@fungi.computer/oyster 0.0.0-stage → 0.0.1

package/dist/invocation.js

@@ -0,0 +1,377 @@
+import { approvedBindingGrants } from "./apps/gate.js";
+import { appToolPolicySchema } from "./apps/tools.js";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as Semaphore from "effect/Semaphore";
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import { sha256DigestSchema } from "@fungi.computer/puffball/effect";
+import { appBackendBindingKinds, appBackendBindingsSchema, appMethodCallContextSchema, } from "@fungi.computer/puffball/app";
+import { actorLane, mayDefer, backgroundContext, sealBackgroundOrigin, backgroundRefusalCodeSchema, admitClaimedOrigin, backgroundOriginSchema, } from "@fungi.computer/puffball/background-replay";
+import { appApiMethodNameSchema, emptyAppDeclaration, } from "@fungi.computer/puffball/app";
+import { AppInstanceError, instanceIdSchema, selectionOf, selectionSchema, } from "./index.js";
+/** One App invocation may hold authority for at most the Hub grant's lifetime. */
+export const APP_INVOCATION_CEILING_MS = 60_000;
+const bindingName = Schema.String.pipe(Schema.refine((value) => Object.hasOwn(appBackendBindingKinds, value)));
+const grantsSchema = Schema.Array(Schema.Struct({
+    binding: bindingName,
+    operations: Schema.Array(Schema.NonEmptyString),
+})).pipe(Schema.check(Schema.makeFilter((grants) => Schema.is(appBackendBindingsSchema)(grants.map((grant) => ({
+    name: grant.binding,
+    operations: grant.operations,
+}))))));
+/** Host-admitted facts; shape decoding does not establish host authority. */
+export const invocationFactsSchema = Schema.Struct({
+    instanceId: instanceIdSchema,
+    selection: selectionSchema,
+    artifactDigest: sha256DigestSchema,
+    subject: Schema.Union([
+        Schema.Struct({
+            kind: Schema.Literal("call"),
+            context: appMethodCallContextSchema,
+            /** Originating Session supplied by capability acquisition, never App arguments. */
+            sessionId: Schema.optionalKey(Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(256)))),
+            /** Captured Agent approval, supplied by the host after current policy admission. */
+            agentPolicy: Schema.optionalKey(Schema.Struct({
+                policyRevision: appToolPolicySchema.fields.revision,
+                grantorMemberId: appToolPolicySchema.fields.grantedBy,
+            })),
+            /** Verified method metadata; raw fetch frames have no declared method. */
+            method: Schema.optionalKey(Schema.Struct({
+                name: appApiMethodNameSchema,
+                effect: Schema.Literals(["read", "write", "external"]),
+            })),
+            /** Host-marked, freshly admitted replay; never read from guest input. */
+            replay: Schema.optionalKey(Schema.Struct({
+                lane: Schema.NonEmptyString,
+                epoch: Schema.Number.check(Schema.isInt(), Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)),
+                admitted: Schema.Array(appApiMethodNameSchema).check(Schema.isMaxLength(256), Schema.makeFilter((names) => new Set(names).size === names.length)),
+            })),
+        }),
+        Schema.Struct({
+            kind: Schema.Literal("lifecycle"),
+            name: Schema.Literal("onGitPush"),
+            eventId: Schema.NonEmptyString,
+        }),
+        Schema.Struct({
+            kind: Schema.Literal("lifecycle"),
+            name: Schema.Literal("syncRefused"),
+            lane: Schema.String.check(Schema.makeFilter((lane) => lane.startsWith("member:") && lane.length > 7 && lane.length <= 263)),
+            code: Schema.Literals(backgroundRefusalCodeSchema.options),
+        }),
+    ]),
+    grants: grantsSchema,
+    deadlineAt: Schema.Number.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThan(0))),
+    ancestry: Schema.Array(instanceIdSchema),
+}).pipe(Schema.check(Schema.makeFilter((facts) => facts.instanceId === facts.selection.instanceId &&
+    (facts.subject.kind !== "lifecycle" ||
+        facts.subject.name !== "syncRefused" ||
+        facts.grants.length === 0) &&
+    (facts.subject.kind !== "call" ||
+        facts.subject.agentPolicy === undefined ||
+        facts.subject.context.actor.kind === "agent") &&
+    (facts.subject.kind !== "call" ||
+        facts.subject.context.backgroundLane === undefined ||
+        (facts.subject.method?.effect === "write" &&
+            facts.subject.context.backgroundOrigin?.method ===
+                facts.subject.method.name &&
+            mayDefer(facts.subject.context, facts.ancestry))) &&
+    facts.grants.some((grant) => grant.binding === "BACKGROUND") ===
+        (facts.subject.kind === "call" &&
+            facts.subject.replay !== undefined) &&
+    (facts.subject.kind !== "call" ||
+        facts.subject.replay === undefined ||
+        (facts.subject.method?.effect === "write" &&
+            facts.subject.context.backgroundLane === undefined &&
+            mayDefer(facts.subject.context, facts.ancestry) &&
+            facts.subject.replay.lane ===
+                actorLane(facts.subject.context.actor))))));
+/** Block replay capability effects before job-origin admission; storage permits claiming/settling. */
+export function assertBackgroundBinding(frame, binding) {
+    if (frame.signal.aborted ||
+        (frame.facts.subject.kind === "call" &&
+            frame.facts.subject.replay !== undefined &&
+            binding !== "BACKGROUND" &&
+            binding !== "APP_STORAGE" &&
+            frame.host.origin !== "admitted"))
+        throw new AppInstanceError("revoked");
+}
+/** Consume this frame's one origin check before awaiting verification, then retain only its decision. */
+export async function admitBackgroundFrame(key, frame, raw) {
+    assertBackgroundBinding(frame, "BACKGROUND");
+    const subject = frame.facts.subject;
+    if (subject.kind !== "call" ||
+        subject.replay === undefined ||
+        frame.host.origin !== "unchecked")
+        return { kind: "refused", code: "access_changed" };
+    frame.host.origin = "refused";
+    const origin = backgroundOriginSchema.safeParse(raw);
+    if (!origin.success)
+        return { kind: "refused", code: "access_changed" };
+    const decision = await admitClaimedOrigin(key, {
+        instanceId: frame.facts.instanceId,
+        lane: subject.replay.lane,
+        admitted: subject.replay.admitted,
+    }, origin.data);
+    assertBackgroundBinding(frame, "BACKGROUND");
+    frame.host.origin = decision.kind;
+    return decision;
+}
+const frameIds = defineIdFamily({
+    family: "app-invocation-frame",
+    version: 1,
+    kinds: { frame: { prefix: "app_frame" } },
+});
+/** Decode only identities minted from the invocation-frame ID family. */
+export const invocationFrameIdSchema = Schema.String.check(Schema.makeFilter((value) => frameIds.frame.is(value)));
+const parseFacts = Schema.decodeUnknownSync(invocationFactsSchema, {
+    onExcessProperty: "error",
+});
+function immutableFacts(facts) {
+    Object.freeze(facts.selection.owner);
+    Object.freeze(facts.selection);
+    if (facts.subject.kind === "call") {
+        Object.freeze(facts.subject.context.actor);
+        if (facts.subject.context.workflow) {
+            Object.freeze(facts.subject.context.workflow.armedBy);
+            Object.freeze(facts.subject.context.workflow);
+        }
+        Object.freeze(facts.subject.context);
+        if (facts.subject.agentPolicy)
+            Object.freeze(facts.subject.agentPolicy);
+        if (facts.subject.method)
+            Object.freeze(facts.subject.method);
+        if (facts.subject.replay)
+            Object.freeze(facts.subject.replay);
+    }
+    Object.freeze(facts.subject);
+    for (const grant of facts.grants) {
+        Object.freeze(grant.operations);
+        Object.freeze(grant);
+    }
+    Object.freeze(facts.grants);
+    Object.freeze(facts.ancestry);
+    return Object.freeze(facts);
+}
+/** Serialize authority, preempt replay only for verified writes, and close each guest before admission. */
+export function createInvocationGate(ports) {
+    const permit = Semaphore.makeUnsafe(1);
+    const now = ports.now ?? Date.now;
+    let foregroundWaiting = 0;
+    let active;
+    const close = (state, reason) => {
+        if (state.closing)
+            return state.closing;
+        if (active === state)
+            active = undefined;
+        state.controller.abort(reason);
+        state.closing = (async () => {
+            try {
+                await ports.abortGuest();
+            }
+            finally {
+                await ports.close(state.frame);
+            }
+        })();
+        return state.closing;
+    };
+    const run = async (input, host, work) => {
+        let facts;
+        try {
+            facts = immutableFacts(structuredClone(parseFacts(input)));
+        }
+        catch (cause) {
+            throw new AppInstanceError("invalid_invocation_facts", { cause });
+        }
+        // This must happen before waiting: self-invocation already holds the permit.
+        if (facts.ancestry.includes(facts.instanceId))
+            throw new AppInstanceError("reentrant");
+        let queuedForeground = facts.subject.kind === "call" && facts.subject.replay === undefined;
+        if (queuedForeground)
+            foregroundWaiting += 1;
+        try {
+            if (facts.deadlineAt <= now())
+                throw new AppInstanceError("expired");
+            // Reads wait for the current replay step under the same permit. Only a
+            // verified write closes replay; Watchdog recovers its retained claim.
+            if (queuedForeground &&
+                facts.subject.kind === "call" &&
+                facts.subject.method?.effect === "write" &&
+                active?.frame.facts.subject.kind === "call" &&
+                active.frame.facts.subject.replay !== undefined)
+                await close(active, new AppInstanceError("revoked"));
+            return await Effect.runPromise(permit.withPermits(1)(Effect.tryPromise({
+                try: async () => {
+                    if (facts.subject.kind === "call" &&
+                        facts.subject.replay !== undefined &&
+                        foregroundWaiting > 0)
+                        throw new AppInstanceError("revoked");
+                    if (queuedForeground) {
+                        foregroundWaiting -= 1;
+                        queuedForeground = false;
+                    }
+                    const { deadlineAt } = facts;
+                    if (deadlineAt <= now())
+                        throw new AppInstanceError("expired");
+                    const frameId = frameIds.frame.generate();
+                    const controller = new AbortController();
+                    const frame = Object.freeze({
+                        frameId,
+                        facts,
+                        host,
+                        signal: controller.signal,
+                    });
+                    const state = { frame, controller };
+                    active = state;
+                    let timer;
+                    let stop = () => undefined;
+                    const revoked = new Promise((_resolve, reject) => {
+                        const onAbort = () => {
+                            const reason = controller.signal.reason;
+                            reject(reason instanceof Error
+                                ? reason
+                                : new AppInstanceError("revoked"));
+                        };
+                        controller.signal.addEventListener("abort", onAbort, {
+                            once: true,
+                        });
+                        stop = () => {
+                            controller.signal.removeEventListener("abort", onAbort);
+                        };
+                        timer = setTimeout(() => {
+                            controller.abort(new AppInstanceError("expired"));
+                        }, Math.max(0, deadlineAt - now()));
+                    });
+                    try {
+                        return await Promise.race([work(frame), revoked]);
+                    }
+                    finally {
+                        clearTimeout(timer);
+                        stop();
+                        await close(state, new AppInstanceError("revoked"));
+                    }
+                },
+                catch: (cause) => cause instanceof Error
+                    ? cause
+                    : new Error("App invocation failed", { cause }),
+            })));
+        }
+        finally {
+            if (queuedForeground)
+                foregroundWaiting -= 1;
+        }
+    };
+    return {
+        run,
+        exclusive: (work) => Effect.runPromise(permit.withPermits(1)(Effect.tryPromise({
+            try: work,
+            catch: (cause) => cause instanceof Error
+                ? cause
+                : new Error("Instance supervisor operation failed", { cause }),
+        }))),
+        active: () => {
+            if (active === undefined ||
+                active.controller.signal.aborted ||
+                active.frame.facts.deadlineAt <= now())
+                throw new AppInstanceError("revoked");
+            return active.frame;
+        },
+        revoke: (reason = new AppInstanceError("revoked"), target) => {
+            if (active === undefined)
+                return Promise.resolve();
+            if (target !== undefined &&
+                (active.frame.facts.subject.kind !== "call" ||
+                    active.frame.facts.subject.context.workflow?.runId !== target.runId))
+                return Promise.resolve();
+            return close(active, reason);
+        },
+    };
+}
+/**
+ * Project an admitted principal into App attribution; only the host chooses
+ * the fixed Computer context. The App caller grammar has no visitor actor, so
+ * the anonymous public reader is attributed as the reserved `visitor` key
+ * without a Computer. Host admission reads the principal, never this projection.
+ */
+export function invocationCallerContext(principal, computerId) {
+    const { actor } = principal;
+    if (actor.kind === "visitor")
+        return { computerId: null, actor: { kind: "team-key", keyId: "visitor" } };
+    if (!("role" in principal))
+        return { computerId, actor };
+    return principal.soleMember === true
+        ? { computerId, actor, role: principal.role, soleMember: true }
+        : { computerId, actor, role: principal.role };
+}
+/** Shared host-held caller/Workflow fact builders, never guest argument decoders. */
+export const invocationFacts = {
+    /** Combine host-admitted caller facts with the invocation and grant deadlines. */
+    fromCaller: (authority, context, deadline, method, sessionId, agentPolicy) => {
+        let subject = {
+            kind: "call",
+            context,
+        };
+        if (method !== undefined)
+            subject = { ...subject, method };
+        if (sessionId !== undefined)
+            subject = { ...subject, sessionId };
+        if (agentPolicy !== undefined)
+            subject = { ...subject, agentPolicy };
+        return parseFacts({
+            ...authority,
+            subject,
+            deadlineAt: Math.min(deadline.deadlineAt, deadline.grantExpiresAt),
+        });
+    },
+    /** Attribute an already host-admitted published node to its retained arming actor. */
+    fromWorkflowNode: (authority, input, deadline) => {
+        const context = {
+            actor: input.workflow.armedBy,
+            computerId: input.computerId,
+            idempotencyKey: input.idempotencyKey,
+            workflow: input.workflow,
+        };
+        if (input.role !== undefined)
+            context.role = input.role;
+        return invocationFacts.fromCaller(authority, context, deadline);
+    },
+};
+/** Authority comes from the admitted installation and its verified backend bytes. */
+export function invocationAuthorityOf(installation, release, ancestry = []) {
+    if (release.backend === null)
+        throw new Error("Release has no backend");
+    if (installation.status !== "enabled" ||
+        installation.release.releaseId !== release.release.releaseId ||
+        installation.release.artifact.artifactDigest !==
+            release.release.artifact.artifactDigest)
+        throw new Error("Invocation installation changed");
+    return {
+        instanceId: selectionOf(installation).instanceId,
+        selection: selectionOf(installation),
+        artifactDigest: release.backend.digest,
+        grants: approvedBindingGrants(installation, release.declaration ?? emptyAppDeclaration),
+        ancestry,
+    };
+}
+/** Mint standalone facts only after host caller and Release admission. */
+export function admittedCallerFacts(installation, release, context, grants, ancestry = [], sessionId, agentPolicy, method, origin) {
+    const deadlineAt = Date.now() + APP_INVOCATION_CEILING_MS;
+    return invocationFacts.fromCaller({ ...invocationAuthorityOf(installation, release, ancestry), grants }, method === undefined
+        ? context
+        : backgroundContext(context, ancestry, method, origin), { deadlineAt, grantExpiresAt: deadlineAt }, method, sessionId, agentPolicy);
+}
+/** Seal the host-verified named method after its current admission checks. */
+export async function admittedMethodCallerFacts(host, installation, release, context, grants, method, ancestry = [], sessionId, agentPolicy) {
+    if (release.api?.methods[method.name]?.effect !== method.effect)
+        throw new Error("Invocation method is not verified by the Release");
+    let origin;
+    if (method.effect === "write" && mayDefer(context, ancestry)) {
+        if (host.backgroundOriginKey === undefined)
+            throw new Error("Background origin key is not configured");
+        origin = await sealBackgroundOrigin(await host.backgroundOriginKey(), {
+            instanceId: selectionOf(installation).instanceId,
+            lane: actorLane(context.actor),
+            method: method.name,
+        });
+    }
+    return admittedCallerFacts(installation, release, context, grants, ancestry, sessionId, agentPolicy, method, origin);
+}

package/dist/keys.d.ts

@@ -0,0 +1,48 @@
+import type { Grant, GrantVocabulary, Scope } from "@fungi.computer/ear-tag/grants";
+import type { KeyPrincipal, KeyRecord, KeyStore } from "@fungi.computer/ear-tag/keys";
+import type { AppToolPolicy } from "./apps/tools.js";
+/** Every capability an Oyster key may carry. */
+export type OysterKeyCapability = "apps.read" | "apps.use" | "computer.use";
+/**
+ * `apps.use` also reaches `apps.read` (one level, per `defineGrants`'s own
+ * `implies`): a key that may change an App's data may also read it.
+ * `computer.use` has no narrower capability under it; the Computer is on or
+ * off, host-wide.
+ */
+export declare const oysterKeyVocabulary: GrantVocabulary<OysterKeyCapability>;
+/** A grant reaching every current and future installation for `capability`. */
+export declare function allInstallations(capability: "apps.read" | "apps.use"): Grant<OysterKeyCapability>;
+/** The grant that turns on the Computer for a key, host-wide; there is no narrower target. */
+export declare const computerUseGrant: Grant<OysterKeyCapability>;
+/** One key's durable record, in the shape a host's own App reads. */
+export type OysterKeyRecord = KeyRecord<OysterKeyCapability>;
+/** One key's live, authenticated principal. */
+export type OysterKeyPrincipal = KeyPrincipal<OysterKeyCapability>;
+/** One key's authority, as `defineGrants` canonicalizes it. */
+export type OysterKeyScope = Scope<OysterKeyCapability>;
+/** The Ear Tag store's own interface, closed over Oyster's capability vocabulary. */
+export type OysterKeyStore = KeyStore<OysterKeyCapability>;
+/**
+ * The minimal live facts `OysterHost`'s `keys.live` port returns: enough to
+ * gate one call, never the key's name or timestamps. `null` for an unknown,
+ * revoked, expired or suspended key -- the same closed set `keyAppAccess`
+ * and `keyAllowsComputerUse` already treat as no authority.
+ */
+export type LiveOysterKey = Readonly<{
+    keyId: string;
+    owner: string;
+    grantVersion: number;
+    grants: readonly Grant<OysterKeyCapability>[];
+}>;
+/**
+ * One live key's access to one installation: `write` when its grants admit
+ * `apps.use` there, `read` when they admit `apps.read`, otherwise `null` --
+ * including for an installation added after the key was issued, unless the
+ * key holds "All Apps" (`targets: {kind: "all"}`). The same shape as an
+ * Agent's stored {@link AppToolPolicy}; its caller adds `bindingName` (which
+ * varies by caller: the plain installation id for the gate, the uppercased
+ * binding name for MCP) to reach the full `AppToolAccess`.
+ */
+export declare function keyAppAccess(key: LiveOysterKey, installationId: string): AppToolPolicy | null;
+/** Whether a live key's own grants turn its Computer access on. Off by default. */
+export declare function keyAllowsComputerUse(key: LiveOysterKey): boolean;

package/dist/keys.js

@@ -0,0 +1,52 @@
+/**
+ * Oyster's own Ear Tag vocabulary: named keys an owner issues for its
+ * installed Apps and, optionally, its Computer. A key's id is its name, so
+ * forks and other name-derived identities stay stable across the cutover.
+ */
+import { defineGrants } from "@fungi.computer/ear-tag/grants";
+/**
+ * `apps.use` also reaches `apps.read` (one level, per `defineGrants`'s own
+ * `implies`): a key that may change an App's data may also read it.
+ * `computer.use` has no narrower capability under it; the Computer is on or
+ * off, host-wide.
+ */
+export const oysterKeyVocabulary = defineGrants({
+    capabilities: ["apps.read", "apps.use", "computer.use"],
+    implies: { "apps.use": ["apps.read"] },
+});
+/** A grant reaching every current and future installation for `capability`. */
+export function allInstallations(capability) {
+    return { capability, targets: { kind: "all" } };
+}
+/** The grant that turns on the Computer for a key, host-wide; there is no narrower target. */
+export const computerUseGrant = {
+    capability: "computer.use",
+    targets: { kind: "all" },
+};
+/**
+ * One live key's access to one installation: `write` when its grants admit
+ * `apps.use` there, `read` when they admit `apps.read`, otherwise `null` --
+ * including for an installation added after the key was issued, unless the
+ * key holds "All Apps" (`targets: {kind: "all"}`). The same shape as an
+ * Agent's stored {@link AppToolPolicy}; its caller adds `bindingName` (which
+ * varies by caller: the plain installation id for the gate, the uppercased
+ * binding name for MCP) to reach the full `AppToolAccess`.
+ */
+export function keyAppAccess(key, installationId) {
+    const level = oysterKeyVocabulary.grantsAllow(key.grants, "apps.use", installationId)
+        ? "write"
+        : oysterKeyVocabulary.grantsAllow(key.grants, "apps.read", installationId)
+            ? "read"
+            : null;
+    if (level === null)
+        return null;
+    return {
+        level,
+        revision: `key:${key.keyId}:${String(key.grantVersion)}`,
+        grantedBy: key.owner,
+    };
+}
+/** Whether a live key's own grants turn its Computer access on. Off by default. */
+export function keyAllowsComputerUse(key) {
+    return oysterKeyVocabulary.grantsAllow(key.grants, "computer.use");
+}

package/dist/mcp-owner.d.ts

@@ -0,0 +1,27 @@
+import { DurableObject } from "cloudflare:workers";
+import type { OysterHost, OysterMcp } from "./host.js";
+import { type TenantScope } from "./tenant.js";
+/** Worker Loader used by the existing Mycelium sandbox. */
+export type OysterMcpOwnerEnv = Readonly<{
+    LOADER: WorkerLoader;
+}>;
+/** Serialized trusted tenant pin supplied by the selected host. */
+export type OysterMcpTenantPin = Readonly<{
+    tenantId: string;
+    origin: string;
+}>;
+/**
+ * One tenant's live SDK transports; cold owners refuse old IDs without execution replay.
+ * The persisted origin is a lifetime pin. Changing the configured origin requires
+ * a fresh MCP namespace; an existing owner never retargets its retained pin.
+ */
+export declare class OysterMcpOwner<Env extends OysterMcpOwnerEnv = OysterMcpOwnerEnv> extends DurableObject<Env> {
+    #private;
+    constructor(ctx: DurableObjectState, env: Env, createHost: (env: Env, scope: TenantScope) => OysterHost);
+    /** Trusted host RPC: the namespace and pin are never selected by guest headers. */
+    serve(request: Request, tenant: OysterMcpTenantPin): Promise<Response>;
+}
+/** Bind the owner to the deployment's existing host factory and options. */
+export declare function createOysterMcpOwner<Env extends OysterMcpOwnerEnv>(host: (env: Env, scope: TenantScope) => OysterHost): new (ctx: DurableObjectState, env: Env) => OysterMcpOwner<Env>;
+/** Frontends own no SDK state and cannot close another isolate's sessions. */
+export declare function remoteOysterMcp(binding: DurableObjectNamespace<OysterMcpOwner> | undefined, scope: TenantScope): OysterMcp;

package/dist/mcp-owner.js

@@ -0,0 +1,143 @@
+import { DurableObject } from "cloudflare:workers";
+import { nanoid } from "@fungi.computer/cairn";
+import { createMcp, createMcpCatalog, } from "@fungi.computer/mycelium/mcp";
+import { createCodemodeSandbox } from "@fungi.computer/mycelium/workers";
+import { parseJSONRPCMessage, serializeMessage, } from "@modelcontextprotocol/server";
+import * as Schema from "effect/Schema";
+import { oysterMcpCatalogLoad } from "./mcp.js";
+import { tenantIdSchema, tenantScope } from "./tenant.js";
+const pinSchema = Schema.Struct({
+    tenant_id: tenantIdSchema,
+    origin: Schema.String,
+});
+const eventSchema = Schema.Struct({
+    event_id: Schema.String,
+    stream_id: Schema.String,
+    message: Schema.String,
+    sequence: Schema.Number,
+});
+/**
+ * One tenant's live SDK transports; cold owners refuse old IDs without execution replay.
+ * The persisted origin is a lifetime pin. Changing the configured origin requires
+ * a fresh MCP namespace; an existing owner never retargets its retained pin.
+ */
+export class OysterMcpOwner extends DurableObject {
+    #mcp;
+    #createHost;
+    constructor(ctx, env, createHost) {
+        super(ctx, env);
+        this.#createHost = createHost;
+        ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS oyster_mcp_tenant (id INTEGER PRIMARY KEY CHECK(id=1), tenant_id TEXT NOT NULL, origin TEXT NOT NULL) STRICT");
+        ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS oyster_mcp_sessions (protocol_id TEXT PRIMARY KEY, catalog_id TEXT NOT NULL, principal TEXT NOT NULL) STRICT");
+        ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS oyster_mcp_events (sequence INTEGER PRIMARY KEY AUTOINCREMENT, catalog_id TEXT NOT NULL, event_id TEXT NOT NULL UNIQUE, stream_id TEXT NOT NULL, message TEXT NOT NULL) STRICT");
+        // The SDK has no transport snapshot restore port. Expire SDK-only state,
+        // retaining the trusted tenant pin and all host-owned business history.
+        ctx.storage.transactionSync(() => {
+            ctx.storage.sql.exec("DELETE FROM oyster_mcp_events");
+            ctx.storage.sql.exec("DELETE FROM oyster_mcp_sessions");
+        });
+    }
+    #eventStore(catalogId) {
+        const sql = this.ctx.storage.sql;
+        const find = (eventId) => {
+            const row = sql
+                .exec("SELECT sequence, event_id, stream_id, message FROM oyster_mcp_events WHERE catalog_id=? AND event_id=?", catalogId, eventId)
+                .toArray()[0];
+            return row === undefined
+                ? undefined
+                : Schema.decodeUnknownSync(eventSchema)(row);
+        };
+        return {
+            storeEvent: (streamId, message) => {
+                const id = nanoid();
+                sql.exec("INSERT INTO oyster_mcp_events (catalog_id, event_id, stream_id, message) VALUES (?,?,?,?)", catalogId, id, streamId, serializeMessage(message));
+                return Promise.resolve(id);
+            },
+            getStreamIdForEventId: (id) => Promise.resolve(find(id)?.stream_id),
+            replayEventsAfter: async (id, { send }) => {
+                const after = find(id);
+                if (after === undefined)
+                    throw new Error("MCP event unavailable");
+                const rows = sql
+                    .exec("SELECT sequence, event_id, stream_id, message FROM oyster_mcp_events WHERE catalog_id=? AND stream_id=? AND sequence>? ORDER BY sequence", catalogId, after.stream_id, after.sequence)
+                    .toArray();
+                for (const raw of rows) {
+                    const row = Schema.decodeUnknownSync(eventSchema)(raw);
+                    await send(row.event_id, parseJSONRPCMessage(JSON.parse(row.message)));
+                }
+                return after.stream_id;
+            },
+        };
+    }
+    /** Trusted host RPC: the namespace and pin are never selected by guest headers. */
+    async serve(request, tenant) {
+        const scope = tenantScope(Schema.decodeUnknownSync(tenantIdSchema)(tenant.tenantId), tenant.origin);
+        if (this.ctx.id.name !== scope.durableName("mcp") ||
+            new URL(request.url).origin !== scope.origin)
+            return new Response("Not found", { status: 404 });
+        const sql = this.ctx.storage.sql;
+        const raw = sql
+            .exec("SELECT tenant_id, origin FROM oyster_mcp_tenant WHERE id=1")
+            .toArray()[0];
+        if (raw !== undefined) {
+            const pin = Schema.decodeUnknownSync(pinSchema)(raw);
+            if (pin.tenant_id !== scope.tenantId || pin.origin !== scope.origin)
+                return new Response("Not found", { status: 404 });
+        }
+        else {
+            sql.exec("INSERT INTO oyster_mcp_tenant (id, tenant_id, origin) VALUES (1,?,?)", scope.tenantId, scope.origin);
+        }
+        if (this.#mcp === undefined) {
+            const host = this.#createHost(this.env, scope);
+            const persistence = {
+                eventStore: (id) => this.#eventStore(id),
+                initialized: (id, session) => {
+                    sql.exec("INSERT INTO oyster_mcp_sessions (protocol_id, catalog_id, principal) VALUES (?,?,?)", id, session.id, JSON.stringify(session.principal));
+                    return Promise.resolve();
+                },
+                closed: (id, session) => {
+                    this.ctx.storage.transactionSync(() => {
+                        sql.exec("DELETE FROM oyster_mcp_events WHERE catalog_id=?", session.id);
+                        sql.exec("DELETE FROM oyster_mcp_sessions WHERE protocol_id=?", id);
+                    });
+                    return Promise.resolve();
+                },
+            };
+            this.#mcp = createMcp({
+                persistence,
+                catalog: createMcpCatalog({
+                    load: oysterMcpCatalogLoad(host),
+                    sandbox: createCodemodeSandbox(this.env.LOADER),
+                }),
+                authenticate: async (incoming) => {
+                    const admission = await host.auth.authenticate(incoming);
+                    return admission.kind === "refused"
+                        ? admission
+                        : { kind: "admitted", principal: admission.principal };
+                },
+            });
+        }
+        return this.#mcp.handleRequest(request);
+    }
+}
+/** Bind the owner to the deployment's existing host factory and options. */
+export function createOysterMcpOwner(host) {
+    return class extends OysterMcpOwner {
+        constructor(ctx, env) {
+            super(ctx, env, host);
+        }
+    };
+}
+/** Frontends own no SDK state and cannot close another isolate's sessions. */
+export function remoteOysterMcp(binding, scope) {
+    return {
+        async handleRequest(request) {
+            if (binding === undefined)
+                return new Response("MCP owner binding unavailable", { status: 503 });
+            const response = await binding
+                .getByName(scope.durableName("mcp"))
+                .serve(request, { tenantId: scope.tenantId, origin: scope.origin });
+            return response;
+        },
+    };
+}