tands 0.2.0 → 0.3.0

package/dist/sdk/tands-sdk-server.js

@@ -1,5 +1,10 @@
 // ../sdk/src/protocol.ts
 var isHome = (context) => Boolean(context.home);
+function withReadOnly(context) {
+  const workspace = context.workspace;
+  if (!workspace || typeof workspace.readOnly === "boolean") return context;
+  return { ...context, workspace: { ...workspace, readOnly: false } };
+}
 
 // ../sdk/src/server.ts
 var TokenError = class extends Error {
@@ -58,7 +63,7 @@ async function verifyToken(token, {
     throw new TokenError("It has expired.");
   }
   return {
-    context: payload.ctx,
+    context: withReadOnly(payload.ctx),
     issuer: String(payload.iss),
     expiresAt: new Date(payload.exp * 1e3),
     action: typeof payload.act === "string" ? payload.act : null

package/dist/sdk/tands-sdk.js

@@ -43,6 +43,11 @@ function readAppMessage(data) {
   }
   return null;
 }
+function withReadOnly(context) {
+  const workspace = context.workspace;
+  if (!workspace || typeof workspace.readOnly === "boolean") return context;
+  return { ...context, workspace: { ...workspace, readOnly: false } };
+}
 function readHostMessage(data) {
   if (!isRecord(data) || data.tands !== PROTOCOL_VERSION) return null;
   const theme = data.theme === "dark" ? "dark" : "light";
@@ -51,7 +56,7 @@ function readHostMessage(data) {
       return isRecord(data.context) && typeof data.token === "string" && typeof data.expiresAt === "string" ? {
         tands: 1,
         type: "context",
-        context: data.context,
+        context: withReadOnly(data.context),
         token: data.token,
         expiresAt: data.expiresAt,
         theme
@@ -70,6 +75,8 @@ function readHostMessage(data) {
       } : null;
     case "theme":
       return { tands: 1, type: "theme", theme };
+    case "readOnly":
+      return typeof data.readOnly === "boolean" ? { tands: 1, type: "readOnly", readOnly: data.readOnly } : null;
     default:
       return null;
   }
@@ -97,6 +104,7 @@ function connect({ timeoutMs = 1e4, window: win = window } = {}) {
     let theme = "light";
     let counter = 0;
     const themeListeners = /* @__PURE__ */ new Set();
+    const readOnlyListeners = /* @__PURE__ */ new Set();
     const waiting = /* @__PURE__ */ new Map();
     let pending = null;
     const send = (message) => parent.postMessage(message, hostOrigin ?? "*");
@@ -141,6 +149,11 @@ function connect({ timeoutMs = 1e4, window: win = window } = {}) {
           waiter.reject(new WorkspaceError(message.message, message.code ?? null));
           return;
         }
+        case "readOnly":
+          if (!context || context.workspace.readOnly === message.readOnly) return;
+          context = { ...context, workspace: { ...context.workspace, readOnly: message.readOnly } };
+          for (const listener of readOnlyListeners) listener(message.readOnly);
+          return;
         case "theme":
           theme = message.theme;
           for (const listener of themeListeners) listener(theme);
@@ -159,6 +172,9 @@ function connect({ timeoutMs = 1e4, window: win = window } = {}) {
       get context() {
         return context;
       },
+      get readOnly() {
+        return context.workspace.readOnly;
+      },
       get theme() {
         return theme;
       },
@@ -215,6 +231,10 @@ function connect({ timeoutMs = 1e4, window: win = window } = {}) {
           }
         };
       },
+      onReadOnly(listener) {
+        readOnlyListeners.add(listener);
+        return () => readOnlyListeners.delete(listener);
+      },
       onTheme(listener) {
         themeListeners.add(listener);
         return () => themeListeners.delete(listener);

package/dist/tands.js

@@ -2580,8 +2580,8 @@ var Doc = class {
     const lines = content.split("\n").filter((x) => x);
     const minIndent = Math.min(...lines.map((x) => x.length - x.trimStart().length));
     const dedented = lines.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
-    for (const line of dedented) {
-      this.content.push(line);
+    for (const line2 of dedented) {
+      this.content.push(line2);
     }
   }
   compile() {
@@ -19814,7 +19814,20 @@ var AppActionSchema = external_exports.object({
   /** It changes something (the default): agents ask first. `false`: it only reads. */
   changes: external_exports.boolean().default(true),
   /** What it's given, checked like a record's fields. */
-  input: external_exports.record(DataNameSchema, AppFieldSchema).refine((fields) => Object.keys(fields).length <= 20, "An action takes at most 20 inputs.").default({})
+  input: external_exports.record(DataNameSchema, AppFieldSchema).refine((fields) => Object.keys(fields).length <= 20, "An action takes at most 20 inputs.").default({}),
+  /**
+   * Its view (decision 216): a page on the app's origin shown under the agent's
+   * answer, told what the action was asked and answered (MCP Apps). Only for
+   * actions that only read, for now.
+   */
+  view: external_exports.object({
+    url: external_exports.string().min(1).max(500),
+    /** What it's called above the page (default: the action's name). */
+    title: external_exports.string().trim().min(1).max(60).optional()
+  }).optional()
+}).refine((action) => !action.view || !action.changes, {
+  message: "Only an action that only reads (changes: false) can have a view, for now.",
+  path: ["view"]
 });
 var AppEventSchema = external_exports.object({
   /** What happened, for people choosing it in a trigger. */
@@ -19878,6 +19891,8 @@ var AppActionInfoSchema = external_exports.object({
   name: external_exports.string(),
   description: external_exports.string(),
   changes: external_exports.boolean(),
+  /** It shows its own view under the agent's answer (decision 216). */
+  view: external_exports.boolean().default(false),
   input: external_exports.array(
     external_exports.object({
       name: external_exports.string(),
@@ -19986,7 +20001,17 @@ var AppPreviewSchema = external_exports.object({
 var TabAppSchema = external_exports.object({ appId: external_exports.string(), tabId: external_exports.string() });
 var AppContextSchema = external_exports.object({
   user: external_exports.object({ id: external_exports.string(), name: external_exports.string() }),
-  workspace: external_exports.object({ id: external_exports.string(), slug: external_exports.string(), name: external_exports.string() }),
+  /**
+   * `readOnly` (decision 215): the workspace is read-only until its bill is
+   * paid, so the app's writes are refused; its page and server can say so.
+   * (False when a token from before it was told says nothing.)
+   */
+  workspace: external_exports.object({
+    id: external_exports.string(),
+    slug: external_exports.string(),
+    name: external_exports.string(),
+    readOnly: external_exports.boolean().default(false)
+  }),
   /**
    * `name` is the one the reader sees: General and My Space in their language,
    * a DM by its other people. Not imported from ./space, which imports this file.
@@ -20896,6 +20921,126 @@ var EmailDraftSchema = external_exports.object({
   error: external_exports.string().nullable()
 });
 
+// ../types/src/cards.ts
+var MAX_MESSAGE_CARDS = 8;
+var line = (max) => external_exports.string().trim().min(1).max(max);
+var optionalLine = (max) => external_exports.string().trim().max(max).optional();
+var link = external_exports.url({ protocol: /^https?$/, error: "An http(s) address." }).max(2e3);
+var when = external_exports.union([
+  external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/, "A date like 2030-01-08."),
+  external_exports.iso.datetime({ offset: true })
+]);
+var tone = external_exports.enum(["good", "warning", "bad", "neutral"]);
+var title = optionalLine(120);
+var EmailsCardSchema = external_exports.object({
+  type: external_exports.literal("emails"),
+  title,
+  items: external_exports.array(
+    external_exports.object({
+      from: line(120),
+      subject: external_exports.string().trim().max(200),
+      snippet: optionalLine(300),
+      at: when.optional(),
+      url: link.optional(),
+      unread: external_exports.boolean().optional(),
+      important: external_exports.boolean().optional(),
+      /** Why it matters, or what to do. */
+      note: optionalLine(240)
+    })
+  ).min(1).max(20)
+});
+var EventsCardSchema = external_exports.object({
+  type: external_exports.literal("events"),
+  title,
+  items: external_exports.array(
+    external_exports.object({
+      title: line(160),
+      start: when,
+      end: when.optional(),
+      where: optionalLine(160),
+      people: external_exports.array(line(80)).max(20).optional(),
+      url: link.optional(),
+      /** A video call's link. */
+      join: link.optional(),
+      /** The asker's answer to it. */
+      status: external_exports.enum(["accepted", "tentative", "declined", "needs_answer"]).optional(),
+      note: optionalLine(240)
+    })
+  ).min(1).max(20)
+});
+var MetricsCardSchema = external_exports.object({
+  type: external_exports.literal("metrics"),
+  title,
+  items: external_exports.array(
+    external_exports.object({
+      label: line(60),
+      value: line(40),
+      detail: optionalLine(80),
+      tone: tone.optional()
+    })
+  ).min(1).max(6)
+});
+var TableCardSchema = external_exports.object({
+  type: external_exports.literal("table"),
+  title,
+  columns: external_exports.array(line(60)).min(1).max(8),
+  rows: external_exports.array(external_exports.array(external_exports.union([external_exports.string().max(200), external_exports.number(), external_exports.null()])).max(8)).min(1).max(50)
+}).refine((card) => card.rows.every((row) => row.length === card.columns.length), {
+  error: "Every row needs one cell per column.",
+  path: ["rows"]
+});
+var ListCardSchema = external_exports.object({
+  type: external_exports.literal("list"),
+  title,
+  items: external_exports.array(
+    external_exports.object({
+      title: line(160),
+      detail: optionalLine(240),
+      /** On the side: a date, an amount, a status. */
+      meta: optionalLine(60),
+      url: link.optional(),
+      tone: tone.optional()
+    })
+  ).min(1).max(30)
+});
+var LinksCardSchema = external_exports.object({
+  type: external_exports.literal("links"),
+  title,
+  items: external_exports.array(external_exports.object({ label: line(120), url: link, detail: optionalLine(160) })).min(1).max(12)
+});
+var NoteCardSchema = external_exports.object({
+  type: external_exports.literal("note"),
+  tone: external_exports.enum(["info", "success", "warning", "danger"]).default("info"),
+  title,
+  text: line(600)
+});
+var BarsCardSchema = external_exports.object({
+  type: external_exports.literal("bars"),
+  title,
+  /** After each value: "h", "%", "€". */
+  unit: optionalLine(12),
+  items: external_exports.array(external_exports.object({ label: line(60), value: external_exports.number().finite().nonnegative() })).min(1).max(12)
+});
+var ActionsCardSchema = external_exports.object({
+  type: external_exports.literal("actions"),
+  items: external_exports.array(external_exports.object({ label: line(40), prompt: line(500) })).min(1).max(4)
+});
+var MessageCardSchema = external_exports.discriminatedUnion("type", [
+  EmailsCardSchema,
+  EventsCardSchema,
+  MetricsCardSchema,
+  TableCardSchema,
+  ListCardSchema,
+  LinksCardSchema,
+  NoteCardSchema,
+  BarsCardSchema,
+  ActionsCardSchema
+]);
+var MESSAGE_CARD_TYPES = MessageCardSchema.options.map(
+  (option) => option.shape.type.value
+);
+var MessageCardsSchema = external_exports.array(MessageCardSchema).max(MAX_MESSAGE_CARDS);
+
 // ../types/src/approvals.ts
 var ApprovalStatusSchema = external_exports.enum(["pending", "approved", "declined", "expired"]);
 var ApprovalSchema = external_exports.object({
@@ -20914,6 +21059,8 @@ var ApprovalSchema = external_exports.object({
   }).nullable(),
   /** The message, as proposed (or as approved, when edited). */
   body: external_exports.string(),
+  /** Cards posted with it (decision 211: a recurring task's results). */
+  cards: MessageCardsSchema.optional(),
   edited: external_exports.boolean(),
   /** Why, in the agent's words (optional); a workflow's step: what it asks. */
   reason: external_exports.string().nullable(),
@@ -21090,6 +21237,40 @@ var ChannelLoginSchema = external_exports.object({
   qr: external_exports.string().nullable()
 });
 
+// ../types/src/views.ts
+var MessageViewSchema = external_exports.object({
+  id: external_exports.string().regex(/^[a-f0-9]{24}$/),
+  /** Whose it is: a connector's (its page served by us, sandboxed), or an app's. */
+  source: external_exports.object({ kind: external_exports.enum(["connector", "app"]), id: external_exports.string(), name: external_exports.string() }),
+  /** The tool it shows (an app's: the action). */
+  tool: external_exports.string(),
+  /** An app's view: its page, on the app's origin (null: a connector's, served by us). */
+  url: external_exports.string().nullable().default(null),
+  title: external_exports.string().nullable(),
+  /** Its server asks for a border (true), none (false), or leaves it to us (null). */
+  border: external_exports.boolean().nullable()
+});
+var ViewToolResultSchema = external_exports.object({
+  content: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())),
+  structuredContent: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  isError: external_exports.boolean().optional()
+});
+var MessageViewDataSchema = external_exports.object({
+  tool: external_exports.object({
+    name: external_exports.string(),
+    title: external_exports.string().nullable(),
+    description: external_exports.string(),
+    inputSchema: external_exports.record(external_exports.string(), external_exports.unknown())
+  }),
+  input: external_exports.record(external_exports.string(), external_exports.unknown()),
+  result: ViewToolResultSchema
+});
+var ViewCallRequestSchema = external_exports.object({
+  name: external_exports.string().min(1).max(200),
+  arguments: external_exports.record(external_exports.string(), external_exports.unknown()).default({})
+});
+var ViewCallResponseSchema = external_exports.object({ result: ViewToolResultSchema });
+
 // ../types/src/message.ts
 var MAX_MESSAGE_LENGTH = 1e4;
 var MessageIdSchema = external_exports.string().regex(/^[a-f0-9]{24}$/, "Invalid message id");
@@ -21182,7 +21363,9 @@ var AgentToolSchema = external_exports.enum([
   // Connectors (M12 slice 2): a remote MCP server's tools the workspace chose (reading ones).
   "use_connector",
   // Notifications (decision 198): the asker's own Inbox, where only they read the answer.
-  "read_inbox"
+  "read_inbox",
+  // Cards (decision 211): mail, events, figures and rows shown under its answer.
+  "show_cards"
 ]);
 var AgentStepSchema = external_exports.object({
   tool: AgentToolSchema,
@@ -21237,6 +21420,10 @@ var MessageSchema = external_exports.object({
   proposal: TaskProposalSchema.optional(),
   /** Something an agent wants to do, waiting for a person's yes (M8 slice 6). */
   approval: ApprovalSchema.optional(),
+  /** What an agent's answer shows (decision 211): mail, events, figures, rows… */
+  cards: MessageCardsSchema.optional(),
+  /** Connectors' views in an agent's answer (MCP Apps, decision 213). */
+  views: external_exports.array(MessageViewSchema).optional(),
   /** Sent from a messaging app (M13): Telegram… */
   via: MessageViaSchema.optional()
 });
@@ -21588,6 +21775,10 @@ var AUDIT_ACTIONS = {
     "workspace.data_moved",
     "workspace.previous_data_deleted",
     "workspace.support_plan_changed",
+    "workspace.billing_contact_changed",
+    "workspace.card_saved",
+    "workspace.card_removed",
+    "workspace.statement_paid",
     "workspace.space_imported",
     "audit.exported",
     "audit.destination_added",
@@ -21722,6 +21913,10 @@ var AUDIT_ACTIONS = {
     "billing.stripe_connected",
     "billing.stripe_disconnected",
     "statement.changed",
+    "statement.extended",
+    "agreement.created",
+    "agreement.updated",
+    "agreement.deleted",
     "support.registered",
     "support.unregistered",
     "support.report_sent",
@@ -21781,6 +21976,7 @@ var AuditTargetSchema = external_exports.object({
     "workflow",
     "approval",
     "statement",
+    "agreement",
     "ticket",
     "help_request",
     "skill",
@@ -22220,6 +22416,297 @@ var ReadinessSchema = external_exports.object({
   checks: external_exports.array(ReadinessCheckSchema)
 });
 
+// ../types/src/billing.ts
+var COMMON_CURRENCIES = [
+  "USD",
+  "EUR",
+  "GBP",
+  "NGN",
+  "KES",
+  "GHS",
+  "ZAR",
+  "CAD",
+  "AUD",
+  "CHF",
+  "JPY",
+  "INR",
+  "BRL"
+];
+var CurrencySchema = external_exports.string().regex(/^[A-Z]{3}$/, "Use a three-letter currency code, like USD").refine((code) => knownCurrencies().has(code), "Unknown currency");
+var known = null;
+function knownCurrencies() {
+  known ??= new Set(
+    typeof Intl.supportedValuesOf === "function" ? Intl.supportedValuesOf("currency") : COMMON_CURRENCIES
+  );
+  return known;
+}
+var PriceSchema = external_exports.number().min(0, "Prices can't be negative").max(1e6).transform((value) => Math.round(value * 1e4) / 1e4);
+var priced = external_exports.object({ enabled: external_exports.boolean(), price: PriceSchema });
+var ModelPriceSchema = external_exports.object({
+  /** As agents name it: `provider/model`. */
+  model: external_exports.string().trim().min(3).max(200),
+  input: PriceSchema,
+  /** Input read from the prompt cache. */
+  cachedInput: PriceSchema,
+  /** Input written to the prompt cache. */
+  cacheWrite: PriceSchema,
+  output: PriceSchema
+});
+var BillingSettingsSchema = external_exports.object({
+  currency: CurrencySchema,
+  /** Per person who used the workspace in the month. */
+  seats: priced,
+  /** Per GB-month in the deployment's bucket. */
+  files: priced,
+  /** Per GB-month in the deployment's MongoDB. */
+  database: priced,
+  /** Model cost (from `models`) plus a markup, for runs on the deployment's Gateway. */
+  ai: external_exports.object({
+    enabled: external_exports.boolean(),
+    markupPercent: external_exports.number().min(0).max(1e3),
+    models: external_exports.array(ModelPriceSchema).max(100).refine(
+      (models) => new Set(models.map((m) => m.model)).size === models.length,
+      "Each model once"
+    )
+  }),
+  /** A flat amount per workspace per month (prorated from the day it was created). */
+  deploymentFee: priced,
+  /**
+   * A support plan per workspace per month, opt-in (decision 74): workspaces
+   * that turn it on pay it (prorated by day) and can ask the deployment for
+   * help. Absent in settings saved before it existed: off.
+   */
+  support: priced.default({ enabled: false, price: 0 }),
+  /**
+   * The deployment's Gateways (decision 151), per hour: a workspace's own
+   * ("Managed for you") while it's awake, or the deployment's shared one while
+   * the workspace is connected to it. Absent in older settings: off.
+   */
+  gatewayHours: priced.default({ enabled: false, price: 0 }),
+  /** A workspace's own Gateway's storage (its volume), per GB-month, asleep or awake. */
+  gatewayStorage: priced.default({ enabled: false, price: 0 }),
+  /**
+   * What happens when a statement isn't paid (decision 209): reminders always;
+   * with `readOnly`, the workspace becomes read-only `graceDays` after its
+   * due date, until it's paid. Absent in older settings: on, 30 days.
+   */
+  overdue: external_exports.object({ readOnly: external_exports.boolean(), graceDays: external_exports.number().int().min(1).max(365) }).default({ readOnly: true, graceDays: 30 })
+});
+var BILLING_METERS = [
+  "seats",
+  "files",
+  "database",
+  "ai",
+  "deploymentFee",
+  "support",
+  "gatewayHours",
+  "gatewayStorage"
+];
+var StripeConnectionSchema = external_exports.object({
+  connected: external_exports.boolean(),
+  /** Test keys create test invoices that nobody really pays. */
+  mode: external_exports.enum(["test", "live"]).nullable(),
+  /** The key's last four characters, to recognise it. */
+  keyHint: external_exports.string().nullable(),
+  connectedAt: external_exports.iso.datetime().nullable()
+});
+var ConnectStripeRequestSchema = external_exports.object({
+  secretKey: external_exports.string().trim().regex(
+    /^(sk|rk)_(test|live)_[A-Za-z0-9]{10,}$/,
+    "Use a Stripe secret key (sk_\u2026) or restricted key (rk_\u2026)"
+  )
+});
+var AdminBillingSchema = external_exports.object({
+  settings: BillingSettingsSchema,
+  /** Models agents have run on this deployment's Gateways, to price. */
+  modelsInUse: external_exports.array(external_exports.string()),
+  stripe: StripeConnectionSchema
+});
+var BillLineSchema = external_exports.object({
+  meter: external_exports.enum([...BILLING_METERS, "agreement"]),
+  /**
+   * billed: charged; notBilled: this deployment doesn't bill it;
+   * own: the workspace brings this resource itself; notChosen: an opt-in plan
+   * (support) the workspace doesn't have; included: its agreement covers it.
+   */
+  status: external_exports.enum(["billed", "notBilled", "own", "notChosen", "included"]),
+  /** People, GB-months, tokens, or the share of the month (deployment fee, support plan). */
+  quantity: external_exports.number().nonnegative(),
+  /** Price per unit; null for AI (priced per model). */
+  unitPrice: external_exports.number().nullable(),
+  amount: external_exports.number().nonnegative()
+});
+var WorkspaceBillSchema = external_exports.object({
+  currency: external_exports.string(),
+  lines: external_exports.array(BillLineSchema),
+  /** AI amount per model (null: the model has no price set). */
+  aiByModel: external_exports.array(external_exports.object({ model: external_exports.string(), amount: external_exports.number().nullable() })),
+  /** Models used but not priced: their tokens aren't charged. */
+  unpricedModels: external_exports.array(external_exports.string()),
+  total: external_exports.number().nonnegative(),
+  /** True for the current month: amounts grow until it ends. */
+  toDate: external_exports.boolean()
+});
+var StatementStatusSchema = external_exports.enum(["nothingDue", "due", "paid", "void"]);
+var StatementSchema = external_exports.object({
+  id: external_exports.string(),
+  workspaceId: external_exports.string(),
+  /**
+   * usage: a month's metered bill, after it ends; agreement: a period of an
+   * agreement's fixed price, at its start (decision 209).
+   */
+  kind: external_exports.enum(["usage", "agreement"]).default("usage"),
+  /** usage: the month; agreement: the period's first month. */
+  month: external_exports.string(),
+  /** An agreement's period: its first and last months (null for usage). */
+  period: external_exports.object({ from: external_exports.string(), to: external_exports.string() }).nullable().default(null),
+  currency: external_exports.string(),
+  lines: external_exports.array(BillLineSchema),
+  aiByModel: external_exports.array(external_exports.object({ model: external_exports.string(), amount: external_exports.number().nullable() })),
+  unpricedModels: external_exports.array(external_exports.string()),
+  total: external_exports.number().nonnegative(),
+  status: StatementStatusSchema,
+  createdAt: external_exports.iso.datetime(),
+  /** When it must be paid by (null: nothing due, or from before due dates were kept). */
+  dueAt: external_exports.iso.datetime().nullable().default(null),
+  paidAt: external_exports.iso.datetime().nullable(),
+  payment: external_exports.object({
+    /** stripe: an invoice on the deployment's Stripe; manual: settled outside the app. */
+    provider: external_exports.enum(["stripe", "manual"]),
+    invoiceNumber: external_exports.string().nullable(),
+    /** Stripe's page where the invoice can be paid. */
+    invoiceUrl: external_exports.url().nullable(),
+    /** Why the invoice couldn't be created yet (retried every hour). */
+    error: external_exports.string().nullable(),
+    /** Why the saved card couldn't pay it (it can still be paid on Stripe's page). */
+    chargeError: external_exports.string().nullable().default(null)
+  })
+});
+var WorkspaceStatementsSchema = external_exports.object({ statements: external_exports.array(StatementSchema) });
+var AdminStatementsSchema = external_exports.object({
+  month: external_exports.string(),
+  /** Months with statements, newest first. */
+  months: external_exports.array(external_exports.string()),
+  statements: external_exports.array(
+    StatementSchema.extend({
+      workspace: external_exports.object({ id: external_exports.string(), name: external_exports.string(), slug: external_exports.string() })
+    })
+  )
+});
+var AgreementPeriodSchema = external_exports.enum(["month", "year"]);
+var AgreementSchema = external_exports.object({
+  id: external_exports.string(),
+  workspaceId: external_exports.string(),
+  /** What it's called on invoices, like "Enterprise". */
+  name: external_exports.string(),
+  currency: external_exports.string(),
+  /** The fixed price per period. */
+  amount: external_exports.number().nonnegative(),
+  period: AgreementPeriodSchema,
+  startMonth: UsageMonthOf(),
+  /** Its last month, included; null: until it's ended. */
+  endMonth: UsageMonthOf().nullable(),
+  included: external_exports.array(external_exports.enum(BILLING_METERS)),
+  /** For the deployment's admins only (never shown to the workspace). */
+  note: external_exports.string(),
+  createdAt: external_exports.iso.datetime()
+});
+function UsageMonthOf() {
+  return external_exports.string().regex(/^\d{4}-(0[1-9]|1[0-2])$/, "Use a month like 2026-11");
+}
+var agreementFields = {
+  name: external_exports.string().trim().min(1, "Give it a name").max(80),
+  amount: PriceSchema.refine((amount) => amount > 0, "Use an amount above 0"),
+  period: AgreementPeriodSchema,
+  startMonth: UsageMonthOf(),
+  endMonth: UsageMonthOf().nullable(),
+  included: external_exports.array(external_exports.enum(BILLING_METERS)).max(BILLING_METERS.length).transform((meters) => [...new Set(meters)]),
+  note: external_exports.string().trim().max(2e3)
+};
+var endsAfterStart = (a) => !a.startMonth || !a.endMonth || a.endMonth >= a.startMonth;
+var CreateAgreementRequestSchema = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  ...agreementFields,
+  note: agreementFields.note.default("")
+}).refine(endsAfterStart, { message: "It can't end before it starts", path: ["endMonth"] });
+var UpdateAgreementRequestSchema = external_exports.object(agreementFields).partial().refine((patch) => Object.keys(patch).length > 0, "Nothing to change.").refine(endsAfterStart, { message: "It can't end before it starts", path: ["endMonth"] });
+var AdminAgreementsSchema = external_exports.object({
+  currency: external_exports.string(),
+  /** The current month (UTC): agreements start then or later. */
+  month: external_exports.string(),
+  agreements: external_exports.array(
+    AgreementSchema.extend({
+      workspace: external_exports.object({ id: external_exports.string(), name: external_exports.string(), slug: external_exports.string() })
+    })
+  ),
+  workspaces: external_exports.array(external_exports.object({ id: external_exports.string(), name: external_exports.string(), slug: external_exports.string() }))
+});
+var BillingContactSchema = external_exports.object({
+  /** The name on invoices: a company, or a person. */
+  name: external_exports.string().trim().max(120),
+  email: external_exports.union([external_exports.literal(""), external_exports.email()]),
+  address: external_exports.object({
+    line1: external_exports.string().trim().max(200),
+    line2: external_exports.string().trim().max(200),
+    city: external_exports.string().trim().max(100),
+    postalCode: external_exports.string().trim().max(20),
+    state: external_exports.string().trim().max(100),
+    /** ISO 3166-1 alpha-2, or empty. */
+    country: external_exports.union([
+      external_exports.literal(""),
+      external_exports.string().regex(/^[A-Z]{2}$/, "Use a two-letter country code")
+    ])
+  }),
+  /** A VAT or tax number, printed on invoices. */
+  taxId: external_exports.string().trim().max(50)
+});
+var SavedCardSchema = external_exports.object({
+  brand: external_exports.string(),
+  last4: external_exports.string(),
+  expMonth: external_exports.number().int(),
+  expYear: external_exports.number().int()
+});
+var BillingHoldSchema = external_exports.object({
+  state: external_exports.enum(["overdue", "readOnly"]),
+  /** The oldest unpaid statement's due date. */
+  dueAt: external_exports.iso.datetime(),
+  /** When it becomes read-only (null: the deployment doesn't do that). */
+  readOnlyAt: external_exports.iso.datetime().nullable()
+});
+var WorkspaceBillingSchema = external_exports.object({
+  /** null: the deployment doesn't bill workspaces. */
+  plan: external_exports.discriminatedUnion("kind", [
+    external_exports.object({
+      kind: external_exports.literal("usage"),
+      currency: external_exports.string(),
+      /** The meters billed and their prices (null: priced per model, for AI). */
+      meters: external_exports.array(
+        external_exports.object({ meter: external_exports.enum(BILLING_METERS), unitPrice: external_exports.number().nullable() })
+      )
+    }),
+    external_exports.object({
+      kind: external_exports.literal("agreement"),
+      currency: external_exports.string(),
+      agreement: AgreementSchema.omit({ note: true }),
+      /** The meters it doesn't include, billed as usual. */
+      meters: external_exports.array(
+        external_exports.object({ meter: external_exports.enum(BILLING_METERS), unitPrice: external_exports.number().nullable() })
+      )
+    })
+  ]).nullable(),
+  /** An agreement that starts later, if one is set. */
+  upcoming: AgreementSchema.omit({ note: true }).nullable(),
+  statements: external_exports.array(StatementSchema),
+  contact: BillingContactSchema,
+  /** Whether invoices can be paid online (the deployment has Stripe). */
+  online: external_exports.boolean(),
+  card: SavedCardSchema.nullable(),
+  hold: BillingHoldSchema.nullable(),
+  /** Owners change the contact and the card; admins see. */
+  canManage: external_exports.boolean()
+});
+var CardSetupSchema = external_exports.object({ url: external_exports.url() });
+
 // ../types/src/accent.ts
 var HexColorSchema = external_exports.string().regex(/^#[0-9a-fA-F]{6}$/, "Use a colour like #4f46e5").transform((hex3) => hex3.toLowerCase());
 var WorkspaceAccentSchema = external_exports.object({ light: HexColorSchema, dark: HexColorSchema });
@@ -22242,6 +22729,11 @@ var WorkspaceSchema = external_exports.object({
   logoUrl: external_exports.string().nullable().default(null),
   /** Its data is moving to new storage (M5 slice 4): read-only until it's done. */
   moving: external_exports.boolean().default(false),
+  /**
+   * Its bills are late (decision 209): owners and admins see it as overdue;
+   * everyone sees it once it's read-only until paid. Null: nothing late.
+   */
+  billingHold: BillingHoldSchema.nullable().default(null),
   /** Its accent colour for each mode; null: the default ink. */
   accent: WorkspaceAccentSchema.nullable().default(null),
   /** Its default time zone (M8 slice 1): for schedules when a person's own isn't known. */
@@ -22750,166 +23242,6 @@ var SpaceImportResultSchema = external_exports.object({
   files: external_exports.number().int()
 });
 
-// ../types/src/billing.ts
-var COMMON_CURRENCIES = [
-  "USD",
-  "EUR",
-  "GBP",
-  "NGN",
-  "KES",
-  "GHS",
-  "ZAR",
-  "CAD",
-  "AUD",
-  "CHF",
-  "JPY",
-  "INR",
-  "BRL"
-];
-var CurrencySchema = external_exports.string().regex(/^[A-Z]{3}$/, "Use a three-letter currency code, like USD").refine((code) => knownCurrencies().has(code), "Unknown currency");
-var known = null;
-function knownCurrencies() {
-  known ??= new Set(
-    typeof Intl.supportedValuesOf === "function" ? Intl.supportedValuesOf("currency") : COMMON_CURRENCIES
-  );
-  return known;
-}
-var PriceSchema = external_exports.number().min(0, "Prices can't be negative").max(1e6).transform((value) => Math.round(value * 1e4) / 1e4);
-var priced = external_exports.object({ enabled: external_exports.boolean(), price: PriceSchema });
-var ModelPriceSchema = external_exports.object({
-  /** As agents name it: `provider/model`. */
-  model: external_exports.string().trim().min(3).max(200),
-  input: PriceSchema,
-  /** Input read from the prompt cache. */
-  cachedInput: PriceSchema,
-  /** Input written to the prompt cache. */
-  cacheWrite: PriceSchema,
-  output: PriceSchema
-});
-var BillingSettingsSchema = external_exports.object({
-  currency: CurrencySchema,
-  /** Per person who used the workspace in the month. */
-  seats: priced,
-  /** Per GB-month in the deployment's bucket. */
-  files: priced,
-  /** Per GB-month in the deployment's MongoDB. */
-  database: priced,
-  /** Model cost (from `models`) plus a markup, for runs on the deployment's Gateway. */
-  ai: external_exports.object({
-    enabled: external_exports.boolean(),
-    markupPercent: external_exports.number().min(0).max(1e3),
-    models: external_exports.array(ModelPriceSchema).max(100).refine(
-      (models) => new Set(models.map((m) => m.model)).size === models.length,
-      "Each model once"
-    )
-  }),
-  /** A flat amount per workspace per month (prorated from the day it was created). */
-  deploymentFee: priced,
-  /**
-   * A support plan per workspace per month, opt-in (decision 74): workspaces
-   * that turn it on pay it (prorated by day) and can ask the deployment for
-   * help. Absent in settings saved before it existed: off.
-   */
-  support: priced.default({ enabled: false, price: 0 }),
-  /**
-   * The deployment's Gateways (decision 151), per hour: a workspace's own
-   * ("Managed for you") while it's awake, or the deployment's shared one while
-   * the workspace is connected to it. Absent in older settings: off.
-   */
-  gatewayHours: priced.default({ enabled: false, price: 0 }),
-  /** A workspace's own Gateway's storage (its volume), per GB-month, asleep or awake. */
-  gatewayStorage: priced.default({ enabled: false, price: 0 })
-});
-var BILLING_METERS = [
-  "seats",
-  "files",
-  "database",
-  "ai",
-  "deploymentFee",
-  "support",
-  "gatewayHours",
-  "gatewayStorage"
-];
-var StripeConnectionSchema = external_exports.object({
-  connected: external_exports.boolean(),
-  /** Test keys create test invoices that nobody really pays. */
-  mode: external_exports.enum(["test", "live"]).nullable(),
-  /** The key's last four characters, to recognise it. */
-  keyHint: external_exports.string().nullable(),
-  connectedAt: external_exports.iso.datetime().nullable()
-});
-var ConnectStripeRequestSchema = external_exports.object({
-  secretKey: external_exports.string().trim().regex(
-    /^(sk|rk)_(test|live)_[A-Za-z0-9]{10,}$/,
-    "Use a Stripe secret key (sk_\u2026) or restricted key (rk_\u2026)"
-  )
-});
-var AdminBillingSchema = external_exports.object({
-  settings: BillingSettingsSchema,
-  /** Models agents have run on this deployment's Gateways, to price. */
-  modelsInUse: external_exports.array(external_exports.string()),
-  stripe: StripeConnectionSchema
-});
-var BillLineSchema = external_exports.object({
-  meter: external_exports.enum(BILLING_METERS),
-  /**
-   * billed: charged; notBilled: this deployment doesn't bill it;
-   * own: the workspace brings this resource itself; notChosen: an opt-in plan
-   * (support) the workspace doesn't have.
-   */
-  status: external_exports.enum(["billed", "notBilled", "own", "notChosen"]),
-  /** People, GB-months, tokens, or the share of the month (deployment fee, support plan). */
-  quantity: external_exports.number().nonnegative(),
-  /** Price per unit; null for AI (priced per model). */
-  unitPrice: external_exports.number().nullable(),
-  amount: external_exports.number().nonnegative()
-});
-var WorkspaceBillSchema = external_exports.object({
-  currency: external_exports.string(),
-  lines: external_exports.array(BillLineSchema),
-  /** AI amount per model (null: the model has no price set). */
-  aiByModel: external_exports.array(external_exports.object({ model: external_exports.string(), amount: external_exports.number().nullable() })),
-  /** Models used but not priced: their tokens aren't charged. */
-  unpricedModels: external_exports.array(external_exports.string()),
-  total: external_exports.number().nonnegative(),
-  /** True for the current month: amounts grow until it ends. */
-  toDate: external_exports.boolean()
-});
-var StatementStatusSchema = external_exports.enum(["nothingDue", "due", "paid", "void"]);
-var StatementSchema = external_exports.object({
-  id: external_exports.string(),
-  workspaceId: external_exports.string(),
-  month: external_exports.string(),
-  currency: external_exports.string(),
-  lines: external_exports.array(BillLineSchema),
-  aiByModel: external_exports.array(external_exports.object({ model: external_exports.string(), amount: external_exports.number().nullable() })),
-  unpricedModels: external_exports.array(external_exports.string()),
-  total: external_exports.number().nonnegative(),
-  status: StatementStatusSchema,
-  createdAt: external_exports.iso.datetime(),
-  paidAt: external_exports.iso.datetime().nullable(),
-  payment: external_exports.object({
-    /** stripe: an invoice on the deployment's Stripe; manual: settled outside the app. */
-    provider: external_exports.enum(["stripe", "manual"]),
-    invoiceNumber: external_exports.string().nullable(),
-    /** Stripe's page where the invoice can be paid. */
-    invoiceUrl: external_exports.url().nullable(),
-    /** Why the invoice couldn't be created yet (retried every hour). */
-    error: external_exports.string().nullable()
-  })
-});
-var WorkspaceStatementsSchema = external_exports.object({ statements: external_exports.array(StatementSchema) });
-var AdminStatementsSchema = external_exports.object({
-  month: external_exports.string(),
-  /** Months with statements, newest first. */
-  months: external_exports.array(external_exports.string()),
-  statements: external_exports.array(
-    StatementSchema.extend({
-      workspace: external_exports.object({ id: external_exports.string(), name: external_exports.string(), slug: external_exports.string() })
-    })
-  )
-});
-
 // ../types/src/usage.ts
 var UsageMonthSchema = external_exports.string().regex(/^\d{4}-(0[1-9]|1[0-2])$/, "Use YYYY-MM");
 var UsageSourceSchema = external_exports.enum(["deployment", "own"]);
@@ -23297,7 +23629,11 @@ var ConnectorToolSchema = external_exports.object({
   /** A tool its server doesn't describe, which an owner says only reads. */
   markedReadOnly: external_exports.boolean(),
   /** Agents may use it (only tools that read, or that an owner says only read). */
-  enabled: external_exports.boolean()
+  enabled: external_exports.boolean(),
+  /** It shows a view in conversations (MCP Apps, decision 213). */
+  view: external_exports.boolean().default(false),
+  /** Only its views call it, not agents. */
+  viewsOnly: external_exports.boolean().default(false)
 });
 var McpConnectorSchema = external_exports.object({
   id: external_exports.string(),
@@ -24000,6 +24336,7 @@ function checkManifest(json2, url2) {
     manifest2.tabs.forEach((tab) => onOrigin(tab.url, `tabs.${tab.id}.url`));
     for (const [name, action] of Object.entries(manifest2.actions ?? {})) {
       onOrigin(action.url, `actions.${name}.url`);
+      if (action.view) onOrigin(action.view.url, `actions.${name}.view.url`);
     }
     if (manifest2.icon) onOrigin(manifest2.icon, "icon");
   }
@@ -24075,6 +24412,7 @@ function harnessPage() {
   input, select, textarea { width: 100%; padding: 7px 9px; border: 1px solid var(--border); border-radius: 8px; background: var(--surface); }
   button { padding: 7px 12px; border-radius: 8px; border: 1px solid var(--border); background: var(--canvas); cursor: pointer; }
   button.primary { background: var(--accent); color: var(--canvas); border-color: var(--accent); }
+  button[aria-pressed="true"] { background: var(--text); color: var(--canvas); border-color: var(--text); }
   .frame { display: flex; flex-direction: column; }
   .frame .bar { display: flex; align-items: center; gap: 8px; padding: 10px 14px; border-bottom: 1px solid var(--border); color: var(--muted); font-size: 12px; }
   .frame .bar code { color: var(--text); }
@@ -24098,6 +24436,7 @@ function harnessPage() {
   <strong>App harness</strong><span class="muted" id="appName"></span>
   <span class="spacer"></span>
   <button type="button" id="theme">Dark</button>
+  <button type="button" id="readOnly" aria-pressed="false" title="As when its bill is unpaid: reads work, writes are refused">Read-only</button>
   <button type="button" id="reset">Clear data</button>
 </header>
 <div id="problems" class="problems" hidden></div>
@@ -24141,6 +24480,8 @@ function harnessPage() {
 const $ = (id) => document.getElementById(id);
 const frame = $("frame");
 let theme = "light";
+// The workspace read-only (an unpaid bill): the page is told, and writes are refused.
+let readOnly = false;
 let info = null;
 let origin = null;
 
@@ -24148,7 +24489,7 @@ const post = async (path, body) => {
   const response = await fetch(path, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
   return response.json();
 };
-const who = () => Object.fromEntries(new FormData($("who")));
+const who = () => ({ ...Object.fromEntries(new FormData($("who"))), readOnly });
 const send = (message) => frame.contentWindow?.postMessage({ tands: 1, ...message }, origin);
 const reply = (id, out) =>
   out && out.error ? send({ type: "error", id, code: out.error.code, message: out.error.message }) : send({ type: "data", id, result: out.result });
@@ -24251,6 +24592,11 @@ $("theme").addEventListener("click", () => {
   $("theme").textContent = theme === "light" ? "Dark" : "Light";
   send({ type: "theme", theme });
 });
+$("readOnly").addEventListener("click", () => {
+  readOnly = !readOnly;
+  $("readOnly").setAttribute("aria-pressed", String(readOnly));
+  send({ type: "readOnly", readOnly });
+});
 $("reset").addEventListener("click", async () => { await post("/harness/reset", {}); void refresh(); });
 void load().then(refresh);
 setInterval(refresh, 2000);
@@ -24420,6 +24766,9 @@ function createMemoryStore() {
 }
 
 // src/harness.ts
+var READING = /* @__PURE__ */ new Set(["values.get", "values.list", "records.list", "records.get"]);
+var READ_ONLY_MESSAGE = "This workspace is read-only until its bill is paid.";
+var writes = (request) => !READING.has(String(request?.op));
 var ACTION_TOKEN_SECONDS = 120;
 var DATA_KEY_MS = 5 * 6e4;
 var ACTION_TIMEOUT_MS = 1e4;
@@ -24468,7 +24817,12 @@ async function startHarness({
     const spaceId = idFrom("s", who.spaceName || "Design");
     return {
       user: { id: idFrom("u", who.name || "Ada Lovelace"), name: who.name || "Ada Lovelace" },
-      workspace: { id: "dev-workspace", slug: "dev", name: "Harness workspace" },
+      workspace: {
+        id: "dev-workspace",
+        slug: "dev",
+        name: "Harness workspace",
+        readOnly: who.readOnly === true
+      },
       space: { id: spaceId, kind: who.spaceKind, name: who.spaceName || "Design" },
       tab: { id: `${spaceId}-${who.appTabId}`, appTabId: who.appTabId },
       app: { id: manifest2.id },
@@ -24503,7 +24857,7 @@ async function startHarness({
   }
   const isWho = (value) => {
     const who = value;
-    return typeof who?.name === "string" && typeof who.spaceName === "string" && typeof who.locale === "string" && typeof who.appTabId === "string" && ["normal", "general", "personal", "dm"].includes(String(who.spaceKind));
+    return typeof who?.name === "string" && typeof who.spaceName === "string" && typeof who.locale === "string" && typeof who.appTabId === "string" && (who.readOnly === void 0 || typeof who.readOnly === "boolean") && ["normal", "general", "personal", "dm"].includes(String(who.spaceKind));
   };
   function logEvent(loaded, body, from, person) {
     const manifest2 = loaded.manifest;
@@ -24633,6 +24987,9 @@ async function startHarness({
       }
       const loaded2 = await current();
       if (!loaded2.manifest) return refused2(409, "BAD_MANIFEST", loaded2.problems.join(" "));
+      if (claims.who.readOnly && (url2.pathname === "/api/apps/events" || writes(body))) {
+        return refused2(423, "WORKSPACE_READ_ONLY", READ_ONLY_MESSAGE);
+      }
       if (url2.pathname === "/api/apps/events") {
         const outcome2 = logEvent(loaded2, body, "server", claims.who.name);
         return "error" in outcome2 ? send(outcome2.status, { error: outcome2.error }) : send(200, { result: outcome2.result });
@@ -24649,6 +25006,9 @@ async function startHarness({
       return refused2(404, "NOT_FOUND", `${manifest2.name} has no tab \u201C${who.appTabId}\u201D.`);
     }
     const context = contextFor(who, manifest2);
+    if (who.readOnly && (url2.pathname === "/harness/event" || url2.pathname === "/harness/data" && writes(body.request))) {
+      return refused2(423, "WORKSPACE_READ_ONLY", READ_ONLY_MESSAGE);
+    }
     switch (url2.pathname) {
       case "/harness/token": {
         const tab = manifest2.tabs.find((one) => one.id === who.appTabId);
@@ -25001,7 +25361,7 @@ your manifest's address. See https://developer.tabsandspaces.dev.
 `;
 
 // src/bin.ts
-var version2 = true ? "0.2.0" : "dev";
+var version2 = true ? "0.3.0" : "dev";
 var USAGE = `tands: developer tools for Tabs & Spaces apps
 
   tands new <folder> [--name "My app"] [--id my-app]
@@ -25027,8 +25387,8 @@ var USAGE = `tands: developer tools for Tabs & Spaces apps
 Docs: https://developer.tabsandspaces.dev`;
 async function main(argv, {
   cwd = process.env.INIT_CWD ?? process.cwd(),
-  out = (line) => console.log(line),
-  err = (line) => console.error(line),
+  out = (line2) => console.log(line2),
+  err = (line2) => console.error(line2),
   env = process.env,
   fetchImpl = fetch
 } = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tands",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Developer tools for Tabs & Spaces apps: `tands new`, `tands check`, `tands dev` (a local harness that stands in for a workspace) and `tands publish`.",
   "license": "MIT",
   "author": "Tabs & Spaces",
@@ -38,7 +38,7 @@
     "test:coverage": "vitest run --coverage"
   },
   "devDependencies": {
-    "@tabs-and-spaces/sdk": "0.3.0",
+    "@tabs-and-spaces/sdk": "0.5.0",
     "@tabs-and-spaces/types": "0.0.0",
     "@types/node": "^26.6.3",
     "@vitest/coverage-v8": "5.0.2",