@yourrealm/sdk 0.0.0-alpha.1378.ce03c8dc

package/dist/chunk-O3UIK34B.js

@@ -0,0 +1,1430 @@
+import {
+  MANAGEMENT_NET,
+  REALM_LOGS_MOUNT,
+  REALM_STATS_MOUNT,
+  SPAWN_PLACEHOLDER,
+  homeProxyMount,
+  siloNetwork,
+  spawnMounts,
+  speculativeSilo
+} from "./chunk-VHTUSZUX.js";
+import {
+  __export
+} from "./chunk-MLKGABMK.js";
+
+// src/schema/host.ts
+var host_exports = {};
+__export(host_exports, {
+  HOST_DIRECTORY_BLOCKLIST: () => HOST_DIRECTORY_BLOCKLIST,
+  egress: () => egress,
+  gpu: () => gpu,
+  iptables: () => iptables,
+  isValidHostDirectoryPath: () => isValidHostDirectoryPath,
+  logs: () => logs,
+  management: () => management,
+  normalizeHostPath: () => normalizeHostPath,
+  pathsOverlap: () => pathsOverlap,
+  port: () => port,
+  rocketLaunch: () => rocketLaunch,
+  silo: () => silo,
+  siloRequiresUnmetMessage: () => siloRequiresUnmetMessage,
+  spawn: () => spawn,
+  stats: () => stats
+});
+import { z } from "zod";
+
+// src/factory.ts
+function defineMethod(target, name, fn) {
+  Object.defineProperty(target, name, {
+    value: fn,
+    enumerable: false,
+    writable: false,
+    configurable: true
+  });
+}
+function cloneAnd(source, patch) {
+  const c = Object.create(
+    Object.getPrototypeOf(source),
+    Object.getOwnPropertyDescriptors(source)
+  );
+  Object.assign(c, patch);
+  return c;
+}
+var makePermRecord = ((kind, schema) => {
+  return (input) => ({
+    kind,
+    data: schema.parse(input),
+    meta: {}
+  });
+});
+var makeInputRecord = (kind, schema) => {
+  return () => ({
+    kind,
+    schema,
+    meta: {}
+  });
+};
+function makeOptional(inner, ..._gate) {
+  return ((kind, schema) => {
+    const factory = inner(kind, schema);
+    return ((...args) => {
+      const innerRecord = factory(...args);
+      const seeded = cloneAnd(innerRecord, {
+        meta: { ...innerRecord.meta, isOptional: false }
+      });
+      defineMethod(seeded, "optional", function() {
+        return cloneAnd(this, { meta: { ...this.meta, isOptional: true } });
+      });
+      return seeded;
+    });
+  });
+}
+function makeDescribable(inner, ..._gate) {
+  return ((kind, schema) => {
+    const factory = inner(kind, schema);
+    return ((...args) => {
+      const record = factory(...args);
+      defineMethod(record, "describe", function(text) {
+        return cloneAnd(this, { meta: { ...this.meta, description: text } });
+      });
+      return record;
+    });
+  });
+}
+function makeReasonable(inner, ..._gate) {
+  return ((kind, schema) => {
+    const factory = inner(kind, schema);
+    return ((input) => {
+      const record = factory(input);
+      defineMethod(record, "reason", function(text) {
+        return cloneAnd(this, { meta: { ...this.meta, reason: text } });
+      });
+      return record;
+    });
+  });
+}
+function makeSchemable(inner, ..._gate) {
+  return ((kind, schema) => {
+    const factory = inner(kind, schema);
+    return ((input) => {
+      const record = factory(input);
+      defineMethod(record, "schema", function(s) {
+        const cloned = cloneAnd(this, {});
+        Object.defineProperty(cloned, "responseSchema", {
+          value: s,
+          enumerable: false,
+          writable: false,
+          configurable: true
+        });
+        return cloned;
+      });
+      return record;
+    });
+  });
+}
+function makeTitleable(inner, ..._gate) {
+  return ((kind, schema) => {
+    const factory = inner(kind, schema);
+    return (() => {
+      const record = factory();
+      defineMethod(record, "title", function(text) {
+        return cloneAnd(this, { meta: { ...this.meta, title: text } });
+      });
+      return record;
+    });
+  });
+}
+function makePrefillable(inner, ..._gate) {
+  return ((kind, schema) => {
+    const factory = inner(kind, schema);
+    return (() => {
+      const record = factory();
+      defineMethod(record, "prefill", function(value) {
+        return cloneAnd(this, { meta: { ...this.meta, prefill: value } });
+      });
+      return record;
+    });
+  });
+}
+function makePlaceholdable(inner, ..._gate) {
+  return ((kind, schema) => {
+    const factory = inner(kind, schema);
+    return (() => {
+      const record = factory();
+      defineMethod(record, "placeholder", function(text) {
+        return cloneAnd(this, { meta: { ...this.meta, placeholder: text } });
+      });
+      return record;
+    });
+  });
+}
+function makeNumericConstraints(inner) {
+  return ((kind, schema) => {
+    const factory = inner(kind, schema);
+    return (() => {
+      const record = factory();
+      defineMethod(record, "int", function() {
+        return cloneAnd(this, {
+          meta: { ...this.meta, int: true },
+          schema: this.schema.int()
+        });
+      });
+      defineMethod(record, "min", function(value) {
+        return cloneAnd(this, {
+          meta: { ...this.meta, min: value },
+          schema: this.schema.min(value)
+        });
+      });
+      defineMethod(record, "max", function(value) {
+        return cloneAnd(this, {
+          meta: { ...this.meta, max: value },
+          schema: this.schema.max(value)
+        });
+      });
+      return record;
+    });
+  });
+}
+var basePermission = makeOptional(makeDescribable(makeReasonable(makePermRecord)));
+var schemablePermission = makeSchemable(basePermission);
+var baseInput = makeOptional(
+  makeDescribable(makeTitleable(makePrefillable(makePlaceholdable(makeInputRecord))))
+);
+var numberInput = makeNumericConstraints(baseInput);
+
+// src/permission-meta.ts
+function scopeAllows(scope, appKind) {
+  return scope === "both" || scope === appKind;
+}
+var PERMISSION_META_TAG = /* @__PURE__ */ Symbol("realm.permission.meta");
+function tagPermissionMeta(target, kind, meta) {
+  Object.defineProperty(target, PERMISSION_META_TAG, {
+    value: { kind, meta },
+    enumerable: false
+  });
+  return target;
+}
+function isMetaTagged(value) {
+  return (typeof value === "function" || typeof value === "object" && value !== null) && PERMISSION_META_TAG in value;
+}
+function derivePermissionMeta(...modules) {
+  const out = {};
+  for (const mod of modules) {
+    for (const value of Object.values(mod)) {
+      if (isMetaTagged(value)) {
+        const tag = value[PERMISSION_META_TAG];
+        out[tag.kind] = tag.meta;
+      }
+    }
+  }
+  return out;
+}
+
+// src/host-registry.ts
+var HOST_KIND = /* @__PURE__ */ Symbol("realm.host.kind");
+var HOST_HOOKS = /* @__PURE__ */ Symbol("realm.host.hooks");
+function isHostable(value) {
+  return (typeof value === "function" || typeof value === "object" && value !== null) && HOST_KIND in value && HOST_HOOKS in value;
+}
+function tagHostable(target, kind, hooks, meta) {
+  Object.defineProperty(target, HOST_KIND, { value: kind, enumerable: false });
+  Object.defineProperty(target, HOST_HOOKS, { value: hooks, enumerable: false });
+  return tagPermissionMeta(target, kind, meta);
+}
+function makeHostable(inner) {
+  return (kind, schema, hooks, meta) => {
+    const factory = inner(kind, schema);
+    const enriched = {
+      ...hooks,
+      grantSchema: hooks.grantSchema ?? schema
+    };
+    return tagHostable(factory, kind, enriched, meta);
+  };
+}
+function deriveHostRegistry(mod) {
+  const reg = /* @__PURE__ */ new Map();
+  for (const value of Object.values(mod)) {
+    if (isHostable(value)) reg.set(value[HOST_KIND], value[HOST_HOOKS]);
+  }
+  return reg;
+}
+
+// src/errors.ts
+var RealmCompileError = class extends Error {
+  issues;
+  constructor(input) {
+    const list = Array.isArray(input) ? input : [input];
+    super(formatHeader(list));
+    this.issues = Object.freeze([...list]);
+    this.name = "RealmCompileError";
+  }
+};
+var SiloRequiresError = class extends RealmCompileError {
+};
+function formatHeader(issues) {
+  if (issues.length === 1) return formatIssue(issues[0]);
+  return `${issues.length} compile errors`;
+}
+function formatIssue(issue) {
+  switch (issue.kind) {
+    case "eval":
+      return issue.message;
+    case "validation":
+      return `${issue.path.join(".")}: ${issue.message}`;
+    case "permission":
+      return `missing grant: ${issue.missing}`;
+  }
+}
+
+// src/schema/host.ts
+var hostable = makeHostable(basePermission);
+var MANAGEMENT_PLACEHOLDER = {
+  network: MANAGEMENT_NET,
+  baseDomain: "",
+  homeSlug: "",
+  workerId: "",
+  acmeDns: null
+};
+var HOST_DIRECTORY_BLOCKLIST = [
+  "/",
+  "/proc",
+  "/sys",
+  "/dev",
+  "/run",
+  "/var/run",
+  "/var/lib/docker",
+  "/etc",
+  "/root",
+  "/home",
+  "/opt/realm",
+  "/boot"
+];
+function normalizeHostPath(raw) {
+  if (!raw.startsWith("/")) return null;
+  const segments = [];
+  for (const segment of raw.split("/")) {
+    if (segment === "" || segment === ".") continue;
+    if (segment === "..") return null;
+    segments.push(segment);
+  }
+  return `/${segments.join("/")}`;
+}
+function pathsOverlap(a, b) {
+  if (a === b) return true;
+  const contains = (parent, child) => child.startsWith(parent === "/" ? "/" : `${parent}/`);
+  return contains(a, b) || contains(b, a);
+}
+function isValidHostDirectoryPath(raw) {
+  if (typeof raw !== "string") return false;
+  const normalized = normalizeHostPath(raw);
+  if (normalized === null) return false;
+  for (const blocked of HOST_DIRECTORY_BLOCKLIST) {
+    if (normalized === blocked) return false;
+    if (blocked === "/") continue;
+    if (normalized.startsWith(blocked + "/")) return false;
+  }
+  return true;
+}
+var gpu = hostable(
+  "host.gpu",
+  z.literal(true).default(true),
+  {
+    iterateUses: (svc) => svc.gpu === true ? [true] : [],
+    toValue: () => true
+  },
+  {
+    name: "GPU passthrough",
+    phrase: "GPU passthrough (/dev/dri)",
+    helpText: "This app gets access to your graphics card.",
+    icon: "GraphicsCardIcon",
+    appKinds: "both"
+  }
+);
+var port = hostable(
+  "host.port",
+  z.number().int().min(1).max(65535),
+  {
+    iterateUses: (svc) => (svc.hostPorts ?? []).map((hp) => hp.hostPort),
+    toValue: (data) => ({ port: data }),
+    // Admin-grant input arrives as a raw string from the form (we don't
+    // coerce in the UI so an empty input stays empty). Coerce here, then
+    // re-validate the int range.
+    grantSchema: z.coerce.number().int().min(1).max(65535)
+  },
+  {
+    name: "Port",
+    phrase: "bind a host port",
+    helpText: "This port will be reachable from the internet. You can change the port number before approving.",
+    icon: "PlugIcon",
+    appKinds: "both"
+  }
+);
+function siloRequiresUnmetMessage(siloName, unmet) {
+  const parts = unmet.map(
+    (u) => u.offeredPort === void 0 ? `doesn't offer "${u.name}" on port ${u.port}` : `offers "${u.name}" on ${u.offeredPort}, not ${u.port}`
+  );
+  return `Silo "${siloName}" ${parts.join("; ")}`;
+}
+var SILO_PLACEHOLDER = {};
+function resolveSilo({ grant, declared, path, ctx }) {
+  const fail = (message) => {
+    throw new RealmCompileError({ kind: "validation", path: path.split("."), message });
+  };
+  if (typeof grant !== "string") {
+    if (ctx.speculative) return speculativeSilo(declared);
+    fail("no Silo was picked for this permission");
+  }
+  const silo2 = ctx.silos.find((s) => s.id === grant);
+  if (!silo2) fail(`Silo "${grant}" no longer exists`);
+  if (ctx.worker.internalId !== void 0 && silo2.workerId !== ctx.worker.internalId) {
+    fail(`Silo "${silo2.name}" is on worker ${silo2.workerSlug}, so this app must run there too`);
+  }
+  const asked = declared;
+  const resolved = {};
+  if (asked.network !== void 0) {
+    resolved.network = siloNetwork(silo2.id);
+    if (asked.network !== true) {
+      const offered = ctx.siloDirectory(silo2.id);
+      const unmet = [];
+      for (const [name, port2] of Object.entries(asked.network)) {
+        const entry = offered.get(name);
+        if (entry === void 0) unmet.push({ name, port: port2 });
+        else if (entry.port !== port2) unmet.push({ name, port: port2, offeredPort: entry.port });
+      }
+      if (unmet.length > 0) {
+        throw new SiloRequiresError({
+          kind: "validation",
+          path: path.split("."),
+          message: siloRequiresUnmetMessage(silo2.name, unmet)
+        });
+      }
+      const services = {};
+      for (const [name, port2] of Object.entries(asked.network)) {
+        services[name] = { host: name, port: port2 };
+      }
+      resolved.services = services;
+    }
+  }
+  if (asked.volume !== void 0) {
+    resolved.volume = {
+      hostPath: silo2.hostPath,
+      containerPath: silo2.containerPath,
+      gid: silo2.gid,
+      // The author declared the mode and the operator approved it; a member
+      // that only asked to read gets a mount it cannot write through.
+      readOnly: asked.volume === "read",
+      backup: false
+    };
+  }
+  if (asked.apiKey !== void 0) {
+    resolved.apiKey = ctx.siloApiKeys.get(silo2.id);
+  }
+  return resolved;
+}
+var siloRequiresSchema = z.record(z.string(), z.number().int().min(1).max(65535));
+var siloGrantsSchema = z.object({
+  network: z.union([z.literal(true), siloRequiresSchema]).optional(),
+  volume: z.enum(["read", "readwrite"]).optional(),
+  apiKey: z.literal(true).optional()
+}).refine((g) => g.network !== void 0 || g.volume !== void 0 || g.apiKey !== void 0, {
+  message: "silo() needs at least one of network, volume, apiKey"
+});
+var siloFactory = hostable(
+  "host.silo",
+  siloGrantsSchema,
+  {
+    // The elevated use is the communal volume: a mount carrying a gid reads
+    // (or writes) another trust domain's bytes and joins its group. All three
+    // of hostPath, gid and writability have to match a Silo the operator bound
+    // this app to - a hand-written gid, a Silo path without the join, or a
+    // writable mount from an app that only asked to read, all fail the gate.
+    // Network membership and the apiKey have no per-service use; they fall out
+    // of the grant being in place.
+    iterateUses: function* (svc) {
+      for (const v of svc.volumes ?? []) {
+        if (v.gid !== void 0) {
+          yield { hostPath: v.hostPath, gid: v.gid, readOnly: v.readOnly === true };
+        }
+      }
+    },
+    // Type-level only. The grant carries a Silo id, which means nothing
+    // without the Silo record, so every real value comes from `resolve`
+    // below; this exists so `ValueOf` can read the resolved shape.
+    toValue: () => SILO_PLACEHOLDER,
+    resolve: resolveSilo,
+    // The author declares which affordances they want; the grant carries
+    // which Silo the operator bound (its id).
+    grantSchema: z.string().min(1)
+  },
+  {
+    name: "Silo",
+    phrase: "join a Silo",
+    helpText: "This app joins a Silo you pick - an operator-owned network, shared directory, and shared credential. Everything in a Silo can see everything else in it, so only put apps together that you mean to share.",
+    icon: "StackIcon",
+    // Single-only: a Silo is a directory on one box, so the grant means
+    // nothing spread across a fleet.
+    appKinds: "single"
+  }
+);
+var silo = siloFactory;
+var management = hostable(
+  "host.management",
+  z.literal(true).default(true),
+  {
+    // The "use" of management is implicit — joining the network and
+    // reading the URL pieces falls out of the grant being in place;
+    // nothing in the resolved service spec distinguishes a user from a
+    // non-user.
+    iterateUses: () => [],
+    // Type-level only. The network is the SDK-side constant, but every other
+    // field is Home's, so the real value comes from `resolve`.
+    toValue: () => MANAGEMENT_PLACEHOLDER,
+    resolve: ({ ctx }) => ({
+      network: MANAGEMENT_NET,
+      baseDomain: ctx.home.baseDomain,
+      homeSlug: ctx.home.homeSlug,
+      workerId: ctx.worker.id,
+      // acme-dns username is the domain slug = the first label of baseDomain.
+      acmeDns: ctx.home.acmeDns ? {
+        serverUrl: ctx.home.acmeDns.serverUrl,
+        username: ctx.home.baseDomain.split(".")[0] ?? "",
+        apiKey: ctx.home.acmeDns.apiKey,
+        ca: ctx.home.acmeDns.ca,
+        caRootPem: ctx.home.acmeDns.caRootPem
+      } : null
+    })
+  },
+  {
+    name: "Management bridge + Home identity",
+    phrase: "join the management bridge network and read Home identity",
+    helpText: "This grants access to the management bridge network and the Home's dashboard URL pieces.",
+    icon: "ShareNetworkIcon",
+    danger: true,
+    appKinds: "both"
+  }
+);
+var iptables = hostable(
+  "host.iptables",
+  z.literal(true).default(true),
+  {
+    iterateUses: (svc) => svc.iptables === true ? [true] : [],
+    toValue: () => true
+  },
+  {
+    name: "Host iptables",
+    phrase: "install host iptables and ip6tables rules",
+    helpText: "This app installs firewall rules on the host. Required for the firewall app to lock down which ports are reachable.",
+    icon: "ShieldIcon",
+    danger: true,
+    appKinds: "both"
+  }
+);
+var egress = hostable(
+  "host.egress",
+  z.literal(true).default(true),
+  {
+    iterateUses: () => [],
+    toValue: () => true
+  },
+  {
+    name: "Internet access",
+    phrase: "outbound internet access",
+    helpText: "Without this, the app can only communicate with other apps on your server. Granting this allows it to make outbound connections to the internet.",
+    icon: "GlobeIcon",
+    appKinds: "both"
+  }
+);
+var rocketLaunch = hostable(
+  "host.rocketLaunch",
+  z.literal(true).default(true),
+  {
+    iterateUses: () => [],
+    toValue: () => true
+  },
+  {
+    name: "Rocket launch",
+    phrase: "launch a rocket",
+    helpText: "Permission with no worker that can satisfy it. Used to exercise the unsupported-permission UX.",
+    icon: "RocketLaunchIcon",
+    appKinds: "both"
+  }
+);
+var logs = hostable(
+  "host.logs",
+  z.literal(true).default(true),
+  {
+    // The "use" of host.logs is implicit — mounting the socket dir falls out
+    // of the grant being in place; the resolved hostPath is exempted from the
+    // absolute-mount check via `collectAllowed` in the Home eval graph. That
+    // exemption carries the read-only requirement with it, so an app that
+    // mounts the shared dir writable is rejected there.
+    iterateUses: () => [],
+    toValue: () => REALM_LOGS_MOUNT
+  },
+  {
+    name: "Container logs",
+    phrase: "stream container logs from every app",
+    helpText: "This app receives the stdout and stderr of every container running on this Worker. Useful for log forwarders and audit collectors.",
+    icon: "TerminalWindowIcon",
+    danger: true,
+    appKinds: "both"
+  }
+);
+var stats = hostable(
+  "host.stats",
+  z.literal(true).default(true),
+  {
+    // The "use" of host.stats is implicit — mounting the socket dir falls out
+    // of the grant being in place; the resolved hostPath is exempted from the
+    // absolute-mount check via `collectAllowed` in the Home eval graph. That
+    // exemption carries the read-only requirement with it, so an app that
+    // mounts the shared dir writable is rejected there.
+    iterateUses: () => [],
+    toValue: () => REALM_STATS_MOUNT
+  },
+  {
+    name: "Container stats",
+    phrase: "read resource usage for every app's containers",
+    helpText: "This app can sample the resource usage of every container running on this Worker, plus the host's own load, memory, and disks. Read-only: it can see your fleet, but can't touch it.",
+    icon: "PulseIcon",
+    danger: true,
+    appKinds: "both"
+  }
+);
+var spawn = hostable(
+  "host.spawn",
+  z.literal(true).default(true),
+  {
+    // The "use" of host.spawn is implicit — mounting the socket/scratch/
+    // artifacts dirs falls out of the grant being in place; the resolved
+    // paths are exempted from the absolute-mount gate via `collectAllowed`
+    // in the Home eval graph.
+    iterateUses: () => [],
+    // Type-level only; every real value comes from `resolve`, since all three
+    // paths are per-app and the grant carries only presence.
+    toValue: () => SPAWN_PLACEHOLDER,
+    // `socket` is the per-app DIRECTORY the app mounts (connect to
+    // `spawn.sock` inside); the wire carries the socket file inside it (the
+    // path the worker binds). scratch/artifacts are dir mounts.
+    resolve: ({ ctx }) => spawnMounts(ctx.appId)
+  },
+  {
+    name: "Spawn disposable containers",
+    phrase: "spawn disposable hardened containers on the worker",
+    helpText: "This app can start one-shot, fully-hardened containers on your server (e.g. to run builds). The worker forces the hardening, network, and lifecycle; the app never gets the Docker socket.",
+    icon: "CubeIcon",
+    danger: true,
+    appKinds: "both"
+  }
+);
+
+// src/schema/home.ts
+var home_exports = {};
+__export(home_exports, {
+  apiAccess: () => apiAccess,
+  publicDomain: () => publicDomain
+});
+import { z as z3 } from "zod";
+
+// src/home-registry.ts
+var HOME_KIND = /* @__PURE__ */ Symbol("realm.home.kind");
+var HOME_HOOKS = /* @__PURE__ */ Symbol("realm.home.hooks");
+function isHomeable(value) {
+  return (typeof value === "function" || typeof value === "object" && value !== null) && HOME_KIND in value && HOME_HOOKS in value;
+}
+function tagHomeable(target, kind, hooks, meta) {
+  Object.defineProperty(target, HOME_KIND, { value: kind, enumerable: false });
+  Object.defineProperty(target, HOME_HOOKS, { value: hooks, enumerable: false });
+  return tagPermissionMeta(target, kind, meta);
+}
+function makeHomeable(inner) {
+  return (kind, schema, hooks, meta) => {
+    const factory = inner(kind, schema);
+    const enriched = {
+      ...hooks,
+      grantSchema: hooks.grantSchema ?? schema
+    };
+    return tagHomeable(factory, kind, enriched, meta);
+  };
+}
+function deriveHomeRegistry(mod) {
+  const reg = /* @__PURE__ */ new Map();
+  for (const value of Object.values(mod)) {
+    if (isHomeable(value)) reg.set(value[HOME_KIND], value[HOME_HOOKS]);
+  }
+  return reg;
+}
+
+// src/schema/public-domain.ts
+import { z as z2 } from "zod";
+var LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+var HOSTNAME = new RegExp(`^${LABEL}(?:\\.${LABEL})+$`);
+function normalizeHost(host) {
+  return host.trim().replace(/\.$/, "").toLowerCase();
+}
+var publicDomainHostSchema = z2.string().transform(normalizeHost).refine((h) => h.length <= 253 && HOSTNAME.test(h), {
+  message: "must be a hostname of at least two labels using letters, digits and hyphens (e.g. photos.example.com)"
+});
+function dedupeHosts(hosts) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const host of hosts) {
+    if (seen.has(host)) continue;
+    seen.add(host);
+    out.push(host);
+  }
+  return out;
+}
+var publicDomainValueSchema = z2.object({
+  hosts: z2.array(publicDomainHostSchema).transform(dedupeHosts),
+  domainMode: z2.enum(["redirect", "all"])
+});
+
+// src/schema/home.ts
+var homeable = makeHomeable(basePermission);
+var HOME_API_ACCESS_SCOPES = ["builder", "whoami"];
+var HOME_API_PLACEHOLDER = {
+  socket: { ...homeProxyMount(""), hostPath: "" }
+};
+var apiAccess = homeable(
+  "home.apiAccess",
+  z3.array(z3.enum(HOME_API_ACCESS_SCOPES)).min(1),
+  {
+    // No elevated *use* to collect — mounting the socket falls out of the
+    // grant being in place; the resolved socket is exempted from the
+    // absolute-mount gate via `collectAllowed` in the Home eval graph.
+    iterateUses: () => [],
+    // Type-level only; every real value comes from `resolve`, since the
+    // socket is per-app and the grant carries only scopes.
+    toValue: () => HOME_API_PLACEHOLDER,
+    // The value the app mounts is the per-app DIRECTORY; the wire carries the
+    // socket file inside it (the path the worker binds).
+    resolve: ({ ctx }) => ({ socket: homeProxyMount(ctx.appId) })
+  },
+  {
+    name: "Home API access",
+    phrase: "call the Home control-plane API",
+    helpText: "This app can call your Home's control-plane API (over the worker) to use the capabilities you grant \u2014 e.g. pinning the images it builds. It holds no key; the worker proves which app it is.",
+    icon: "GearIcon",
+    danger: true,
+    // Single-only: a fleet-wide app holding a Home API socket on every
+    // box is a materially larger surface than one holding a single
+    // socket, and `builder` (the only scope with reach) is a singleton.
+    appKinds: "single"
+  }
+);
+var NO_PUBLIC_DOMAIN = { hosts: [], domainMode: "redirect" };
+var publicDomain = homeable(
+  "home.publicDomain",
+  // Empty author data. `z.literal(true)` rather than `z.void()` leaves the
+  // slot for `publicDomain({ wildcard: true })` without changing any call
+  // site: the author declares cardinality, the operator only ever chooses
+  // which domain.
+  z3.literal(true).default(true),
+  {
+    // Unlike the rest of `home.*` this kind has a real per-service use: the
+    // hosts a router actually serves on. `checkAppGrants` matches them against
+    // the granted set, so a packed bundle can't hand the VM a router carrying
+    // a host the operator never approved. Routers with no hosts emit nothing —
+    // there is no elevated thing being done.
+    iterateUses: function* (svc) {
+      const value = svc.router?.publicDomain;
+      if (value && value.hosts.length > 0) yield value;
+    },
+    // The grant holds the whole answer (the operator's hosts + their redirect
+    // choice), so there is no `resolve` hook — branding is all that separates
+    // stored data from the resolved value.
+    //
+    // Total on purpose: the speculative-eval paths build grants straight off
+    // the descriptors with an empty `grantValues` map, and this kind has no
+    // `perm.data` to fall back to, so throwing on `undefined` would drop the
+    // image cards off the install screen of every app that declares it.
+    toValue: (data) => data == null ? NO_PUBLIC_DOMAIN : { hosts: data.hosts, domainMode: data.domainMode },
+    // Descriptor data and grant data diverge, the `host.silo` shape: the
+    // author declares nothing but intent, the operator supplies the hosts.
+    // The default is what an enabled-but-untouched toggle stores, and it is
+    // the "no route" value rather than an error, because adding the domain
+    // later is a normal install-then-configure flow.
+    grantSchema: publicDomainValueSchema.default({ hosts: [], domainMode: "redirect" })
+  },
+  {
+    name: "Public domain",
+    phrase: "serve this app on a domain you own",
+    helpText: "This app is served on a hostname you supply, outside your Realm domain and without Home's login in front of it. Anyone who can reach the name reaches the app, so only grant it to an app whose own authentication you trust.",
+    icon: "GlobeIcon",
+    // Single-only: a hostname points at one box. Fanning the same name
+    // across every worker would have them all claim it.
+    appKinds: "single"
+  }
+);
+
+// src/schema/peer.ts
+var peer_exports = {};
+__export(peer_exports, {
+  backupVolumes: () => backupVolumes,
+  buildApps: () => buildApps,
+  hostPorts: () => hostPorts,
+  isNetworkStrategy: () => isNetworkStrategy,
+  isVolumeStrategy: () => isVolumeStrategy,
+  routedApps: () => routedApps
+});
+import { z as z4 } from "zod";
+
+// src/peer-registry.ts
+var PEER_KIND = /* @__PURE__ */ Symbol("realm.peer.kind");
+var PEER_HOOKS = /* @__PURE__ */ Symbol("realm.peer.hooks");
+function isPeerable(value) {
+  return (typeof value === "function" || typeof value === "object" && value !== null) && PEER_KIND in value && PEER_HOOKS in value;
+}
+function tagPeerable(target, kind, hooks, meta) {
+  Object.defineProperty(target, PEER_KIND, { value: kind, enumerable: false });
+  Object.defineProperty(target, PEER_HOOKS, { value: hooks, enumerable: false });
+  return tagPermissionMeta(target, kind, meta);
+}
+function makePeerable(inner) {
+  return (kind, schema, hooks, meta) => {
+    const factory = inner(kind, schema);
+    return tagPeerable(factory, kind, hooks, meta);
+  };
+}
+function derivePeerRegistry(mod) {
+  const reg = /* @__PURE__ */ new Map();
+  for (const value of Object.values(mod)) {
+    if (isPeerable(value)) reg.set(value[PEER_KIND], value[PEER_HOOKS]);
+  }
+  return reg;
+}
+
+// src/schema/peer.ts
+var peerable = makePeerable(basePermission);
+function isNetworkStrategy(s) {
+  return "network" in s;
+}
+function isVolumeStrategy(s) {
+  return !("network" in s);
+}
+function appNetwork(appId) {
+  return `realm_${appId}`;
+}
+function rewriteSelfDerivedToShared(value, providerAppId, serviceKey) {
+  if (value == null || typeof value !== "object") return value;
+  if (Array.isArray(value)) {
+    return value.map((v) => rewriteSelfDerivedToShared(v, providerAppId, serviceKey));
+  }
+  if ("__realmRef" in value) {
+    const inner = value.__realmRef;
+    return { __realmRef: rewriteMarker(inner, providerAppId, serviceKey) };
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    out[k] = rewriteSelfDerivedToShared(v, providerAppId, serviceKey);
+  }
+  return out;
+}
+function rewriteMarker(marker, providerAppId, serviceKey) {
+  if (marker == null || typeof marker !== "object") return marker;
+  const m = marker;
+  if (m.kind === "derived" && m.appId === "__self__" && typeof m.name === "string") {
+    return { kind: "shared", providerAppId, serviceKey, name: m.name };
+  }
+  if (m.kind === "concat" && Array.isArray(m.parts)) {
+    return {
+      kind: "concat",
+      parts: m.parts.map(
+        (p) => typeof p === "string" ? p : rewriteMarker(p, providerAppId, serviceKey)
+      )
+    };
+  }
+  return marker;
+}
+var routedApps = peerable(
+  "peers.routedApps",
+  z4.literal(true).default(true),
+  {
+    extract(appId, state) {
+      const services = [];
+      for (const [serviceId, svc] of Object.entries(state.services)) {
+        if (svc.router == null) continue;
+        const { publicDomain: publicDomain2, ...rest } = svc.router;
+        const hosts = publicDomain2?.hosts ?? [];
+        services.push({
+          serviceId,
+          router: {
+            ...rest,
+            domainMode: publicDomain2?.domainMode ?? "redirect",
+            // Key omitted entirely when the operator granted no hosts, so a
+            // downstream truthiness check can't see an empty array as "has a
+            // public domain".
+            ...hosts.length > 0 ? { publicDomain: [...hosts] } : {}
+          }
+        });
+      }
+      if (services.length === 0) return [];
+      const trustedHeaderKeys = state.trustedHeaders?.keys ?? [];
+      return [{ appId, network: appNetwork(appId), services, trustedHeaderKeys }];
+    },
+    resolve(entries) {
+      return [...entries].sort((a, b) => a.appId < b.appId ? -1 : a.appId > b.appId ? 1 : 0);
+    },
+    extractNetworks(entry) {
+      return entry.network;
+    },
+    producerPredicate(svc) {
+      return svc.router != null;
+    }
+  },
+  {
+    name: "Routed apps",
+    phrase: "join routed app networks",
+    helpText: "This app reads the list of all routed apps on this Worker and joins their networks to route traffic.",
+    icon: "ShareNetworkIcon",
+    danger: true,
+    // System-only: an aggregated view over every app on the worker.
+    // Widening later is additive where narrowing is not.
+    appKinds: "system"
+  }
+);
+var hostPorts = peerable(
+  "peers.hostPorts",
+  z4.literal(true).default(true),
+  {
+    extract(_appId, state) {
+      const out = [];
+      for (const svc of Object.values(state.services)) {
+        for (const hp of svc.hostPorts ?? []) out.push({ port: hp.hostPort });
+      }
+      return out;
+    },
+    resolve(entries) {
+      return entries;
+    }
+  },
+  {
+    name: "Host ports",
+    phrase: "read host port allocations",
+    helpText: "This app reads the list of all approved host ports across apps on this Worker.",
+    icon: "ShareNetworkIcon",
+    // System-only: same aggregated shape as routedApps.
+    appKinds: "system"
+  }
+);
+var backupVolumes = peerable(
+  "peers.backupVolumes",
+  z4.literal(true).default(true),
+  {
+    extract(appId, state) {
+      const out = [];
+      for (const [serviceKey, svc] of Object.entries(state.services)) {
+        for (const vol of svc.volumes ?? []) {
+          if (!vol.backup) continue;
+          const scopedPath = vol.hostPath.startsWith("./") ? `./apps/${appId}/${vol.hostPath.slice(2)}` : vol.hostPath;
+          const isNetwork = "url" in vol.backup;
+          const rewritten = rewriteSelfDerivedToShared(vol.backup, appId, serviceKey);
+          const strategy = isNetwork ? { ...rewritten, network: appNetwork(appId) } : rewritten;
+          out.push({
+            appId,
+            serviceKey,
+            hostPath: scopedPath,
+            strategy
+          });
+        }
+      }
+      return out;
+    },
+    resolve(entries) {
+      return entries;
+    },
+    extractNetworks(entry) {
+      return isNetworkStrategy(entry.strategy) ? entry.strategy.network : void 0;
+    },
+    extractPeerVolumes(entry) {
+      return isNetworkStrategy(entry.strategy) ? void 0 : entry.hostPath;
+    },
+    extractAllowedProvider(entry) {
+      return { appId: entry.appId, serviceKey: entry.serviceKey };
+    },
+    producerPredicate(svc) {
+      return svc.volumes?.some((v) => !!v.backup) ?? false;
+    }
+  },
+  {
+    name: "Backup volumes",
+    phrase: "mount peer volumes for backup",
+    helpText: "This app reads the list of all volumes with backup strategies and mounts them for snapshotting.",
+    icon: "ShareNetworkIcon",
+    danger: true,
+    // System-only: same aggregated shape as routedApps.
+    appKinds: "system"
+  }
+);
+var buildApps = peerable(
+  "peers.buildApps",
+  z4.literal(true).default(true),
+  // `extract` + `resolve` and NOTHING else, deliberately. Home unions this
+  // kind's entries across workers (`isBuildAppEntry` in peer-world.ts is the
+  // filter), which is only sound while an entry is inert data anywhere in the
+  // realm. Each of the four hooks omitted here would turn one into something
+  // that exists on exactly one box, leaving a consumer on another worker with a
+  // dangling reference:
+  //   - extractNetworks: a docker network on that box to join
+  //   - extractPeerVolumes: a host path on that box to mount
+  //   - extractAllowedProvider: a `shared` ref you may dereference
+  //   - producerPredicate: a depends_on edge, which also fails the worker's
+  //     dependsOn validation because a pinless build target is off the wire
+  // Adding any of the four gives up realm scope — peer-world.test.ts fails.
+  {
+    extract(appId, state) {
+      const out = [];
+      for (const [service, svc] of Object.entries(state.services)) {
+        if (svc.build != null && svc.image == null) {
+          out.push({ appId, service, recipe: svc.build });
+        }
+      }
+      return out;
+    },
+    resolve(entries) {
+      return entries;
+    }
+  },
+  {
+    name: "Build apps",
+    phrase: "read the recipes of build apps",
+    helpText: "This app reads the build recipe of every build-from-source service across every app in your Realm, on any Worker.",
+    icon: "ShareNetworkIcon",
+    danger: true,
+    // Single-only: the one consumer is forge, and the builder is a
+    // singleton — enforced on `home.apiAccess` by builderScopeIssue,
+    // not here. Aggregated like the three above; the restriction is
+    // about who reads it, not what it holds.
+    appKinds: "single"
+  }
+);
+
+// src/schema/remote.ts
+var remote_exports = {};
+__export(remote_exports, {
+  artifact: () => artifact,
+  fetchUrl: () => fetchUrl
+});
+import { z as z5 } from "zod";
+
+// src/remote-registry.ts
+function makeRemotable(inner) {
+  return (kind, schema, meta) => {
+    const factory = inner(kind, schema);
+    return tagPermissionMeta(factory, kind, meta);
+  };
+}
+
+// src/schema/remote.ts
+var remotable = makeRemotable(basePermission);
+var remotableSchemable = makeRemotable(schemablePermission);
+var fetchUrl = remotableSchemable(
+  "remote.fetchUrl",
+  z5.object({
+    url: z5.string(),
+    maxSizeMb: z5.number().positive().optional()
+  }),
+  {
+    name: "Fetch URL",
+    phrase: "fetch a remote URL",
+    helpText: "Home fetches this URL on behalf of the app and validates the response. The app itself never makes network requests.",
+    icon: "CloudArrowDownIcon",
+    appKinds: "both"
+  }
+);
+var artifact = remotable(
+  "remote.artifact",
+  z5.object({ url: z5.string(), digest: z5.string() }),
+  {
+    name: "Download artifact",
+    phrase: "download a remote artifact",
+    helpText: "Home downloads this file, verifies its SHA-256 hash, and caches it. The app gets the verified file at deploy time.",
+    icon: "CloudArrowDownIcon",
+    appKinds: "both"
+  }
+);
+
+// src/deep-merge.ts
+function deepMergeConfig(base, over) {
+  const out = { ...base };
+  for (const [k, v] of Object.entries(over)) {
+    const current = out[k];
+    if (isPlainMergeableObject(v) && isPlainMergeableObject(current)) {
+      out[k] = deepMergeConfig(current, v);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+function isPlainMergeableObject(v) {
+  return v != null && typeof v === "object" && !Array.isArray(v) && !("__realmRef" in v);
+}
+
+// src/security.ts
+import { z as z6 } from "zod";
+
+// src/grants.ts
+var HOST_REGISTRY = deriveHostRegistry(host_exports);
+function hostHooks(kind) {
+  return HOST_REGISTRY.get(kind);
+}
+var HOME_REGISTRY = deriveHomeRegistry(home_exports);
+function homeHooks(kind) {
+  return HOME_REGISTRY.get(kind);
+}
+function dataMatches(grantData, useData) {
+  return JSON.stringify(grantData) === JSON.stringify(useData);
+}
+function isHostGrant(g) {
+  return g.kind.startsWith("host.");
+}
+function isHomeGrant(g) {
+  return g.kind.startsWith("home.");
+}
+function toValue(grant) {
+  if (isHomeGrant(grant)) {
+    const hooks2 = HOME_REGISTRY.get(grant.kind);
+    if (!hooks2) return void 0;
+    return hooks2.toValue(grant.data);
+  }
+  if (!isHostGrant(grant)) return void 0;
+  const hooks = HOST_REGISTRY.get(grant.kind);
+  if (!hooks) return void 0;
+  return hooks.toValue(grant.data);
+}
+function resolveValue(grant, args) {
+  if (isHostGrant(grant)) return viaHooks(HOST_REGISTRY.get(grant.kind), grant.data, args);
+  if (isHomeGrant(grant)) return viaHooks(HOME_REGISTRY.get(grant.kind), grant.data, args);
+  return toValue(grant);
+}
+function viaHooks(hooks, data, args) {
+  if (!hooks) return void 0;
+  return hooks.resolve ? hooks.resolve({ grant: data, ...args }) : hooks.toValue(data);
+}
+function collectUses(svc) {
+  const uses = [];
+  for (const [kind, hooks] of HOST_REGISTRY) {
+    for (const data of hooks.iterateUses(svc)) {
+      uses.push({ kind, data });
+    }
+  }
+  for (const [kind, hooks] of HOME_REGISTRY) {
+    for (const data of hooks.iterateUses(svc)) {
+      uses.push({ kind, data });
+    }
+  }
+  return uses;
+}
+
+// src/permissions.ts
+var PERMISSION_META = derivePermissionMeta(
+  host_exports,
+  peer_exports,
+  remote_exports,
+  home_exports
+);
+var PERMISSION_KINDS = Object.keys(
+  PERMISSION_META
+).sort();
+var HOST_PERMISSION_KINDS = Object.keys(
+  derivePermissionMeta(host_exports)
+).sort();
+var WORKER_CAPABILITIES = [
+  ...HOST_PERMISSION_KINDS,
+  "host.volumes"
+].sort();
+function permissionAllowsAppKind(kind, appKind) {
+  const meta = PERMISSION_META[kind];
+  return meta ? scopeAllows(meta.appKinds, appKind) : true;
+}
+
+// src/security.ts
+var rawGrantSchema = z6.object({
+  kind: z6.string(),
+  data: z6.unknown().optional()
+});
+var grantsSchema = z6.record(z6.string(), rawGrantSchema);
+function validateGrantData(grant) {
+  if (isHostGrant(grant)) {
+    const hooks = hostHooks(grant.kind);
+    if (!hooks?.grantSchema) {
+      return { ok: false, reason: `unknown host permission kind: ${grant.kind}` };
+    }
+    const r = hooks.grantSchema.safeParse(grant.data);
+    if (!r.success) {
+      const reason = r.error.issues.map((i) => i.message).join("; ");
+      return { ok: false, reason };
+    }
+    return { ok: true, grant: { kind: grant.kind, data: r.data } };
+  }
+  if (isHomeGrant(grant)) {
+    const hooks = homeHooks(grant.kind);
+    if (!hooks?.grantSchema) {
+      return { ok: false, reason: `unknown home permission kind: ${grant.kind}` };
+    }
+    const r = hooks.grantSchema.safeParse(grant.data);
+    if (!r.success) {
+      const reason = r.error.issues.map((i) => i.message).join("; ");
+      return { ok: false, reason };
+    }
+    return { ok: true, grant: { kind: grant.kind, data: r.data } };
+  }
+  if (grant.kind.startsWith("peers.") || grant.kind.startsWith("remote.")) {
+    return { ok: true, grant: { kind: grant.kind } };
+  }
+  return { ok: false, reason: `unknown permission kind: ${grant.kind}` };
+}
+function sanitizeGrants(permsFlat, grants) {
+  if (!grants) return { sanitized: {}, rejected: [], pruned: [] };
+  const sanitized = {};
+  const rejected = [];
+  const pruned = [];
+  for (const [path, grant] of Object.entries(grants)) {
+    const perm = permsFlat[path];
+    if (!perm) {
+      pruned.push({ path, kind: grant.kind, reason: "no declared permission at this path" });
+      continue;
+    }
+    if (grant.kind !== perm.kind) {
+      pruned.push({
+        path,
+        kind: grant.kind,
+        reason: `kind ${grant.kind} does not match declared ${perm.kind}`
+      });
+      continue;
+    }
+    const result = validateGrantData(grant);
+    if (!result.ok) {
+      rejected.push({ path, kind: grant.kind, reason: result.reason });
+      continue;
+    }
+    sanitized[path] = result.grant;
+  }
+  return { sanitized, rejected, pruned };
+}
+function siloMountKey(hostPath, gid) {
+  return `${hostPath}\0${gid}`;
+}
+function checkAppGrants(state, grants, permsFlat, options) {
+  const violations = [];
+  const declarationsByKind = /* @__PURE__ */ new Map();
+  for (const [path, perm] of Object.entries(permsFlat)) {
+    const list = declarationsByKind.get(perm.kind) ?? [];
+    list.push([path, perm]);
+    declarationsByKind.set(perm.kind, list);
+  }
+  for (const [serviceName, svc] of Object.entries(state.services)) {
+    for (const v of svc.volumes ?? []) {
+      const grantedBy = options?.readOnlyHostPaths?.get(v.hostPath);
+      if (grantedBy === void 0) continue;
+      if (v.readOnly === true) continue;
+      violations.push({
+        kind: "grant",
+        permissionKind: grantedBy,
+        serviceName,
+        use: v.hostPath,
+        description: "write to a directory the grant only covers read-only"
+      });
+    }
+    for (const v of svc.volumes ?? []) {
+      const hostPath = v.hostPath;
+      if (hostPath.startsWith("./")) continue;
+      if (v.gid !== void 0) continue;
+      if (options?.allowedAbsoluteHostPaths?.has(hostPath)) continue;
+      violations.push({
+        kind: "grant",
+        permissionKind: "host.mount",
+        serviceName,
+        use: hostPath,
+        description: "mount an absolute host path"
+      });
+    }
+    for (const use of collectUses(svc)) {
+      if (use.kind === "host.silo") {
+        const { hostPath, gid } = use.data;
+        if (options?.allowedSiloMounts?.has(siloMountKey(hostPath, gid))) continue;
+        violations.push({
+          kind: "grant",
+          permissionKind: use.kind,
+          serviceName,
+          use: use.data,
+          description: PERMISSION_META["host.silo"].phrase
+        });
+        continue;
+      }
+      if (use.kind === "home.publicDomain") {
+        const { hosts, domainMode } = use.data;
+        const declarations2 = declarationsByKind.get(use.kind) ?? [];
+        const matched2 = declarations2.some(([path]) => {
+          const grant = grants[path];
+          if (grant == null || !isHomeGrant(grant) || grant.kind !== use.kind) return false;
+          const data = grant.data;
+          if (data.domainMode !== domainMode) return false;
+          const granted = new Set(data.hosts ?? []);
+          return hosts.every((h) => granted.has(h));
+        });
+        if (!matched2) {
+          violations.push({
+            kind: "grant",
+            permissionKind: use.kind,
+            serviceName,
+            use: use.data,
+            description: PERMISSION_META["home.publicDomain"].phrase
+          });
+        }
+        continue;
+      }
+      const declarations = declarationsByKind.get(use.kind) ?? [];
+      const matched = declarations.some(([path]) => {
+        const grant = grants[path];
+        return grant != null && isHostGrant(grant) && grant.kind === use.kind && dataMatches(grant.data, use.data);
+      });
+      if (!matched) {
+        violations.push({
+          kind: "grant",
+          permissionKind: use.kind,
+          serviceName,
+          use: use.data,
+          description: PERMISSION_META[use.kind]?.phrase ?? use.kind
+        });
+      }
+    }
+    for (const net of svc.joinNetworks ?? []) {
+      if (!options?.allowedNetworks?.has(net)) {
+        violations.push({
+          kind: "grant",
+          permissionKind: "network.join",
+          serviceName,
+          use: [net],
+          description: "join network"
+        });
+      }
+    }
+  }
+  if (state.egress === true) {
+    const declarations = declarationsByKind.get("host.egress") ?? [];
+    const matched = declarations.some(([path]) => {
+      const grant = grants[path];
+      return grant != null && isHostGrant(grant) && grant.kind === "host.egress";
+    });
+    if (!matched) {
+      violations.push({
+        kind: "grant",
+        permissionKind: "host.egress",
+        use: true,
+        description: PERMISSION_META["host.egress"]?.phrase ?? "host.egress"
+      });
+    }
+  }
+  return violations;
+}
+function checkSystemAppRoutes(state) {
+  const violations = [];
+  for (const [serviceName, svc] of Object.entries(state.services)) {
+    if (svc.router != null) {
+      violations.push({
+        kind: "app-kind",
+        appKind: "system",
+        description: `service "${serviceName}" declares a router \u2014 routes are not allowed on a system app`
+      });
+    }
+  }
+  if (state.trustedHeaders != null) {
+    violations.push({
+      kind: "app-kind",
+      appKind: "system",
+      // Not a routing argument: brokered identity also reaches a container
+      // through a page or widget loader, and a system app has those. It is a
+      // consent argument - a system app is seeded by the platform, with no
+      // operator install click to grant the disclosure.
+      description: "getTrustedHeaders is not supported on a system app \u2014 a system app is seeded by the platform, so no operator ever consented to it learning who is signed in"
+    });
+  }
+  if (state.hasAnonymousGate === true) {
+    violations.push({
+      kind: "app-kind",
+      appKind: "system",
+      description: "verifyAnonymousRequest is not supported on a system app \u2014 anonymous gates admit callers to an app's routes, and a system app has none"
+    });
+  }
+  return violations;
+}
+function checkPermissionAppKinds(appKind, permissionsFlat) {
+  const violations = [];
+  for (const [path, perm] of Object.entries(permissionsFlat)) {
+    if (permissionAllowsAppKind(perm.kind, appKind)) continue;
+    const phrase = PERMISSION_META[perm.kind]?.phrase;
+    const allowed = appKind === "single" ? "system" : "single";
+    const factory = allowed === "system" ? "createSystemApp" : "createApp";
+    violations.push({
+      kind: "app-kind",
+      appKind,
+      description: `"${path}" declares ${perm.kind}${phrase ? ` (${phrase})` : ""}, which only a ${allowed} app may declare \u2014 move the app to ${factory}, or drop the permission`
+    });
+  }
+  return violations;
+}
+
+// src/app-icon.ts
+import { z as z7 } from "zod";
+var PACK_REPOS = {
+  "dashboard-icons": "homarr-labs/dashboard-icons",
+  selfhst: "selfhst/icons"
+};
+var PACK_KEY_RE = /^[a-z0-9][a-z0-9._-]*$/;
+var URL_UNSAFE_RE = /[\s"'<>\\`]/;
+var FORM_MESSAGE = 'icon must be "dashboard-icons:<key>", "selfhst:<key>" or an https:// URL';
+function parseIcon(spec) {
+  for (const [prefix, repo] of Object.entries(PACK_REPOS)) {
+    if (!spec.startsWith(`${prefix}:`)) continue;
+    const key = spec.slice(prefix.length + 1);
+    if (!PACK_KEY_RE.test(key)) {
+      return {
+        error: `${prefix} key must be lowercase and match ${PACK_KEY_RE.source}`
+      };
+    }
+    return { url: `https://cdn.jsdelivr.net/gh/${repo}/svg/${key}.svg` };
+  }
+  if (spec.startsWith("https://")) {
+    const rest = spec.slice("https://".length);
+    if (rest === "") return { error: "https icon URL must have a host" };
+    if (URL_UNSAFE_RE.test(rest))
+      return { error: "https icon URL must not contain whitespace or quotes" };
+    return { url: spec };
+  }
+  return { error: FORM_MESSAGE };
+}
+var appIconSchema = z7.string().superRefine((spec, ctx) => {
+  const parsed = parseIcon(spec);
+  if ("error" in parsed) ctx.addIssue({ code: "custom", message: parsed.error });
+});
+
+export {
+  appIconSchema,
+  publicDomainValueSchema,
+  deepMergeConfig,
+  defineMethod,
+  cloneAnd,
+  baseInput,
+  numberInput,
+  RealmCompileError,
+  formatIssue,
+  host_exports,
+  home_exports,
+  isHostGrant,
+  isHomeGrant,
+  resolveValue,
+  derivePeerRegistry,
+  isNetworkStrategy,
+  isVolumeStrategy,
+  peer_exports,
+  remote_exports,
+  grantsSchema,
+  sanitizeGrants,
+  siloMountKey,
+  checkAppGrants,
+  checkSystemAppRoutes,
+  checkPermissionAppKinds
+};