) => {
+    const now = Date.now();
+    const floor = previous === undefined ? Number.NaN : Date.parse(previous);
+    return new Date(Number.isFinite(floor) && floor >= now ? floor + 1 : now).toISOString();
+};
+/** Bounded read-mutate-CAS on the app row; the store's revision receipt
+ *  arbitrates racers (adapters without atomic/revision fall back to put). */
+export const updateAppRow = async (records, appId, mutate) => {
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        const record = await records.get(appId);
+        if (record === null)
+            throw new VendoError("not-found", `app not found: ${appId}`, { appId });
+        const row = rowFromRecord(record);
+        const next = mutate(structuredClone(row.doc));
+        const input = appRecordInput(next, row.subject, row.enabled);
+        if (records.atomic === undefined || record.revision === undefined) {
+            await records.put(input);
+            return next;
+        }
+        if (await records.atomic.compareAndSwap(input, record.revision) !== null)
+            return next;
+    }
+    throw new VendoError("conflict", `app ${appId} was concurrently modified`, { appId });
+};
+//# sourceMappingURL=persistence.js.map

package/dist/persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.js","sourceRoot":"","sources":["../src/persistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,aAAa,EACb,mBAAmB,GAMpB,MAAM,eAAe,CAAC;AAEvB;6EAC6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAAoB,EACpB,QAAqC,EAAE,EACf,EAAE;IAC1B,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM;QAC/D,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAE,KAAY,EAAe,EAAE;IAC5E,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE;YACtB,CAAC,CAAC,eAAe,MAAM,CAAC,GAAG,CAAC,EAAE,6BAA6B;YAC3D,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,4BAA4B,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC,CAAC;AAYF;yEACyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,QAAqB,EACrB,IAAiB,EACjB,OAAgB,EACP,EAAE;IACX,MAAM,KAAK,GAAG,CAAC,OAA+B,EAAU,EAAE,CACxD,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAmB,EAAc,EAAE;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAkC,CAAC;IACvD,IACE,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;WACtC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;WAChC,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;WACjC,IAAI,CAAC,GAAG,KAAK,SAAS,EACzB,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,uBAAuB,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAmB,EAAe,EAAE,CACrE,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC;AAQ5B,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAgB,EAChB,OAAe,EACf,OAAO,GAAG,KAAK,EACC,EAAE,CAAC,CAAC;IACpB,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE;IAC9D,wFAAwF;IACxF,4FAA4F;IAC5F,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE;CAC/F,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAiB,EAAU,EAAE;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1F,CAAC,CAAC;AAEF;6EAC6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAAoB,EACpB,KAAY,EACZ,MAAyC,EACnB,EAAE;IACxB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,kBAAkB,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,OAAO,KAAK,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACxF,CAAC,CAAC"}