@fungi.computer/oyster 0.0.0-stage → 0.0.1

package/dist/source/template-write.js

@@ -0,0 +1,344 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import { memfs } from "memfs";
+import { dirname, join } from "node:path";
+import * as git from "isomorphic-git";
+import * as Schema from "effect/Schema";
+import { parseAppId, parseSourceRevision } from "@fungi.computer/puffball";
+import { appIdSchema, sha256DigestSchema, sourceRevisionSchema, } from "@fungi.computer/puffball/effect";
+import { capturedPinnedRecipeSchema, digestPinnedRecipe, } from "../build-contract.js";
+import { templateRepositoryForApp } from "./template-repository.js";
+function logEvent(operation, cause) {
+    console.error(JSON.stringify({
+        source: "app-publisher",
+        operation,
+        failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+    }));
+}
+class TemplateRequestTooLarge extends Error {
+}
+/** A bounded operator source upload; decoding happens only at the Publisher boundary. */
+export const TEMPLATE_WRITE_MAX_REQUEST_BYTES = 24 * 1024 * 1024;
+const templatePathSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((path) => path.length > 0 &&
+    path.length <= 4096 &&
+    !path.includes("\\") &&
+    !path.includes("\0") &&
+    path
+        .split("/")
+        .every((part) => part !== "" &&
+        part !== "." &&
+        part !== ".." &&
+        part.toLowerCase() !== ".git"))));
+export const templateWriteInputSchema = Schema.Struct({
+    appId: appIdSchema,
+    sourceRevision: sourceRevisionSchema,
+    sourceTreeDigest: sha256DigestSchema,
+    recipe: capturedPinnedRecipeSchema,
+    files: Schema.Array(Schema.Struct({
+        path: templatePathSchema,
+        contents: Schema.Uint8ArrayFromBase64,
+    })).pipe(Schema.check(Schema.makeFilter((files) => files.length > 0 && files.length <= 10_000))),
+});
+/** Isomorphic Git owns the protocol; the existing Artifacts owner owns every
+ * credential and revokes it when the response stream closes. */
+function templateHttp(transport, repository, signal) {
+    const readers = new Set();
+    const close = async (reader) => {
+        if (!readers.delete(reader))
+            return;
+        try {
+            await reader.cancel();
+        }
+        finally {
+            reader.releaseLock();
+        }
+    };
+    return {
+        async [Symbol.asyncDispose]() {
+            const results = await Promise.allSettled([...readers].map(close));
+            if (results.some((result) => result.status === "rejected"))
+                throw new Error("Template Git response cleanup failed");
+        },
+        async request(input) {
+            signal.throwIfAborted();
+            const chunks = input.body;
+            const iterator = chunks === undefined
+                ? undefined
+                : (async function* () {
+                    yield* chunks;
+                })();
+            const body = iterator === undefined
+                ? null
+                : new ReadableStream({
+                    async pull(controller) {
+                        const item = await iterator.next();
+                        if (item.done)
+                            controller.close();
+                        else
+                            controller.enqueue(item.value);
+                    },
+                    async cancel() {
+                        await iterator.return(undefined);
+                    },
+                });
+            const init = {
+                method: input.method ?? "GET",
+                headers: new Headers(input.headers),
+                body,
+                signal,
+            };
+            if (body !== null)
+                Object.assign(init, { duplex: "half" });
+            const response = await transport.exchangeTemplateGit(repository, new Request(input.url, init));
+            // Own the reader before handing the iterable to Git, including when the
+            // client never starts iteration or abandons it without calling return().
+            const reader = response.body?.getReader();
+            if (reader !== undefined)
+                readers.add(reader);
+            async function* responseChunks() {
+                if (reader === undefined)
+                    return;
+                try {
+                    for (;;) {
+                        signal.throwIfAborted();
+                        const item = await reader.read();
+                        if (item.done)
+                            return;
+                        yield item.value;
+                    }
+                }
+                finally {
+                    await close(reader);
+                }
+            }
+            return {
+                url: input.url,
+                method: input.method,
+                statusCode: response.status,
+                statusMessage: response.statusText,
+                headers: Object.fromEntries(response.headers),
+                body: responseChunks(),
+            };
+        },
+    };
+}
+/** Each request owns an in-memory Git working tree. Uploaded source never
+ * executes here and callers supply no provider token; the maintained Git client
+ * writes and compares trees. */
+async function writeTemplate(transport, input, repository, signal) {
+    const env_1 = { stack: [], error: void 0, hasError: false };
+    try {
+        const { fs } = memfs();
+        const dir = "/template";
+        await git.init({ fs, dir, defaultBranch: "main" });
+        const paths = new Set();
+        for (const file of input.files) {
+            signal.throwIfAborted();
+            if (paths.has(file.path))
+                throw new Error("Duplicate template source path");
+            paths.add(file.path);
+            const target = join(dir, file.path);
+            await fs.promises.mkdir(dirname(target), { recursive: true });
+            await fs.promises.writeFile(target, file.contents);
+        }
+        await git.add({ fs, dir, filepath: [...paths], force: true });
+        const oid = await git.commit({
+            fs,
+            dir,
+            author: {
+                name: "Botanical App Source",
+                email: "app-source@botanical.invalid",
+                timestamp: 0,
+                timezoneOffset: 0,
+            },
+            message: `Seed ${input.appId} from ${input.sourceRevision}`,
+        });
+        const http = __addDisposableResource(env_1, templateHttp(transport, repository, signal), true);
+        const url = `https://git.team.internal/${repository}.git`;
+        await git.addRemote({ fs, dir, remote: "origin", url });
+        const refs = await git.listServerRefs({
+            http,
+            url,
+            prefix: "refs/heads/main",
+        });
+        const main = refs.find((ref) => ref.ref === "refs/heads/main");
+        if (main !== undefined) {
+            await git.fetch({
+                fs,
+                http,
+                dir,
+                url,
+                ref: "main",
+                singleBranch: true,
+                depth: 1,
+                tags: false,
+            });
+            const expected = await git.readCommit({ fs, dir, oid });
+            const actual = await git.readCommit({ fs, dir, oid: main.oid });
+            if (expected.commit.tree !== actual.commit.tree)
+                return null;
+        }
+        if (main === undefined) {
+            // isomorphic-git's pack writer sends whole objects, preserving Artifacts
+            // native forks' requirement that seed packs contain no delta objects.
+            const pushed = await git.push({
+                fs,
+                http,
+                dir,
+                url,
+                ref: "main",
+                remoteRef: "main",
+                signal,
+            });
+            if (!pushed.ok)
+                throw new Error("Template Git push refused");
+        }
+        // A successful push or matching fetched tree is not sufficient: retain the
+        // former Publisher receipt check that main still names this exact commit.
+        const expectedHead = main?.oid ?? oid;
+        const confirmed = await git.listServerRefs({
+            http,
+            url,
+            prefix: "refs/heads/main",
+        });
+        return confirmed.find((ref) => ref.ref === "refs/heads/main")?.oid ===
+            expectedHead
+            ? expectedHead
+            : null;
+    }
+    catch (e_1) {
+        env_1.error = e_1;
+        env_1.hasError = true;
+    }
+    finally {
+        const result_1 = __disposeResources(env_1);
+        if (result_1)
+            await result_1;
+    }
+}
+/** The only operator template-write result contains provenance, never custody. */
+export async function seedPublisherTemplate(receipts, transport, rawAppId, request) {
+    try {
+        const appId = parseAppId(rawAppId);
+        const length = Number(request.headers.get("content-length") ?? "0");
+        if (!Number.isSafeInteger(length) ||
+            length < 0 ||
+            length > TEMPLATE_WRITE_MAX_REQUEST_BYTES)
+            return { kind: "too-large" };
+        const signal = AbortSignal.any([
+            request.signal,
+            AbortSignal.timeout(240_000),
+        ]);
+        let bytes = 0;
+        const bounded = request.body?.pipeThrough(new TransformStream({
+            transform(chunk, controller) {
+                bytes += chunk.byteLength;
+                if (bytes > TEMPLATE_WRITE_MAX_REQUEST_BYTES)
+                    throw new TemplateRequestTooLarge();
+                controller.enqueue(chunk);
+            },
+        }), { signal });
+        let input;
+        try {
+            const body = await new Response(bounded).json();
+            input = Schema.decodeUnknownSync(templateWriteInputSchema, {
+                onExcessProperty: "error",
+            })(body);
+        }
+        catch (cause) {
+            logEvent("operator.template.decode", cause);
+            return {
+                kind: cause instanceof TemplateRequestTooLarge ? "too-large" : "invalid",
+            };
+        }
+        if (input.appId !== appId)
+            return { kind: "conflict" };
+        const repository = templateRepositoryForApp(appId);
+        await transport.ensureRepository(repository);
+        const oid = await writeTemplate(transport, input, repository, signal);
+        if (oid === null)
+            return { kind: "conflict" };
+        const seedRevision = parseSourceRevision(`git:${oid}`);
+        const receipt = {
+            appId,
+            sourceRevision: input.sourceRevision,
+            sourceTreeDigest: input.sourceTreeDigest,
+            seedRevision,
+            recipe: input.recipe,
+            buildRecipeDigest: digestPinnedRecipe(input.recipe),
+        };
+        const existing = await receipts.read(appId, seedRevision);
+        if (existing !== null &&
+            (existing.sourceRevision !== receipt.sourceRevision ||
+                existing.sourceTreeDigest !== receipt.sourceTreeDigest ||
+                existing.buildRecipeDigest !== receipt.buildRecipeDigest))
+            return { kind: "conflict" };
+        // Recording still uses the write-once, digest-checked Publisher receipt owner.
+        await receipts.record(receipt);
+        return {
+            kind: existing === null ? "recorded" : "existing",
+            receipt: {
+                appId,
+                repository,
+                sourceRevision: receipt.sourceRevision,
+                sourceTreeDigest: receipt.sourceTreeDigest,
+                seedRevision,
+                buildRecipeDigest: receipt.buildRecipeDigest,
+            },
+        };
+    }
+    catch (cause) {
+        logEvent("operator.template.write", cause);
+        return { kind: "unavailable" };
+    }
+}

package/dist/storage-frame.d.ts

@@ -0,0 +1,64 @@
+import * as Schema from "effect/Schema";
+/** The storage codecs and operation checks used by both sides of the native frame. */
+export declare const storageFrameMethods: {
+    APP_STORAGE: {
+        read: {
+            decodeArgs: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => readonly [string];
+            decodeResult: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => {
+                readonly kind: "accepted";
+                readonly value: {
+                    readonly value: Schema.Json;
+                    readonly source: "team" | "member" | "none";
+                    readonly team: {
+                        readonly value: Schema.Json;
+                        readonly revision: number;
+                    } | null;
+                    readonly member: {
+                        readonly value: Schema.Json;
+                        readonly revision: number;
+                    } | null;
+                    readonly canWriteTeam: boolean;
+                };
+            } | {
+                readonly kind: "rejected";
+                readonly code: "unavailable" | "invalid" | "undeclared_key" | "scope_not_declared" | "owner_required" | "too_large" | "quota_exceeded" | "conflict";
+            };
+            requiredOperations: () => string[];
+        };
+        write: {
+            decodeArgs: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => readonly [{
+                readonly value: Schema.Json;
+                readonly key: string;
+                readonly scope: "team" | "member";
+                readonly basedOn: number | null;
+            }];
+            decodeResult: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => {
+                readonly kind: "accepted";
+                readonly value: {
+                    readonly revision: number;
+                };
+            } | {
+                readonly kind: "rejected";
+                readonly code: "unavailable" | "invalid" | "undeclared_key" | "scope_not_declared" | "owner_required" | "too_large" | "quota_exceeded" | "conflict";
+            };
+            requiredOperations: () => string[];
+        };
+        reset: {
+            decodeArgs: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => readonly [{
+                readonly key: string;
+                readonly scope: "team" | "member";
+                readonly basedOn: number | null;
+            }];
+            decodeResult: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => {
+                readonly kind: "accepted";
+                readonly value: {
+                    readonly revision: number;
+                };
+            } | {
+                readonly kind: "rejected";
+                readonly code: "unavailable" | "invalid" | "undeclared_key" | "scope_not_declared" | "owner_required" | "too_large" | "quota_exceeded" | "conflict";
+            };
+            requiredOperations: () => string[];
+        };
+    };
+};

package/dist/storage-frame.js

@@ -0,0 +1,28 @@
+import * as Schema from "effect/Schema";
+import { appStorageKeyNameSchema, appStorageWriteSchema, appStorageResetSchema, appStorageReadResultSchema, appStorageMutationResultSchema, } from "@fungi.computer/agar/storage";
+/** The storage codecs and operation checks used by both sides of the native frame. */
+export const storageFrameMethods = {
+    APP_STORAGE: {
+        read: {
+            decodeArgs: Schema.decodeUnknownSync(Schema.Tuple([appStorageKeyNameSchema]), { onExcessProperty: "error" }),
+            decodeResult: Schema.decodeUnknownSync(appStorageReadResultSchema, {
+                onExcessProperty: "error",
+            }),
+            requiredOperations: () => ["read"],
+        },
+        write: {
+            decodeArgs: Schema.decodeUnknownSync(Schema.Tuple([appStorageWriteSchema]), { onExcessProperty: "error" }),
+            decodeResult: Schema.decodeUnknownSync(appStorageMutationResultSchema, {
+                onExcessProperty: "error",
+            }),
+            requiredOperations: () => ["write"],
+        },
+        reset: {
+            decodeArgs: Schema.decodeUnknownSync(Schema.Tuple([appStorageResetSchema]), { onExcessProperty: "error" }),
+            decodeResult: Schema.decodeUnknownSync(appStorageMutationResultSchema, {
+                onExcessProperty: "error",
+            }),
+            requiredOperations: () => ["reset"],
+        },
+    },
+};

package/dist/tenant.d.ts

@@ -0,0 +1,81 @@
+import type { HostActor } from "@fungi.computer/puffball/app-method-runtime";
+import * as Schema from "effect/Schema";
+import type { OysterAuth } from "./host.js";
+/**
+ * A host-minted tenant slug: 2–40 lowercase ASCII letters or digits, with
+ * single interior hyphens. The repository separator `--` is forbidden.
+ * Hosts resolve it before authentication; App-controlled inputs never select it.
+ */
+export declare const tenantIdSchema: Schema.brand<Schema.String, "OysterTenantId">;
+/** A validated host-selected tenant identity. */
+export type TenantId = typeof tenantIdSchema.Type;
+/** A canonical host actor with a tenant role only when the actor is a member. */
+export type TenantPrincipal = Readonly<{
+    /** Stored member identity resolved by the tenant registry. */
+    actor: Extract<HostActor, {
+        kind: "member";
+    }>;
+    /** The member's admitted role; membership does not imply ownership. */
+    role: "owner" | "member";
+    /** The host attests this member is the tenant's only member. */
+    soleMember?: true;
+}> | Readonly<{
+    /** An Agent or Team key retains its canonical actor identity. */
+    actor: Exclude<HostActor, {
+        kind: "member";
+    }>;
+}>;
+/** The single-tenant Oyster identity whose durable names remain unchanged. */
+export declare const defaultTenant: TenantId;
+/** Resolves a request before authentication; null means refuse, never fallback. */
+export type TenantResolver = Readonly<{
+    /** Return the host-selected tenant and canonical origin, or refuse this URL. */
+    resolve(request: Request): Promise<Readonly<{
+        tenantId: TenantId;
+        origin: string;
+    }> | null>;
+}>;
+/** The only source of durable names for a standalone Oyster tenant. */
+export type TenantScope = Readonly<{
+    /** Host-selected tenant identity; never taken from App input. */
+    tenantId: TenantId;
+    /** Canonical HTTP(S) origin for this tenant's public routes. */
+    origin: string;
+    /** Name of a tenant-owned Durable Object within its binding namespace. */
+    durableName(kind: "registry" | "keys" | "webhooks" | "git-push" | "agents" | "mcp"): string;
+    /** Name within the Computer binding; nondefault Computers await host support. */
+    computerName(computerId: string): string;
+    /** R2 prefix for mutable workspace files; immutable release bytes may be shared. */
+    workspacePrefix: string;
+    /**
+     * Provider prefix for an installation slug without `--`.
+     * The Git adapter must validate the final prefix + repo against the provider's
+     * 128-character limit; a prefix alone cannot establish that a repo name fits.
+     */
+    repositoryPrefix(installationId: string): string;
+}>;
+/**
+ * Name tenant-owned stores without changing any default-tenant name. The `t.`
+ * repository namespace cannot be a default installation slug, which forbids dots.
+ * Hub supplies its own Team-scoped ports and does not use this naming contract.
+ */
+export declare function tenantScope(tenantId: TenantId, origin: string): TenantScope;
+/**
+ * Admit defaultTenant only at the configured origin. Scheme, host and port must
+ * match after URL canonicalization; unknown origins never fall back to default.
+ */
+export declare function singleTenant(origin: string): TenantResolver;
+/** A host-selected scope paired with its existing authentication port. */
+export type ResolvedTenant = Readonly<{
+    /** Canonical origin and durable names selected before authentication. */
+    scope: TenantScope;
+    /** Authentication bound to this tenant; resolution does not invoke it. */
+    auth: OysterAuth;
+}>;
+/** Resolve an origin-scoped host; null refuses the request without a fallback. */
+export type OysterTenancy = Readonly<{
+    /** Select one tenant before authentication; unknown origins return null. */
+    resolve(request: Request): Promise<ResolvedTenant | null>;
+}>;
+/** Preserve the default tenant's names and auth only at the configured origin. */
+export declare function implicitTenancy(origin: string, auth: OysterAuth): OysterTenancy;

package/dist/tenant.js

@@ -0,0 +1,71 @@
+import * as Schema from "effect/Schema";
+/**
+ * A host-minted tenant slug: 2–40 lowercase ASCII letters or digits, with
+ * single interior hyphens. The repository separator `--` is forbidden.
+ * Hosts resolve it before authentication; App-controlled inputs never select it.
+ */
+export const tenantIdSchema = Schema.String.check(Schema.isPattern(/^[a-z0-9](?:[a-z0-9]|-(?!-)){0,38}[a-z0-9]$/u)).pipe(Schema.brand("OysterTenantId"));
+/** The single-tenant Oyster identity whose durable names remain unchanged. */
+export const defaultTenant = Schema.decodeUnknownSync(tenantIdSchema)("default");
+function configuredOrigin(origin) {
+    const url = new URL(origin);
+    if (!["https:", "http:"].includes(url.protocol) ||
+        url.username !== "" ||
+        url.password !== "" ||
+        url.pathname !== "/" ||
+        url.search !== "" ||
+        url.hash !== "") {
+        throw new TypeError("Configure an HTTP(S) origin without credentials or a path");
+    }
+    return url;
+}
+const installationIdSchema = Schema.String.check(Schema.isPattern(/^[a-z][a-z0-9-]{0,62}$/u), Schema.isPattern(/^(?!.*--)/u));
+/**
+ * Name tenant-owned stores without changing any default-tenant name. The `t.`
+ * repository namespace cannot be a default installation slug, which forbids dots.
+ * Hub supplies its own Team-scoped ports and does not use this naming contract.
+ */
+export function tenantScope(tenantId, origin) {
+    const canonicalOrigin = configuredOrigin(origin).origin;
+    const isDefault = tenantId === defaultTenant;
+    const durablePrefix = isDefault ? "" : `t.${tenantId}.`;
+    return {
+        tenantId,
+        origin: canonicalOrigin,
+        durableName: (kind) => `${durablePrefix}${kind}`,
+        computerName: (computerId) => `${durablePrefix}${computerId}`,
+        workspacePrefix: isDefault
+            ? "workspace/"
+            : `tenants/${tenantId}/workspace/`,
+        repositoryPrefix(installationId) {
+            const installation = Schema.decodeUnknownSync(installationIdSchema)(installationId);
+            return isDefault
+                ? `${installation}--`
+                : `t.${tenantId}--${installation}--`;
+        },
+    };
+}
+/**
+ * Admit defaultTenant only at the configured origin. Scheme, host and port must
+ * match after URL canonicalization; unknown origins never fall back to default.
+ */
+export function singleTenant(origin) {
+    const canonicalOrigin = configuredOrigin(origin).origin;
+    return {
+        resolve: (request) => Promise.resolve(new URL(request.url).origin === canonicalOrigin
+            ? { tenantId: defaultTenant, origin: canonicalOrigin }
+            : null),
+    };
+}
+/** Preserve the default tenant's names and auth only at the configured origin. */
+export function implicitTenancy(origin, auth) {
+    const resolver = singleTenant(origin);
+    const scope = tenantScope(defaultTenant, origin);
+    return {
+        async resolve(request) {
+            return (await resolver.resolve(request)) === null
+                ? null
+                : { scope, auth };
+        },
+    };
+}

package/dist/testing/capabilities.d.ts

@@ -0,0 +1,29 @@
+import { Hono } from "hono";
+import { type AppCapabilityId } from "@fungi.computer/puffball/app";
+import { type OysterAgents } from "../agents.js";
+import { type FileSource } from "../files.js";
+import { type OysterAuthResult, type OysterCapability } from "../host.js";
+/** How one capability fixture host admits its single installation. */
+export type CapabilityFixtureOptions = Readonly<{
+    /** `false` publishes a Release that declares no capability. */
+    declared?: boolean;
+    /** Capabilities the Release declares; defaults to `computer.list`. */
+    capabilities?: readonly AppCapabilityId[];
+    /** Adapters the host grants; defaults to a `computer.list` probe. */
+    adapters?: readonly OysterCapability[];
+    /** Grant the file adapters over this source instead of the probe. */
+    fileSource?: FileSource;
+    /** `false` clears the owner's approval after install. */
+    admitted?: boolean;
+    /** Serve a public installation to an anonymous visitor. */
+    visitor?: boolean;
+    authenticate?: (request: Request) => Promise<OysterAuthResult>;
+    agents?: OysterAgents;
+}>;
+/** One Oyster host with a single installation whose capability grants the options shape. */
+export declare function capabilityFixture(options?: CapabilityFixtureOptions): Promise<{
+    app: Hono<import("../host.js").OysterEnv, import("hono/types").BlankSchema, "/">;
+    page: () => Response | Promise<Response>;
+    request: () => Response | Promise<Response>;
+    removeDeclaration(): Promise<void>;
+}>;