Concierge.
The safe action layer for agent-ready web applications.
Typed, consent-gated actions so an AI can operate your web app; without taking over the browser.
Three packages, one release set
Install the core runtime for a framework-neutral integration, then add the matching adapter. Install and upgrade them together so every adapter resolves the same physical core.
$ pnpm add @full-self-browsing/concierge zod$ pnpm add @full-self-browsing/concierge@^0.2 \
@full-self-browsing/concierge-react@^0.2 zodVersion 0.2.1 is a supported public preview on runtime contract v2. React and Svelte package roots are server-safe; their runtime bindings live in /client and /client.svelte. Edge deployment is not part of the 0.2 support matrix.
Publish verbs, not a page surface
Generic browser automation reconstructs intent from page structure, selectors, or coordinates. Concierge lets a cooperating application publish the exact verbs an AI may use at the current moment.
FSB operates sites that do not cooperate. Concierge is the action layer for applications that do cooperate. The projects address different parts of the agent browsing stack.
From declaration to structured result
The application defines named actions with descriptions, input schemas, availability rules, effect metadata, redaction policy, and handlers.
Concierge resolves the active stage and its available actions into one immutable catalog snapshot with an instance-local revision.
The model receives only the tools admitted by that snapshot.
Concierge validates every requested action again before execution, applies consent and scheduling rules, and rejects stale or conflicting calls.
The application bridge performs the approved interface operation and returns a structured result.
Application
Action definitions, live state, interface operations, authentication, and server authorization.
Concierge
Catalog admission, validation, consent, scheduling, deduplication, dispatch, and workflows.
Model integration
Tool presentation, model calls, tool correlation, and result delivery.
Declare an action. Resolve one catalog.
Define each action as a named constant, attach it to a stage, and resolve one atomic catalog snapshot for the current application state.
- Stage, availability, tools, and revision resolve together
- Only the literal value true admits an action; anything else fails closed
- The resolved catalog is deeply frozen and never cross-runtime authority
import { createBridge, createConcierge, defineAction, offPageResult } from "@full-self-browsing/concierge";
import { z } from "zod";
const projectBridge = createBridge<{
actions: { openProject(id: string): void };
snapshot: { activeProject(): string | null };
}>("project-ui");
const openProject = defineAction({
name: "openProject",
description: "Open one project in the application preview.",
schema: z.object({ projectId: z.string().min(1).max(64) }).strict(),
jsonSchema: {
type: "object",
properties: { projectId: { type: "string", minLength: 1, maxLength: 64 } },
required: ["projectId"],
additionalProperties: false,
},
redact: ({ projectId }) => ({ projectId }),
effects: { readOnly: false, destructive: false, idempotent: true },
handler: ({ args, bridge }) => {
if (bridge === null) {
return offPageResult("Project opening", "project interface");
}
bridge.actions.openProject(args.projectId);
return { ok: true, message: `Opened project ${args.projectId}.` };
},
});
const concierge = createConcierge({
stages: [
{
id: "projects",
match: (context) => context.pathname === "/projects",
actions: [openProject],
bridge: projectBridge,
},
],
});
const catalog = concierge.resolveCatalog({ pathname: "/projects" });
// → catalog.stage · catalog.revision · catalog.tools one snapshotCore runtime plus framework bindings
The public packages form one fixed release set and share runtime contract v2.
@full-self-browsing/conciergeFramework-neutral catalog, dispatch, consent, workflow, telemetry, and transport runtime.
@full-self-browsing/concierge-reactReact context, bridge lifecycle, and optional activity visuals including ConciergeActivityOverlay.
@full-self-browsing/concierge-svelteSvelte context, bridge lifecycle, and reactive snapshot normalization.
One instance, several entry points
Mount the same Concierge instance and bridge registry through the appropriate adapter. Getter-based state stays live until Concierge captures a snapshot for validation or consent.
Raw onToolCall values are display data only. They never actuate the application. The signed bridge verifies the envelope, consumes its replay key, compares it with the live browser catalog, and only then enters core dispatch.
What the runtime holds to
Dispatch outcome
completedA least-authority boundary, not an authentication system
Security model
Concierge does not authenticate users, and a client consent record is not server authorization. A server that performs a protected effect must independently authenticate the current principal, authorize the exact action and payload under current policy, reject replay, and make the effect idempotent or transactional.
The signed AI bridge authenticates a short-lived server decision to admit one specific browser batch. It does not make model output trustworthy, repair an XSS vulnerability, or turn client state into server authority.
Read SECURITY.md before shipping a consequential integration.
Telemetry
Mounted React and Svelte runtimes send default-on anonymous usage estimates to FSB's aggregate statistics pipeline. Vanilla integrations mount telemetry explicitly through the browser-only /telemetry entry, which also provides status and opt-out APIs.
Telemetry never sends action names, arguments, results, schemas, stages, page URLs, DOM content, application names, or account identifiers. If browser storage is unavailable, telemetry stops without affecting dispatch.
Read the telemetry privacy contract for payload, retention, and erasure.
Let an AI act without handing over the browser
TypeScript-first, ESM-only, MIT-licensed. Published under the @full-self-browsingnpm scope.