@fungi.computer/oyster 0.0.0-stage → 0.0.1

package/dist/apps/operations.js

@@ -0,0 +1,98 @@
+import { appBackendBindingOperation, } from "@fungi.computer/puffball/app";
+import { sha256 } from "../release.js";
+import canonicalJson from "fast-json-stable-stringify";
+import { declaredOperationsSchema, } from "./installation.js";
+/** Qualify backend operations so a same-named browser method grants no backend authority. */
+export function bindingOperationKey(binding, operation) {
+    return `binding:${binding}:${operation}`;
+}
+/** Approval identity for one UI-side target method; upgrades intersect these exact pairs. */
+export function appCallOperation(appId, method) {
+    return `route:apps.call:${appId}:${method}`;
+}
+/** Sole derivation owner. Inputs are the verified Release declaration and existing host adapters. */
+export async function deriveDeclaredOperations(release, declaration, descriptors) {
+    if (descriptors.some((descriptor) => descriptor.id === "app.methods"))
+        throw new Error("app_methods_descriptor_reserved");
+    const capabilities = new Map(declaration.capabilities.map((capability) => [
+        capability,
+        new Set(),
+    ]));
+    for (const call of declaration.calls ?? [])
+        for (const method of call.methods)
+            capabilities.get("apps.call")?.add(appCallOperation(call.appId, method));
+    for (const [name, method] of Object.entries(declaration.api?.methods ?? {}))
+        for (const capability of method.requires)
+            capabilities.get(capability)?.add(`route:app.methods:${name}`);
+    const routes = descriptors
+        .filter((descriptor) => capabilities.has(descriptor.permission))
+        .map((descriptor) => {
+        const methods = Object.entries(descriptor.methods).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+        for (const [name] of methods)
+            capabilities
+                .get(descriptor.permission)
+                ?.add(`route:${descriptor.id}:${name}`);
+        return { id: descriptor.id, permission: descriptor.permission, methods };
+    })
+        .sort((a, b) => a.id < b.id
+        ? -1
+        : a.id > b.id
+            ? 1
+            : a.permission < b.permission
+                ? -1
+                : a.permission > b.permission
+                    ? 1
+                    : 0);
+    const bindings = (declaration.backend?.bindings ?? [])
+        .flatMap((binding) => binding.operations.flatMap((name) => {
+        const operation = appBackendBindingOperation(binding.name, name);
+        if (!operation?.requires.every((capability) => capabilities.has(capability)))
+            return [];
+        for (const capability of operation.requires)
+            capabilities
+                .get(capability)
+                ?.add(bindingOperationKey(binding.name, name));
+        return [
+            {
+                binding: binding.name,
+                operation: name,
+                effect: operation.effect,
+                requires: [...operation.requires].sort(),
+            },
+        ];
+    }))
+        .sort((a, b) => bindingOperationKey(a.binding, a.operation) <
+        bindingOperationKey(b.binding, b.operation)
+        ? -1
+        : bindingOperationKey(a.binding, a.operation) >
+            bindingOperationKey(b.binding, b.operation)
+            ? 1
+            : 0);
+    const rows = [...capabilities]
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([capability, operations]) => ({
+        capability,
+        operations: [...operations].sort(),
+    }));
+    const artifactDigest = release.artifact.artifactDigest;
+    const anonymousMethods = await Promise.all(Object.entries(declaration.api?.methods ?? {})
+        .filter(([, method]) => method.anonymous === true)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(async ([name, method]) => ({
+        name,
+        digest: await sha256(new TextEncoder().encode(canonicalJson(method))),
+    })));
+    const digest = await sha256(new TextEncoder().encode(JSON.stringify({
+        artifactDigest,
+        capabilities: rows,
+        routes,
+        bindings,
+        anonymousMethods,
+    })));
+    return declaredOperationsSchema.parse({
+        artifactDigest,
+        digest,
+        capabilities: rows,
+        anonymousMethods,
+    });
+}

package/dist/apps/tools.d.ts

@@ -0,0 +1,33 @@
+import * as Schema from "effect/Schema";
+import type { AppApi, AppDeclaration } from "@fungi.computer/puffball/app";
+import type { Installation, DeclaredOperations } from "./installation.js";
+/**
+ * One App-tool access level, with its own freshness pin. An Agent's comes
+ * from the owner's stored direct approval; a key's is computed fresh from
+ * its own Ear Tag grants (`keyAppAccess`), never stored as this shape --
+ * only read through it, for one call or one installation at a time.
+ */
+export declare const appToolPolicySchema: Schema.Struct<{
+    readonly level: Schema.Literals<readonly ["read", "write"]>;
+    readonly revision: Schema.NonEmptyString;
+    readonly grantedBy: Schema.NonEmptyString;
+}>;
+/** The authenticated attaching member is recorded when this policy is approved. */
+export type AppToolPolicy = typeof appToolPolicySchema.Type;
+/** One installation's binding under the captured host approval. */
+export declare const appToolAccessSchema: Schema.Struct<{
+    readonly bindingName: Schema.NonEmptyString;
+    readonly level: Schema.Literals<readonly ["read", "write"]>;
+    readonly revision: Schema.NonEmptyString;
+    readonly grantedBy: Schema.NonEmptyString;
+}>;
+/** One installation binding constrained by an authenticated tool-policy approval. */
+export type AppToolAccess = typeof appToolAccessSchema.Type;
+/** Pre-read entries: the catalog never resolves installations or calls back into a host. */
+export type AppToolEntry = Readonly<{
+    installation: Installation;
+    declaration: AppDeclaration;
+    declaredOperations: DeclaredOperations;
+    api: AppApi | null;
+    access: AppToolAccess | null;
+}>;

package/dist/apps/tools.js

@@ -0,0 +1,17 @@
+import * as Schema from "effect/Schema";
+/**
+ * One App-tool access level, with its own freshness pin. An Agent's comes
+ * from the owner's stored direct approval; a key's is computed fresh from
+ * its own Ear Tag grants (`keyAppAccess`), never stored as this shape --
+ * only read through it, for one call or one installation at a time.
+ */
+export const appToolPolicySchema = Schema.Struct({
+    level: Schema.Literals(["read", "write"]),
+    revision: Schema.NonEmptyString,
+    grantedBy: Schema.NonEmptyString,
+});
+/** One installation's binding under the captured host approval. */
+export const appToolAccessSchema = Schema.Struct({
+    ...appToolPolicySchema.fields,
+    bindingName: Schema.NonEmptyString,
+});

package/dist/auth.d.ts

@@ -0,0 +1,11 @@
+import type { OysterAuth } from "./host.js";
+import type { OysterKeyStore } from "./keys.js";
+/** Cookie emitted by ownerKeyAuth, for composing credential-specific adapters. */
+export declare const ownerKeyCookieName = "oyster_session";
+/**
+ * Single-owner sign-in: a bearer token or a session cookie holding the
+ * owner key's digest. The key itself is never stored in the browser.
+ */
+export declare function ownerKeyAuth(ownerKey: string, ownerId?: string): OysterAuth;
+/** The owner key, or a named key admitted as its canonical Team-key actor. */
+export declare function ownerOrKeyAuth(ownerKey: string, ownerId: string, keys: () => Pick<OysterKeyStore, "verify">): OysterAuth;

package/dist/auth.js

@@ -0,0 +1,93 @@
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import { presentedGitKey } from "./git-auth.js";
+import { sha256 } from "./release.js";
+/** Cookie emitted by ownerKeyAuth, for composing credential-specific adapters. */
+export const ownerKeyCookieName = "oyster_session";
+const loginFormSchema = Schema.Struct({ key: Schema.String });
+/** Compare two secrets through their fixed-length digests, in constant time. */
+async function constantTimeEqual(a, b) {
+    const [left, right] = await Promise.all([
+        sha256(new TextEncoder().encode(a)),
+        sha256(new TextEncoder().encode(b)),
+    ]);
+    let difference = 0;
+    for (let index = 0; index < left.length; index += 1)
+        difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+    return difference === 0;
+}
+/**
+ * Single-owner sign-in: a bearer token or a session cookie holding the
+ * owner key's digest. The key itself is never stored in the browser.
+ */
+export function ownerKeyAuth(ownerKey, ownerId = "owner") {
+    if (ownerKey.length < 24)
+        throw new Error("OYSTER_OWNER_KEY must be at least 24 characters");
+    const sessionValue = sha256(new TextEncoder().encode(`oyster:${ownerKey}`));
+    const owner = {
+        kind: "admitted",
+        principal: { actor: { kind: "member", memberId: ownerId }, role: "owner" },
+    };
+    return {
+        resolve: (actor) => Promise.resolve(actor.kind === "member" && actor.memberId === ownerId
+            ? owner.principal
+            : null),
+        async authenticate(request) {
+            const authorization = request.headers.get("Authorization");
+            if (authorization?.startsWith("Bearer ") === true)
+                return (await constantTimeEqual(authorization.slice(7), ownerKey))
+                    ? owner
+                    : { kind: "refused", status: 401 };
+            const cookie = (request.headers.get("Cookie") ?? "")
+                .split(";")
+                .map((part) => part.trim())
+                .find((part) => part.startsWith(`${ownerKeyCookieName}=`));
+            if (cookie !== undefined &&
+                (await constantTimeEqual(cookie.slice(ownerKeyCookieName.length + 1), await sessionValue)))
+                return owner;
+            return { kind: "refused", status: 401 };
+        },
+        async login(request) {
+            const form = Schema.decodeUnknownOption(loginFormSchema)(Object.fromEntries(await request.formData()));
+            if (Option.isNone(form) ||
+                !(await constantTimeEqual(form.value.key, ownerKey)))
+                return new Response("Wrong key", { status: 401 });
+            return new Response(null, {
+                status: 303,
+                headers: {
+                    Location: "/",
+                    "Set-Cookie": `${ownerKeyCookieName}=${await sessionValue}; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=2592000`,
+                },
+            });
+        },
+    };
+}
+/** The owner key, or a named key admitted as its canonical Team-key actor. */
+export function ownerOrKeyAuth(ownerKey, ownerId, keys) {
+    const owner = ownerKeyAuth(ownerKey, ownerId);
+    return {
+        resolve: (actor) => owner.resolve(actor),
+        async authenticate(request) {
+            const result = await owner.authenticate(request);
+            if (result.kind === "admitted")
+                return result;
+            const presented = presentedGitKey(request);
+            if (presented.kind !== "key")
+                return result;
+            const verified = await keys().verify(presented.value);
+            // A revoked or expired key, or one belonging to a different owner (a
+            // presented secret can never prove that on its own), authenticates as
+            // no one; the owner-key result above still stands.
+            return verified.kind === "ok" && verified.value.owner === ownerId
+                ? {
+                    kind: "admitted",
+                    principal: {
+                        actor: { kind: "team-key", keyId: verified.value.keyId },
+                    },
+                }
+                : result;
+        },
+        login: (request) => owner.login?.(request) ??
+            Promise.resolve(new Response("Sign-in is not available", { status: 404 })),
+    };
+}

package/dist/backend-request.d.ts

@@ -0,0 +1,3 @@
+export declare function appFacetRequest(request: Request): Request;
+/** Only content metadata crosses back from a guest; origin policy is host-owned. */
+export declare function appFacetResponse(response: Response): Response;

package/dist/backend-request.js

@@ -0,0 +1,53 @@
+/** Second boundary before an admitted request enters customer backend code.
+ * Hub normally builds this shape itself; callers of the App runtime must not
+ * be able to pass their own headers through the facet.
+ */
+import { appBackendActorHeader, appBackendComputerHeader, } from "@fungi.computer/agar/backend";
+export function appFacetRequest(request) {
+    const headers = new Headers();
+    for (const name of [
+        "Content-Type",
+        appBackendActorHeader,
+        appBackendComputerHeader,
+    ]) {
+        const value = request.headers.get(name);
+        if (value !== null)
+            headers.set(name, value);
+    }
+    const init = {
+        method: request.method,
+        headers,
+        body: request.body,
+        redirect: "manual",
+    };
+    if (request.body !== null)
+        init.duplex = "half";
+    return new Request(request.url, init);
+}
+/** Only content metadata crosses back from a guest; origin policy is host-owned. */
+export function appFacetResponse(response) {
+    const headers = new Headers();
+    for (const name of [
+        "Content-Type",
+        "Content-Language",
+        "Content-Encoding",
+        "Content-Length",
+        "Content-Disposition",
+        "Content-Range",
+        "Accept-Ranges",
+        "ETag",
+        "Last-Modified",
+    ]) {
+        const value = response.headers.get(name);
+        if (value !== null)
+            headers.set(name, value);
+    }
+    headers.set("Cache-Control", "no-store");
+    headers.set("Content-Security-Policy", "sandbox; default-src 'none'");
+    headers.set("X-Content-Type-Options", "nosniff");
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}

package/dist/build/build-jobs.d.ts

@@ -0,0 +1,128 @@
+import * as Schema from "effect/Schema";
+import type { Sha256Digest } from "@fungi.computer/puffball";
+import type { PinnedRecipe } from "./effect.js";
+/** The secret-free Team job; no provider token enters publication. */
+declare const jobSchema: Schema.Struct<{
+    readonly jobId: Schema.NonEmptyString;
+    readonly computerId: Schema.NonEmptyString;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly issuedAt: Schema.Number;
+    readonly repository: Schema.NonEmptyString;
+    readonly expiresAt: Schema.Number;
+    readonly remote: Schema.NonEmptyString;
+    readonly reportUrl: Schema.NonEmptyString;
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed", "revoked"]>;
+    readonly artifact: Schema.NullOr<Schema.Struct<{
+        readonly digest: Schema.NonEmptyString;
+        readonly bytes: Schema.Number;
+    }>>;
+    readonly detail: Schema.NullOr<Schema.String>;
+}>;
+export type TeamBuildJob = Schema.Schema.Type<typeof jobSchema>;
+export type BuildCredential = Pick<TeamBuildJob, "jobId" | "computerId" | "credentialId" | "repository" | "issuedAt" | "expiresAt" | "remote" | "reportUrl">;
+declare const executionSchema: Schema.Struct<{
+    readonly output: Schema.optional<Schema.NullOr<Schema.Struct<{
+        readonly exitCode: Schema.NullOr<Schema.Number>;
+        readonly stderr: Schema.optional<Schema.String>;
+    }>>>;
+}>;
+export type TeamBuildComputer = Readonly<{
+    applyBuildDecision: (decision: {
+        kind: "build";
+        schemaVersion: 1;
+        teamId: string;
+        computerId: string;
+        jobId: string;
+        credentialId: string;
+        operations: readonly ["computer.execute"];
+        sequence: number;
+        issuedAt: number;
+        expiresAt: number;
+        status: "allowed" | "revoked";
+        basis: {
+            credentialExpiresAt: number;
+        };
+    }) => Promise<void>;
+    execute: (input: {
+        teamId: string;
+        computerId: string;
+        jobId: string;
+        credentialId: string;
+        command: string;
+        timeoutMs: number;
+    }) => Promise<Schema.Schema.Type<typeof executionSchema>>;
+    deliverTeamGitEvents: () => Promise<number>;
+}>;
+/** Publisher executes builds; Team retains job authority, Computer runs them. */
+export declare function createTeamBuildPublisher(options: Readonly<{
+    team: Readonly<{
+        mintTeamBuildCredential: (input: {
+            jobId: string;
+            repository: string;
+            computerId: string;
+            ttlMs: number;
+        }) => Promise<BuildCredential>;
+        revokeTeamBuild: (jobId: string) => Promise<TeamBuildJob>;
+        /** One Team-owned door checks Computer ownership and settles its job. */
+        build: () => Promise<Readonly<{
+            prepare: (jobId: string) => Promise<TeamBuildJob>;
+            read: (jobId: string) => Promise<TeamBuildJob | null>;
+            complete: (jobId: string, status: "succeeded" | "failed", detail: string) => Promise<TeamBuildJob>;
+            deliverProjection: () => Promise<void>;
+            [Symbol.dispose]: () => void;
+        }>>;
+    }>;
+    computer: (computerId: string) => TeamBuildComputer;
+    now?: () => number;
+    teamId: string;
+    maxPermissionAgeMs?: number;
+}>): Readonly<{
+    mint(input: Parameters<typeof options.team.mintTeamBuildCredential>[0]): Promise<BuildCredential>;
+    read(jobId: string): Promise<{
+        readonly jobId: string;
+        readonly computerId: string;
+        readonly credentialId: string;
+        readonly issuedAt: number;
+        readonly repository: string;
+        readonly expiresAt: number;
+        readonly remote: string;
+        readonly reportUrl: string;
+        readonly status: "revoked" | "running" | "failed" | "succeeded";
+        readonly artifact: {
+            readonly digest: string;
+            readonly bytes: number;
+        } | null;
+        readonly detail: string | null;
+    } | null>;
+    revoke(jobId: string): Promise<{
+        readonly jobId: string;
+        readonly computerId: string;
+        readonly credentialId: string;
+        readonly issuedAt: number;
+        readonly repository: string;
+        readonly expiresAt: number;
+        readonly remote: string;
+        readonly reportUrl: string;
+        readonly status: "revoked" | "running" | "failed" | "succeeded";
+        readonly artifact: {
+            readonly digest: string;
+            readonly bytes: number;
+        } | null;
+        readonly detail: string | null;
+    }>;
+    run(input: {
+        jobId: string;
+        command: string;
+        timeoutMs: number;
+    }): Promise<TeamBuildJob>;
+}>;
+/** Fixed captured builder command; neither source nor the customer supplies shell code. */
+export declare function teamAppBuildCommand(configuration: Readonly<{
+    appId: string;
+    sourceRevision: string;
+    source: Readonly<{
+        recipe: PinnedRecipe;
+        buildRecipeDigest: Sha256Digest;
+    }>;
+}>, uploadGrant: string): string;
+export {};

package/dist/build/build-jobs.js

@@ -0,0 +1,197 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import * as Schema from "effect/Schema";
+import { base64url } from "jose";
+/** The secret-free Team job; no provider token enters publication. */
+const jobSchema = Schema.Struct({
+    jobId: Schema.NonEmptyString,
+    computerId: Schema.NonEmptyString,
+    credentialId: Schema.NonEmptyString,
+    issuedAt: Schema.Number,
+    repository: Schema.NonEmptyString,
+    expiresAt: Schema.Number,
+    remote: Schema.NonEmptyString,
+    reportUrl: Schema.NonEmptyString,
+    status: Schema.Literals(["running", "succeeded", "failed", "revoked"]),
+    artifact: Schema.NullOr(Schema.Struct({ digest: Schema.NonEmptyString, bytes: Schema.Number })),
+    detail: Schema.NullOr(Schema.String),
+});
+const executionSchema = Schema.Struct({
+    output: Schema.optional(Schema.NullOr(Schema.Struct({
+        exitCode: Schema.NullOr(Schema.Number),
+        stderr: Schema.optional(Schema.String),
+    }))),
+});
+/** Publisher executes builds; Team retains job authority, Computer runs them. */
+export function createTeamBuildPublisher(options) {
+    const now = options.now ?? Date.now;
+    const maxPermissionAgeMs = options.maxPermissionAgeMs ?? 5 * 60_000;
+    const decodeJob = Schema.decodeUnknownSync(jobSchema);
+    return Object.freeze({
+        mint(input) {
+            return options.team.mintTeamBuildCredential(input);
+        },
+        async read(jobId) {
+            const env_1 = { stack: [], error: void 0, hasError: false };
+            try {
+                const build = __addDisposableResource(env_1, await options.team.build(), false);
+                return await build.read(jobId);
+            }
+            catch (e_1) {
+                env_1.error = e_1;
+                env_1.hasError = true;
+            }
+            finally {
+                __disposeResources(env_1);
+            }
+        },
+        revoke(jobId) {
+            return options.team.revokeTeamBuild(jobId);
+        },
+        async run(input) {
+            const env_2 = { stack: [], error: void 0, hasError: false };
+            try {
+                const build = __addDisposableResource(env_2, await options.team.build(), false);
+                const job = decodeJob(await build.prepare(input.jobId));
+                const issuedAt = now();
+                if (job.status !== "running" || job.expiresAt <= issuedAt)
+                    throw new Error("Team build expired");
+                const computer = options.computer(job.computerId);
+                const decision = {
+                    kind: "build",
+                    schemaVersion: 1,
+                    teamId: options.teamId,
+                    computerId: job.computerId,
+                    jobId: job.jobId,
+                    credentialId: job.credentialId,
+                    operations: ["computer.execute"],
+                    sequence: 1,
+                    issuedAt,
+                    expiresAt: Math.min(job.expiresAt, issuedAt + maxPermissionAgeMs),
+                    status: "allowed",
+                    basis: { credentialExpiresAt: job.expiresAt },
+                };
+                await computer.applyBuildDecision(decision);
+                try {
+                    const result = Schema.decodeUnknownSync(executionSchema)(await computer.execute({
+                        teamId: options.teamId,
+                        computerId: job.computerId,
+                        jobId: job.jobId,
+                        credentialId: job.credentialId,
+                        command: "export TEAM_BUILD_REMOTE=" +
+                            job.remote +
+                            " TEAM_BUILD_REPORT=" +
+                            job.reportUrl +
+                            "\n" +
+                            input.command,
+                        timeoutMs: input.timeoutMs,
+                    }));
+                    await computer.deliverTeamGitEvents();
+                    const current = decodeJob(await build.read(input.jobId));
+                    if (current.status !== "running") {
+                        await build.deliverProjection();
+                        return current;
+                    }
+                    const exitCode = result.output?.exitCode ?? null;
+                    const completed = decodeJob(await build.complete(job.jobId, exitCode === 0 && current.artifact !== null
+                        ? "succeeded"
+                        : "failed", exitCode === 0
+                        ? "Build exited without reporting status"
+                        : "Build exited with " +
+                            String(exitCode) +
+                            ": " +
+                            (result.output?.stderr ?? "").slice(-1_000)));
+                    await build.deliverProjection();
+                    return completed;
+                }
+                finally {
+                    await computer.applyBuildDecision({
+                        ...decision,
+                        sequence: 2,
+                        status: "revoked",
+                        issuedAt: Math.min(now(), decision.expiresAt - 1),
+                    });
+                }
+            }
+            catch (e_2) {
+                env_2.error = e_2;
+                env_2.hasError = true;
+            }
+            finally {
+                __disposeResources(env_2);
+            }
+        },
+    });
+}
+/** Fixed captured builder command; neither source nor the customer supplies shell code. */
+export function teamAppBuildCommand(configuration, uploadGrant) {
+    const encoded = base64url.encode(JSON.stringify({
+        uploadGrant,
+        appId: configuration.appId,
+        sourceRevision: configuration.sourceRevision,
+        recipe: configuration.source.recipe,
+        buildRecipeDigest: configuration.source.buildRecipeDigest,
+    }));
+    return [
+        "set -eu",
+        // Build scratch (clone, snapshot, installed packages) lives on the
+        // Computer's disk: an on-box VM's /tmp is RAM-backed tmpfs, which a
+        // workspace install fills while the compiler needs that memory.
+        "work=$(mktemp -d /var/tmp/fungi-app-build-XXXXXXXX)",
+        `trap 'rm -rf "$work"' EXIT`,
+        'mkdir "$work/tmp"',
+        'export TMPDIR="$work/tmp"',
+        'git clone -q --no-checkout -- "$TEAM_BUILD_REMOTE" "$work/source" 2>/dev/null',
+        `node /opt/fungi/team-candidate-builder.mjs '${encoded}' "$work/source" "$work/candidate.json"`,
+    ].join("\n");
+}

package/dist/build/build-step.d.ts

@@ -0,0 +1,26 @@
+import * as Schema from "effect/Schema";
+/**
+ * One captured dependency build step. Paths are relative to the captured
+ * snapshot root. A TypeScript step compiles one config; a Tailwind step
+ * compiles one stylesheet input into its output (the same path for an App's
+ * own stylesheet, which compiles in place).
+ */
+export declare const workspaceBuildStepSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"typescript">;
+    readonly config: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"tailwind">;
+    readonly input: Schema.String;
+    readonly output: Schema.String;
+}>]>;
+/** One captured dependency build step. */
+export type WorkspaceBuildStep = Schema.Schema.Type<typeof workspaceBuildStepSchema>;
+/** The steps one dependency-build process runs, encoded as one argument. */
+export declare const workspaceBuildStepsJsonSchema: Schema.fromJsonString<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"typescript">;
+    readonly config: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"tailwind">;
+    readonly input: Schema.String;
+    readonly output: Schema.String;
+}>]>>>;