Interface Schema

Exposure policy for untrusted channels, valid on any schema (an action, a state, a nested group). For a function it governs invocation; for any other member it governs visibility (e.g. toTypeScript omits members hidden from the agent). Pure metadata: does NOT affect ToType or service-schema validation. Resolve it with resolveExternalInvocation(schema) — the single source of truth — rather than re-deriving per call site.

The two channels have deliberately opposite default polarity, matching their trust level:

• link — a deeplink / URL: the least-trusted channel (anyone can craft a URL and get a victim to open it in their authenticated session). Default-deny whitelist: exposed only when link === true.
• agent — an agent acting on the user's behalf: more trusted. Default-allow blacklist: exposed unless agent === false.

The signature of the function constructor, grouped so these members live only on function schemas rather than on every Schema: { type: "function", signature: { parameters, returns } } → (...args) => ToType<returns>. Absent parameters ⇒ no args; absent returns ⇒ void; absent signature entirely ⇒ () => void.

Each parameter is a named descriptor (Parameter) rather than a bare schema, so the argument's name and its own documentation are known independently of its type (parameter.schema). parameter.description documents the argument; parameter.schema.description documents the type. Neither affects ToType, which derives the call signature positionally from parameter.schema. A bare Schema entry is the deprecated positional form; read either with Parameter.schemaOf.