apps 1.0.0-beta.0 → 1.0.0-beta.1

package/dist/authoring/index.js

@@ -10,17 +10,17 @@ import {
   service,
   setActiveRegistry,
   toolSpecOf
-} from "../index-8wmxmfhc.js";
+} from "../chunk-LWKQDDLZ.js";
 export {
-  toolSpecOf,
-  setActiveRegistry,
-  service,
-  secrets,
-  requirementSpecOf,
-  oauth,
-  newRegistry,
-  defineTool,
-  defineApp,
+  __enterFile,
   __leaveFile,
-  __enterFile
+  defineApp,
+  defineTool,
+  newRegistry,
+  oauth,
+  requirementSpecOf,
+  secrets,
+  service,
+  setActiveRegistry,
+  toolSpecOf
 };

package/dist/{index-mcjwntr2.js → chunk-B7NEUIJL.js}

@@ -1,13 +1,14 @@
 // src/manifest/contract.ts
 import { Data, Schema } from "effect";
 var JsonSchemaObject = Schema.Record(Schema.String, Schema.Json);
-
-class PublishError extends Data.TaggedError("PublishError") {
+var PublishError = class extends Data.TaggedError("PublishError") {
   get message() {
     return `publish failed:
-${this.problems.map((problem) => `  - ${problem}`).join(`
-`)}`;
+${this.problems.map((problem) => `  - ${problem}`).join("\n")}`;
   }
-}
+};
 
-export { JsonSchemaObject, PublishError };
+export {
+  JsonSchemaObject,
+  PublishError
+};

package/dist/chunk-J5AVXTHA.js

@@ -0,0 +1,154 @@
+import {
+  __enterFile,
+  __leaveFile,
+  newRegistry,
+  setActiveRegistry
+} from "./chunk-LWKQDDLZ.js";
+import {
+  JsonSchemaObject,
+  PublishError
+} from "./chunk-B7NEUIJL.js";
+import {
+  collectRegistry
+} from "./chunk-RZA7AXBK.js";
+
+// src/manifest/index.ts
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { Crypto, Effect, FileSystem, Schema, Semaphore } from "effect";
+var hasStandardJsonSchema = (input) => "~standard" in input && typeof input["~standard"].jsonSchema?.input === "function";
+var compileInputSchema = (input, where) => {
+  if ("~standard" in input) {
+    if (!hasStandardJsonSchema(input))
+      return {
+        problem: `${where}: input is a Standard Schema without the jsonSchema extension \u2014 use a library that implements it (zod 4+, effect Schema) or pass raw JSON schema`
+      };
+  }
+  try {
+    const compiled = strictify(
+      hasStandardJsonSchema(input) ? input["~standard"].jsonSchema.input({ target: "draft-2020-12" }) : structuredClone(input)
+    );
+    return { value: Schema.decodeUnknownSync(JsonSchemaObject)(compiled) };
+  } catch (error) {
+    return { problem: schemaPublishProblem(where, error) };
+  }
+};
+var schemaPublishProblem = (where, error) => `${where}: input schema could not compile to JSON schema (${error instanceof Error ? error.message : String(error)})`;
+var strictify = (node) => {
+  if (typeof node !== "object" || node === null) return node;
+  if (Array.isArray(node)) return node.map(strictify);
+  const object = { ...node };
+  if (object.type === "object" && object.additionalProperties === void 0)
+    object.additionalProperties = false;
+  for (const key of ["items", "anyOf", "oneOf", "allOf"])
+    if (key in object) object[key] = strictify(object[key]);
+  for (const key of ["properties", "$defs"])
+    if (object[key] !== void 0 && typeof object[key] === "object" && object[key] !== null)
+      object[key] = Object.fromEntries(
+        Object.entries(object[key]).map(([name, value]) => [
+          name,
+          strictify(value)
+        ])
+      );
+  return object;
+};
+var digestOf = (content) => Effect.gen(function* () {
+  const crypto = yield* Crypto.Crypto;
+  const bytes = yield* Effect.orDie(
+    crypto.digest("SHA-256", new TextEncoder().encode(content))
+  );
+  return Array.from(bytes.slice(0, 8), (byte) => byte.toString(16).padStart(2, "0")).join("");
+});
+var loadPermit = Semaphore.makeUnsafe(1);
+var runNonce = 0;
+var baseAppImports = /* @__PURE__ */ new Set();
+var moduleFailure = (where, error) => new PublishError({
+  problems: [
+    `${where}: failed to execute (${error instanceof Error ? error.message : String(error)})`
+  ]
+});
+var canonicalModuleUrl = (path, where) => Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const realPath = yield* fs.realPath(path).pipe(
+    Effect.mapError((error) => moduleFailure(where, error))
+  );
+  return pathToFileURL(realPath);
+});
+var importModule = (specifier, where) => Effect.tryPromise({
+  try: () => import(specifier).then(() => void 0),
+  catch: (error) => moduleFailure(where, error)
+});
+var recordModuleProblems = (registry, effect) => effect.pipe(
+  Effect.catchTag(
+    "PublishError",
+    (error) => Effect.sync(() => {
+      registry.problems.push(...error.problems.map((message) => ({ message })));
+    })
+  )
+);
+var executeModules = (appDir, files) => loadPermit.withPermit(
+  Effect.uninterruptibleMask(
+    (restore) => Effect.gen(function* () {
+      const registry = newRegistry();
+      const previous = yield* Effect.sync(() => setActiveRegistry(registry));
+      const nonce = yield* Effect.sync(() => ++runNonce);
+      const execute = Effect.gen(function* () {
+        __enterFile("app.ts");
+        yield* recordModuleProblems(
+          registry,
+          Effect.gen(function* () {
+            const appUrl = yield* canonicalModuleUrl(`${appDir}/app.ts`, "app.ts");
+            const baseUrl = appUrl.href;
+            const specifier = baseAppImports.has(baseUrl) ? `${fileURLToPath(appUrl)}?m=${nonce}` : baseUrl;
+            yield* importModule(specifier, "app.ts");
+            yield* Effect.sync(() => baseAppImports.add(baseUrl));
+          })
+        );
+        for (const file of files) {
+          const where = `tools/${file}`;
+          __enterFile(where);
+          yield* recordModuleProblems(
+            registry,
+            Effect.gen(function* () {
+              const url = yield* canonicalModuleUrl(`${appDir}/tools/${file}`, where);
+              yield* importModule(`${fileURLToPath(url)}?m=${nonce}`, where);
+            })
+          );
+        }
+      });
+      yield* restore(execute).pipe(
+        Effect.ensuring(
+          Effect.sync(() => {
+            __leaveFile();
+            setActiveRegistry(previous);
+          })
+        )
+      );
+      return registry;
+    })
+  )
+);
+var loadApp = (appDir) => Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const files = (yield* fs.readDirectory(`${appDir}/tools`).pipe(
+    Effect.mapError((error) => new PublishError({ problems: [`tools/: ${error.message}`] }))
+  )).filter((file) => file.endsWith(".ts")).sort();
+  const registry = yield* executeModules(appDir, files);
+  const collected = collectRegistry(registry, compileInputSchema);
+  if (collected.problems.length > 0)
+    return yield* new PublishError({ problems: collected.problems });
+  if (!("manifest" in collected))
+    return yield* Effect.die("validated registry projection unexpectedly missing");
+  return {
+    registry,
+    result: {
+      digest: `snap:${yield* digestOf(collected.canonical)}`,
+      ...collected.manifest
+    }
+  };
+});
+var manifest = (appDir) => Effect.map(loadApp(appDir), ({ result }) => result);
+
+export {
+  loadApp,
+  manifest
+};

package/dist/{index-8wmxmfhc.js → chunk-LWKQDDLZ.js}

@@ -4,12 +4,12 @@ var oauth = (opts) => ({ kind: "oauth", ...opts });
 var RequirementKey = Symbol.for("executor/apps/requirement");
 var DynamicKey = Symbol.for("executor/apps/dynamic");
 var newRegistry = () => ({
-  app: undefined,
-  services: new Map,
-  tools: new Map,
-  dynamic: new Map,
+  app: void 0,
+  services: /* @__PURE__ */ new Map(),
+  tools: /* @__PURE__ */ new Map(),
+  dynamic: /* @__PURE__ */ new Map(),
   problems: [],
-  toolFiles: new Map
+  toolFiles: /* @__PURE__ */ new Map()
 });
 var activeRegistry = newRegistry();
 var currentFile;
@@ -22,11 +22,10 @@ var __enterFile = (path) => {
   currentFile = path;
 };
 var __leaveFile = () => {
-  currentFile = undefined;
+  currentFile = void 0;
 };
 var sourceFileFor = (claim) => {
-  if (currentFile !== undefined)
-    return currentFile;
+  if (currentFile !== void 0) return currentFile;
   activeRegistry.problems.push({
     message: `${claim} called outside an authored module import`
   });
@@ -51,16 +50,14 @@ var service = (decl) => {
     activeRegistry.services.set(decl.origin, { decl, file });
   return value;
 };
-var isRequirement = (value) => typeof value === "object" && value !== null && (RequirementKey in value);
-var isService = (value) => isRequirement(value) && ("decl" in value) && ("optional" in value) && ("array" in value) && ("grant" in value);
-var requirementSpecOf = (value) => isService(value) || isRequirement(value) ? value[RequirementKey] : undefined;
+var isRequirement = (value) => typeof value === "object" && value !== null && RequirementKey in value;
+var isService = (value) => isRequirement(value) && "decl" in value && "optional" in value && "array" in value && "grant" in value;
+var requirementSpecOf = (value) => isService(value) || isRequirement(value) ? value[RequirementKey] : void 0;
 var defineApp = (manifest) => {
   const file = sourceFileFor("defineApp(...)");
   const value = { kind: "executor-app", ...manifest };
-  if (activeRegistry.app === undefined)
-    activeRegistry.app = value;
-  else
-    activeRegistry.problems.push({ message: `${file}: duplicate defineApp(...)` });
+  if (activeRegistry.app === void 0) activeRegistry.app = value;
+  else activeRegistry.problems.push({ message: `${file}: duplicate defineApp(...)` });
   return value;
 };
 var ToolKey = Symbol.for("executor/apps/tool");
@@ -73,18 +70,29 @@ var defineTool = (spec) => {
   const fileSummary = activeRegistry.toolFiles.get(file);
   activeRegistry.toolFiles.set(file, {
     definitions: (fileSummary?.definitions ?? 0) + 1,
-    hasUnnamedTool: fileSummary?.hasUnnamedTool === true || spec.name === undefined
+    hasUnnamedTool: fileSummary?.hasUnnamedTool === true || spec.name === void 0
   });
   const existing = activeRegistry.tools.get(name);
-  if (existing !== undefined) {
+  if (existing !== void 0) {
     activeRegistry.problems.push({
       message: `${file}: tool name '${name}' is already defined in ${existing.file}`
     });
-  } else
-    activeRegistry.tools.set(name, { spec, file });
+  } else activeRegistry.tools.set(name, { spec, file });
   return value;
 };
-var isTool = (value) => typeof value === "object" && value !== null && (ToolKey in value);
-var toolSpecOf = (value) => isTool(value) ? value[ToolKey] : undefined;
+var isTool = (value) => typeof value === "object" && value !== null && ToolKey in value;
+var toolSpecOf = (value) => isTool(value) ? value[ToolKey] : void 0;
 
-export { secrets, oauth, newRegistry, setActiveRegistry, __enterFile, __leaveFile, service, requirementSpecOf, defineApp, defineTool, toolSpecOf };
+export {
+  secrets,
+  oauth,
+  newRegistry,
+  setActiveRegistry,
+  __enterFile,
+  __leaveFile,
+  service,
+  requirementSpecOf,
+  defineApp,
+  defineTool,
+  toolSpecOf
+};

package/dist/{index-dh4z81es.js → chunk-NFLNA2SC.js}

@@ -1,10 +1,11 @@
 // src/runner/protocol.ts
 import { Data } from "effect";
-
-class CallError extends Data.TaggedError("CallError") {
+var CallError = class extends Data.TaggedError("CallError") {
   get message() {
     return `${this.target}: ${this.reason}`;
   }
-}
+};
 
-export { CallError };
+export {
+  CallError
+};

package/dist/chunk-RZA7AXBK.js

@@ -0,0 +1,107 @@
+// src/manifest/collect.ts
+var collectRegistry = (registry, compileInputSchema) => {
+  const requirementKey = Symbol.for("executor/apps/requirement");
+  const problems = registry.problems.map((problem) => problem.message);
+  const app = registry.app;
+  const requirementSpecOf = (value) => typeof value === "object" && value !== null && requirementKey in value ? value[requirementKey] : void 0;
+  const canonicalJson = (value) => {
+    const sortKeys = (node) => {
+      if (Array.isArray(node)) return node.map(sortKeys);
+      if (typeof node === "object" && node !== null)
+        return Object.fromEntries(
+          Object.entries(node).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => [key, sortKeys(child)])
+        );
+      return node;
+    };
+    return JSON.stringify(sortKeys(value));
+  };
+  const claims = /* @__PURE__ */ new Map();
+  for (const [origin, registered] of registry.services) {
+    if (registered.file !== "app.ts") continue;
+    const { decl } = registered;
+    claims.set(origin, {
+      origin,
+      reach: decl.reach ?? [],
+      params: decl.params ?? {},
+      auth: decl.auth ?? {}
+    });
+  }
+  const collectRequirement = (role, requirement, where) => {
+    const spec = requirementSpecOf(requirement);
+    if (spec === void 0) {
+      problems.push(`${where}: requirement '${role}' is not a service/requirement value`);
+      return void 0;
+    }
+    const origin = spec.service.origin;
+    if (!claims.has(origin))
+      problems.push(`${where}: requirement '${role}' names ${origin}, which app.ts does not declare`);
+    if (spec.grant !== void 0 && !(spec.grant in (spec.service.auth ?? {})))
+      problems.push(
+        `${where}: requirement '${role}' pins grant '${spec.grant}', not a auth method on ${origin}`
+      );
+    return {
+      role,
+      service: origin,
+      arity: spec.arity,
+      ...spec.grant === void 0 ? {} : { grant: spec.grant },
+      ...spec.description === void 0 ? {} : { description: spec.description }
+    };
+  };
+  if (app === void 0) problems.push("app.ts must call defineApp({...})");
+  else if (typeof app.description !== "string" || app.description.trim().length === 0)
+    problems.push("app.ts: app description must not be empty");
+  for (const [file, summary] of registry.toolFiles) {
+    if (summary.definitions > 1 && summary.hasUnnamedTool)
+      problems.push(`${file}: multi-tool files must name every tool`);
+  }
+  const tools = [];
+  if (app !== void 0) {
+    for (const [name, registered] of registry.tools) {
+      const { spec, file } = registered;
+      const address = `${app.key}/${name}`;
+      if (typeof spec.description !== "string" || spec.description.trim().length === 0)
+        problems.push(`${file}: tool '${name}' description must not be empty`);
+      const requires = Object.entries(spec.requirements ?? {}).flatMap(([role, requirement]) => {
+        const collected = collectRequirement(role, requirement, address);
+        return collected === void 0 ? [] : [collected];
+      }).sort((left, right) => left.role.localeCompare(right.role));
+      let compiled;
+      try {
+        compiled = compileInputSchema(spec.input, address);
+      } catch (error) {
+        compiled = {
+          problem: `${address}: input schema could not compile to JSON schema (${error instanceof Error ? error.message : String(error)})`
+        };
+      }
+      if ("problem" in compiled) {
+        problems.push(compiled.problem);
+        continue;
+      }
+      tools.push({
+        address,
+        name,
+        description: spec.description,
+        inputSchema: compiled.value,
+        annotations: spec.annotations ?? {},
+        requires,
+        file
+      });
+    }
+  }
+  if (problems.length > 0 || app === void 0) return { problems };
+  const services = [...claims.values()].sort(
+    (left, right) => left.origin.localeCompare(right.origin)
+  );
+  const sortedTools = [...tools].sort((left, right) => left.address.localeCompare(right.address));
+  const appResult = { key: app.key, label: app.label, description: app.description };
+  const manifest = { app: appResult, services, tools: sortedTools };
+  return {
+    problems: [],
+    manifest,
+    canonical: canonicalJson(manifest)
+  };
+};
+
+export {
+  collectRegistry
+};

package/dist/index.js

@@ -10,17 +10,17 @@ import {
   service,
   setActiveRegistry,
   toolSpecOf
-} from "./index-8wmxmfhc.js";
+} from "./chunk-LWKQDDLZ.js";
 export {
-  toolSpecOf,
-  setActiveRegistry,
-  service,
-  secrets,
-  requirementSpecOf,
-  oauth,
-  newRegistry,
-  defineTool,
-  defineApp,
+  __enterFile,
   __leaveFile,
-  __enterFile
+  defineApp,
+  defineTool,
+  newRegistry,
+  oauth,
+  requirementSpecOf,
+  secrets,
+  service,
+  setActiveRegistry,
+  toolSpecOf
 };

package/dist/manifest/contract.js

@@ -1,8 +1,8 @@
 import {
   JsonSchemaObject,
   PublishError
-} from "../index-mcjwntr2.js";
+} from "../chunk-B7NEUIJL.js";
 export {
-  PublishError,
-  JsonSchemaObject
+  JsonSchemaObject,
+  PublishError
 };

package/dist/manifest/index.js

@@ -1,15 +1,16 @@
 import {
   loadApp,
   manifest
-} from "../index-wfngzvv2.js";
-import"../index-8wmxmfhc.js";
+} from "../chunk-J5AVXTHA.js";
+import "../chunk-LWKQDDLZ.js";
 import {
   JsonSchemaObject,
   PublishError
-} from "../index-mcjwntr2.js";
+} from "../chunk-B7NEUIJL.js";
+import "../chunk-RZA7AXBK.js";
 export {
-  manifest,
-  loadApp,
+  JsonSchemaObject,
   PublishError,
-  JsonSchemaObject
+  loadApp,
+  manifest
 };

package/dist/runner/index.js

@@ -1,18 +1,21 @@
 import {
   loadApp
-} from "../index-wfngzvv2.js";
-import"../index-8wmxmfhc.js";
-import"../index-mcjwntr2.js";
+} from "../chunk-J5AVXTHA.js";
+import "../chunk-LWKQDDLZ.js";
+import "../chunk-B7NEUIJL.js";
 import {
   CallError
-} from "../index-dh4z81es.js";
+} from "../chunk-NFLNA2SC.js";
+import "../chunk-RZA7AXBK.js";
 
 // src/runner/index.ts
 import { Effect } from "effect";
-var hasStandardValidate = (input) => ("~standard" in input) && typeof input["~standard"].validate === "function";
+var hasStandardValidate = (input) => "~standard" in input && typeof input["~standard"].validate === "function";
 var parseInput = (name, spec, input) => {
   if (!hasStandardValidate(spec.input))
-    return Effect.fail(new CallError({ target: name, reason: "input schema does not implement Standard Schema validate" }));
+    return Effect.fail(
+      new CallError({ target: name, reason: "input schema does not implement Standard Schema validate" })
+    );
   const standard = spec.input["~standard"];
   return Effect.tryPromise({
     try: () => Promise.resolve(standard.validate(input)),
@@ -20,32 +23,49 @@ var parseInput = (name, spec, input) => {
       target: name,
       reason: `input validation threw (${error instanceof Error ? error.message : String(error)})`
     })
-  }).pipe(Effect.flatMap((result) => result.issues === undefined ? Effect.succeed(result.value) : Effect.fail(new CallError({
-    target: name,
-    reason: `invalid input (${result.issues.map((issue) => issue.message).join("; ")})`
-  }))));
+  }).pipe(
+    Effect.flatMap(
+      (result) => result.issues === void 0 ? Effect.succeed(result.value) : Effect.fail(
+        new CallError({
+          target: name,
+          reason: `invalid input (${result.issues.map((issue) => issue.message).join("; ")})`
+        })
+      )
+    )
+  );
 };
 var localRunner = (appDir) => {
   let cachedLoad;
   const loaded = () => Effect.suspend(() => {
-    if (cachedLoad !== undefined)
-      return cachedLoad;
-    return Effect.flatMap(Effect.cached(loadApp(appDir)), (effect) => Effect.sync(() => {
-      cachedLoad = effect;
-      return effect;
-    }).pipe(Effect.flatten));
+    if (cachedLoad !== void 0) return cachedLoad;
+    return Effect.flatMap(
+      Effect.cached(loadApp(appDir)),
+      (effect) => Effect.sync(() => {
+        cachedLoad = effect;
+        return effect;
+      }).pipe(Effect.flatten)
+    );
   });
-  const loadedFor = (target) => loaded().pipe(Effect.mapError((error) => new CallError({ target, reason: `app failed to load (${error.message})` })));
+  const loadedFor = (target) => loaded().pipe(
+    Effect.mapError(
+      (error) => new CallError({ target, reason: `app failed to load (${error.message})` })
+    )
+  );
   return {
     manifest: () => Effect.map(loaded(), ({ result }) => result),
     call: (name, input, ctx) => Effect.gen(function* () {
       const { registry } = yield* loadedFor(name);
       const registered = registry.tools.get(name);
-      if (registered === undefined)
+      if (registered === void 0)
         return yield* new CallError({ target: name, reason: "unknown tool" });
       const parsed = yield* parseInput(name, registered.spec, input);
       return yield* Effect.tryPromise({
-        try: () => registered.spec.handler(parsed, ctx),
+        // SAFETY: ToolSpec intentionally erases authored handler inputs to keep
+        // authoring generic-free; validation and ToolCtx establish this call boundary.
+        try: () => registered.spec.handler(
+          parsed,
+          ctx
+        ),
         catch: (error) => new CallError({
           target: name,
           reason: `handler failed (${error instanceof Error ? error.message : String(error)})`
@@ -56,6 +76,6 @@ var localRunner = (appDir) => {
   };
 };
 export {
-  localRunner,
-  CallError
+  CallError,
+  localRunner
 };

package/dist/runner/protocol.js

@@ -1,6 +1,6 @@
 import {
   CallError
-} from "../index-dh4z81es.js";
+} from "../chunk-NFLNA2SC.js";
 export {
   CallError
 };

package/dist/workerd/index.js

@@ -1,3 +1,6 @@
+import {
+  collectRegistry
+} from "../chunk-RZA7AXBK.js";
 export {
   collectRegistry
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apps",
-  "version": "1.0.0-beta.0",
+  "version": "1.0.0-beta.1",
   "description": "Author executor apps: declare services, auth, and tools in plain TypeScript; the executor platform runs, validates, and serves them.",
   "license": "MIT",
   "type": "module",
@@ -55,6 +55,7 @@
   },
   "devDependencies": {
     "@types/node": "22",
+    "esbuild": "0.25",
     "typescript": "5.9.3"
   }
-}
+}

package/dist/index-wfngzvv2.js

@@ -1,228 +0,0 @@
-import {
-  __enterFile,
-  __leaveFile,
-  newRegistry,
-  setActiveRegistry
-} from "./index-8wmxmfhc.js";
-import {
-  JsonSchemaObject,
-  PublishError
-} from "./index-mcjwntr2.js";
-
-// src/manifest/index.ts
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { Crypto, Effect, FileSystem, Schema, Semaphore } from "effect";
-
-// src/manifest/collect.ts
-var collectRegistry = (registry, compileInputSchema) => {
-  const requirementKey = Symbol.for("executor/apps/requirement");
-  const problems = registry.problems.map((problem) => problem.message);
-  const app = registry.app;
-  const requirementSpecOf = (value) => typeof value === "object" && value !== null && (requirementKey in value) ? value[requirementKey] : undefined;
-  const canonicalJson = (value) => {
-    const sortKeys = (node) => {
-      if (Array.isArray(node))
-        return node.map(sortKeys);
-      if (typeof node === "object" && node !== null)
-        return Object.fromEntries(Object.entries(node).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => [key, sortKeys(child)]));
-      return node;
-    };
-    return JSON.stringify(sortKeys(value));
-  };
-  const claims = new Map;
-  for (const [origin, registered] of registry.services) {
-    if (registered.file !== "app.ts")
-      continue;
-    const { decl } = registered;
-    claims.set(origin, {
-      origin,
-      reach: decl.reach ?? [],
-      params: decl.params ?? {},
-      auth: decl.auth ?? {}
-    });
-  }
-  const collectRequirement = (role, requirement, where) => {
-    const spec = requirementSpecOf(requirement);
-    if (spec === undefined) {
-      problems.push(`${where}: requirement '${role}' is not a service/requirement value`);
-      return;
-    }
-    const origin = spec.service.origin;
-    if (!claims.has(origin))
-      problems.push(`${where}: requirement '${role}' names ${origin}, which app.ts does not declare`);
-    if (spec.grant !== undefined && !(spec.grant in (spec.service.auth ?? {})))
-      problems.push(`${where}: requirement '${role}' pins grant '${spec.grant}', not a auth method on ${origin}`);
-    return {
-      role,
-      service: origin,
-      arity: spec.arity,
-      ...spec.grant === undefined ? {} : { grant: spec.grant },
-      ...spec.description === undefined ? {} : { description: spec.description }
-    };
-  };
-  if (app === undefined)
-    problems.push("app.ts must call defineApp({...})");
-  else if (typeof app.description !== "string" || app.description.trim().length === 0)
-    problems.push("app.ts: app description must not be empty");
-  for (const [file, summary] of registry.toolFiles) {
-    if (summary.definitions > 1 && summary.hasUnnamedTool)
-      problems.push(`${file}: multi-tool files must name every tool`);
-  }
-  const tools = [];
-  if (app !== undefined) {
-    for (const [name, registered] of registry.tools) {
-      const { spec, file } = registered;
-      const address = `${app.key}/${name}`;
-      if (typeof spec.description !== "string" || spec.description.trim().length === 0)
-        problems.push(`${file}: tool '${name}' description must not be empty`);
-      const requires = Object.entries(spec.requirements ?? {}).flatMap(([role, requirement]) => {
-        const collected = collectRequirement(role, requirement, address);
-        return collected === undefined ? [] : [collected];
-      }).sort((left, right) => left.role.localeCompare(right.role));
-      let compiled;
-      try {
-        compiled = compileInputSchema(spec.input, address);
-      } catch (error) {
-        compiled = {
-          problem: `${address}: input schema could not compile to JSON schema (${error instanceof Error ? error.message : String(error)})`
-        };
-      }
-      if ("problem" in compiled) {
-        problems.push(compiled.problem);
-        continue;
-      }
-      tools.push({
-        address,
-        name,
-        description: spec.description,
-        inputSchema: compiled.value,
-        annotations: spec.annotations ?? {},
-        requires,
-        file
-      });
-    }
-  }
-  if (problems.length > 0 || app === undefined)
-    return { problems };
-  const services = [...claims.values()].sort((left, right) => left.origin.localeCompare(right.origin));
-  const sortedTools = [...tools].sort((left, right) => left.address.localeCompare(right.address));
-  const appResult = { key: app.key, label: app.label, description: app.description };
-  const manifest = { app: appResult, services, tools: sortedTools };
-  return {
-    problems: [],
-    manifest,
-    canonical: canonicalJson(manifest)
-  };
-};
-
-// src/manifest/index.ts
-var hasStandardJsonSchema = (input) => ("~standard" in input) && typeof input["~standard"].jsonSchema?.input === "function";
-var compileInputSchema = (input, where) => {
-  if ("~standard" in input) {
-    if (!hasStandardJsonSchema(input))
-      return {
-        problem: `${where}: input is a Standard Schema without the jsonSchema extension — use a library that implements it (zod 4+, effect Schema) or pass raw JSON schema`
-      };
-  }
-  try {
-    const compiled = strictify(hasStandardJsonSchema(input) ? input["~standard"].jsonSchema.input({ target: "draft-2020-12" }) : structuredClone(input));
-    return { value: Schema.decodeUnknownSync(JsonSchemaObject)(compiled) };
-  } catch (error) {
-    return { problem: schemaPublishProblem(where, error) };
-  }
-};
-var schemaPublishProblem = (where, error) => `${where}: input schema could not compile to JSON schema (${error instanceof Error ? error.message : String(error)})`;
-var strictify = (node) => {
-  if (typeof node !== "object" || node === null)
-    return node;
-  if (Array.isArray(node))
-    return node.map(strictify);
-  const object = { ...node };
-  if (object.type === "object" && object.additionalProperties === undefined)
-    object.additionalProperties = false;
-  for (const key of ["items", "anyOf", "oneOf", "allOf"])
-    if (key in object)
-      object[key] = strictify(object[key]);
-  for (const key of ["properties", "$defs"])
-    if (object[key] !== undefined && typeof object[key] === "object" && object[key] !== null)
-      object[key] = Object.fromEntries(Object.entries(object[key]).map(([name, value]) => [
-        name,
-        strictify(value)
-      ]));
-  return object;
-};
-var digestOf = (content) => Effect.gen(function* () {
-  const crypto = yield* Crypto.Crypto;
-  const bytes = yield* Effect.orDie(crypto.digest("SHA-256", new TextEncoder().encode(content)));
-  return Array.from(bytes.slice(0, 8), (byte) => byte.toString(16).padStart(2, "0")).join("");
-});
-var loadPermit = Semaphore.makeUnsafe(1);
-var runNonce = 0;
-var baseAppImports = new Set;
-var moduleFailure = (where, error) => new PublishError({
-  problems: [
-    `${where}: failed to execute (${error instanceof Error ? error.message : String(error)})`
-  ]
-});
-var canonicalModuleUrl = (path, where) => Effect.gen(function* () {
-  const fs = yield* FileSystem.FileSystem;
-  const realPath = yield* fs.realPath(path).pipe(Effect.mapError((error) => moduleFailure(where, error)));
-  return pathToFileURL(realPath);
-});
-var importModule = (specifier, where) => Effect.tryPromise({
-  try: () => import(specifier).then(() => {
-    return;
-  }),
-  catch: (error) => moduleFailure(where, error)
-});
-var recordModuleProblems = (registry, effect) => effect.pipe(Effect.catchTag("PublishError", (error) => Effect.sync(() => {
-  registry.problems.push(...error.problems.map((message) => ({ message })));
-})));
-var executeModules = (appDir, files) => loadPermit.withPermit(Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
-  const registry = newRegistry();
-  const previous = yield* Effect.sync(() => setActiveRegistry(registry));
-  const nonce = yield* Effect.sync(() => ++runNonce);
-  const execute = Effect.gen(function* () {
-    __enterFile("app.ts");
-    yield* recordModuleProblems(registry, Effect.gen(function* () {
-      const appUrl = yield* canonicalModuleUrl(`${appDir}/app.ts`, "app.ts");
-      const baseUrl = appUrl.href;
-      const specifier = baseAppImports.has(baseUrl) ? `${fileURLToPath(appUrl)}?m=${nonce}` : baseUrl;
-      yield* importModule(specifier, "app.ts");
-      yield* Effect.sync(() => baseAppImports.add(baseUrl));
-    }));
-    for (const file of files) {
-      const where = `tools/${file}`;
-      __enterFile(where);
-      yield* recordModuleProblems(registry, Effect.gen(function* () {
-        const url = yield* canonicalModuleUrl(`${appDir}/tools/${file}`, where);
-        yield* importModule(`${fileURLToPath(url)}?m=${nonce}`, where);
-      }));
-    }
-  });
-  yield* restore(execute).pipe(Effect.ensuring(Effect.sync(() => {
-    __leaveFile();
-    setActiveRegistry(previous);
-  })));
-  return registry;
-})));
-var loadApp = (appDir) => Effect.gen(function* () {
-  const fs = yield* FileSystem.FileSystem;
-  const files = (yield* fs.readDirectory(`${appDir}/tools`).pipe(Effect.mapError((error) => new PublishError({ problems: [`tools/: ${error.message}`] })))).filter((file) => file.endsWith(".ts")).sort();
-  const registry = yield* executeModules(appDir, files);
-  const collected = collectRegistry(registry, compileInputSchema);
-  if (collected.problems.length > 0)
-    return yield* new PublishError({ problems: collected.problems });
-  if (!("manifest" in collected))
-    return yield* Effect.die("validated registry projection unexpectedly missing");
-  return {
-    registry,
-    result: {
-      digest: `snap:${yield* digestOf(collected.canonical)}`,
-      ...collected.manifest
-    }
-  };
-});
-var manifest = (appDir) => Effect.map(loadApp(appDir), ({ result }) => result);
-
-export { loadApp, manifest };