@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/dist/event-recipients.js

@@ -0,0 +1,144 @@
+/**
+ * Host recipients of App events: durable, per-recipient delivery records the
+ * host commits when it accepts an emit, and drains after the emitter's write
+ * has returned. A recipient that is down, slow or refusing never reaches the
+ * emitter; its outcome is recorded on its own row as pending, delivered or
+ * failed, and retried on the owner's alarm.
+ */
+import * as Schema from "effect/Schema";
+import { failureDiagnostic } from "./cause-class.js";
+/**
+ * Retained D5 baseline: a ten-second attempt bound, and a terminal failure
+ * after six failed attempts (the first plus one per retry delay).
+ */
+export const RECIPIENT_ATTEMPT_MS = 10_000;
+export const RECIPIENT_RETRY_DELAYS_MS = [
+    10_000, 60_000, 300_000, 1_800_000, 7_200_000,
+];
+const DRAIN_PAGE = 16;
+const eventCodec = Schema.fromJsonString(Schema.Struct({
+    source: Schema.Struct({
+        installationId: Schema.String,
+        appId: Schema.String,
+        releaseId: Schema.String,
+    }),
+    type: Schema.String,
+    eventId: Schema.String,
+    payload: Schema.Struct({
+        type: Schema.String,
+        timestamp: Schema.String,
+        data: Schema.Unknown,
+    }),
+}));
+const decodeEvent = Schema.decodeUnknownSync(eventCodec);
+const encodeEvent = Schema.encodeSync(eventCodec);
+const dueRow = Schema.Struct({
+    recipient: Schema.String,
+    event_id: Schema.String,
+    body: Schema.String,
+    attempts: Schema.Number,
+});
+const deliveryRow = Schema.Struct({
+    recipient: Schema.String,
+    event_id: Schema.String,
+    type: Schema.String,
+    state: Schema.Literals(["pending", "delivered", "failed"]),
+    attempts: Schema.Number,
+    last_error: Schema.NullOr(Schema.String),
+    updated_at: Schema.Number,
+});
+const nextRow = Schema.Struct({ at: Schema.NullOr(Schema.Number) });
+function diagnostic(cause) {
+    const { causeClass, platform, message } = failureDiagnostic(cause);
+    return [causeClass, ...(platform ?? []), message]
+        .filter((part) => part !== undefined)
+        .join(": ");
+}
+async function bounded(attempt, ms) {
+    let timer;
+    try {
+        await Promise.race([
+            attempt,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => {
+                    reject(new DOMException("Recipient delivery timed out", "TimeoutError"));
+                }, ms);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** The owner's SQLite records, its alarm and the one typed delivery port. */
+export function createRecipientDeliveries(options) {
+    const { sql } = options;
+    sql.exec(`CREATE TABLE IF NOT EXISTS oyster_recipient_deliveries (
+    recipient TEXT NOT NULL, event_id TEXT NOT NULL, type TEXT NOT NULL, body TEXT NOT NULL,
+    state TEXT NOT NULL, attempts INTEGER NOT NULL, next_at INTEGER NOT NULL,
+    last_error TEXT, updated_at INTEGER NOT NULL,
+    PRIMARY KEY (recipient, event_id)) STRICT`);
+    sql.exec(`CREATE INDEX IF NOT EXISTS oyster_recipient_deliveries_due
+    ON oyster_recipient_deliveries(state, next_at)`);
+    const attemptMs = options.attemptMs ?? RECIPIENT_ATTEMPT_MS;
+    const nextDue = () => Schema.decodeUnknownSync(nextRow)(sql
+        .exec("SELECT MIN(next_at) AS at FROM oyster_recipient_deliveries WHERE state = 'pending'")
+        .toArray()[0]).at;
+    return {
+        /**
+         * Record one pending row per recipient (idempotent per event id). The
+         * caller commits it with its other rows and then wakes for `now`.
+         */
+        enqueue(event, recipients) {
+            const now = options.now();
+            const body = encodeEvent(event);
+            let queued = 0;
+            for (const recipient of new Set(recipients))
+                queued += sql
+                    .exec("INSERT INTO oyster_recipient_deliveries (recipient, event_id, type, body, state, attempts, next_at, last_error, updated_at) VALUES (?, ?, ?, ?, 'pending', 0, ?, NULL, ?) ON CONFLICT DO NOTHING RETURNING event_id", recipient, event.eventId, event.type, body, now, now)
+                    .toArray().length;
+            return queued;
+        },
+        /** Attempt every due row once, record each outcome, and re-arm for the next retry. */
+        async drain() {
+            const now = options.now();
+            const due = sql
+                .exec("SELECT recipient, event_id, body, attempts FROM oyster_recipient_deliveries WHERE state = 'pending' AND next_at <= ? ORDER BY next_at LIMIT ?", now, DRAIN_PAGE)
+                .toArray()
+                .map((row) => Schema.decodeUnknownSync(dueRow)(row));
+            await Promise.all(due.map(async (row) => {
+                // The attempt's cause becomes this row's recorded diagnostic.
+                const failure = await bounded(options.deliver(row.recipient, decodeEvent(row.body)), attemptMs).then(() => null, (cause) => diagnostic(cause));
+                const attempts = row.attempts + 1;
+                sql.exec("UPDATE oyster_recipient_deliveries SET state = ?, attempts = ?, next_at = ?, last_error = ?, updated_at = ? WHERE recipient = ? AND event_id = ?", failure === null
+                    ? "delivered"
+                    : attempts > RECIPIENT_RETRY_DELAYS_MS.length
+                        ? "failed"
+                        : "pending", attempts, now + (RECIPIENT_RETRY_DELAYS_MS[attempts - 1] ?? 0), failure, options.now(), row.recipient, row.event_id);
+            }));
+            const next = nextDue();
+            if (next !== null)
+                await options.wake(next);
+        },
+        /** The earliest pending retry, if any. */
+        nextDue,
+        /** Recent deliveries to one recipient, newest first. */
+        deliveries(recipient) {
+            return sql
+                .exec("SELECT recipient, event_id, type, state, attempts, last_error, updated_at FROM oyster_recipient_deliveries WHERE recipient = ? ORDER BY updated_at DESC LIMIT 50", recipient)
+                .toArray()
+                .map((raw) => {
+                const row = Schema.decodeUnknownSync(deliveryRow)(raw);
+                return {
+                    recipient: row.recipient,
+                    eventId: row.event_id,
+                    type: row.type,
+                    state: row.state,
+                    attempts: row.attempts,
+                    lastError: row.last_error,
+                    updatedAt: row.updated_at,
+                };
+            });
+        },
+    };
+}

package/dist/facet-invocation.d.ts

@@ -0,0 +1,4 @@
+/** Trusted Loader facade: code is cached, while each invocation receives its own bindings. */
+export declare function facetInvocationModule(exportName: string): string;
+/** The facade's private maintained decoder module, bundled at package build time. */
+export declare const facetFrameBindingModule: string;

package/dist/facet-invocation.js

@@ -0,0 +1,45 @@
+import { frameBindingWireScript } from "#frame-binding-wire-script";
+import { appInstanceErrorCodeSchema } from "./index.js";
+/** Trusted Loader facade: code is cached, while each invocation receives its own bindings. */
+export function facetInvocationModule(exportName) {
+    return `import { DurableObject } from "cloudflare:workers";
+import * as backend from "./backend.js";
+import { createFrameBindingWire } from "./frame-binding-wire.js";
+const Backend = backend[${JSON.stringify(exportName)}];
+const wire = createFrameBindingWire(${JSON.stringify(appInstanceErrorCodeSchema.literals)});
+// Only the App's own class chain is callable; platform and Object members never are.
+function methodOf(method) {
+  for (
+    let prototype = Backend.prototype;
+    prototype !== null &&
+    prototype !== DurableObject.prototype &&
+    prototype !== Object.prototype;
+    prototype = Object.getPrototypeOf(prototype)
+  ) {
+    const descriptor = Object.getOwnPropertyDescriptor(prototype, method);
+    if (descriptor === undefined) continue;
+    if (method === "constructor" || typeof descriptor.value !== "function")
+      break;
+    return descriptor.value;
+  }
+  throw new Error("App method unavailable");
+}
+export class AppInvocation extends DurableObject {
+  async invoke(method, args, bindings) {
+    if (method === "fetch") throw new Error("App method unavailable");
+    return await methodOf(method).apply(new Backend(this.ctx, wire.wrap(bindings)), args);
+  }
+  async http(input, bindings) {
+    const request = new Request(input.url, {
+      method: input.method, headers: input.headers,
+      ...(input.body === null ? {} : {body: input.body}),
+    });
+    const response = await methodOf("fetch").call(new Backend(this.ctx, wire.wrap(bindings)), request);
+    return {status: response.status, statusText: response.statusText,
+      headers: [...response.headers], body: response.body};
+  }
+}
+`;
+}
+/** The facade's private maintained decoder module, bundled at package build time. */
+export const facetFrameBindingModule = frameBindingWireScript;

package/dist/files.d.ts

@@ -0,0 +1,42 @@
+import type { OysterCapability } from "./host.js";
+/** One entry of a directory listing, in Agar's `computer.list` contract. */
+export type FileEntry = Readonly<{
+    name: string;
+    type: "file" | "directory" | "symlink";
+    size: number;
+    modifiedAt: number;
+}>;
+/** A page of a directory, in Agar's `computer.list` contract. */
+export type FileListing = Readonly<{
+    path: string;
+    entries: readonly FileEntry[];
+    nextOffset: number | null;
+}>;
+/** What a conditional replace did, in Agar's `computer.writeFile` contract. */
+export type FileReplaceOutcome = Readonly<{
+    kind: "replaced";
+    path: string;
+    bytes: number;
+}> | Readonly<{
+    kind: "conflict";
+}>;
+/**
+ * Where an Oyster's files live. Paths are absolute (`/notes/a.md`) and
+ * already normalized by the routes; a source never sees `..`.
+ */
+export type FileSource = Readonly<{
+    /** One page of a directory's entries, or `null` when it does not exist. */
+    list(path: string, limit: number, offset: number): Promise<FileListing | null>;
+    /** A file's bytes, or `null` when it does not exist. */
+    read(path: string): Promise<Uint8Array | null>;
+    /** Create or replace a file. */
+    write(path: string, content: Uint8Array): Promise<void>;
+    /** Create a directory. */
+    mkdir(path: string): Promise<void>;
+    /** Write `content` only if the file still holds `expectedContent`. */
+    replace(path: string, expectedContent: string, content: string): Promise<FileReplaceOutcome>;
+}>;
+/** Normalize an absolute path; `null` when it is not one or escapes the root. */
+export declare function normalizeFilePath(raw: string): string | null;
+/** File capabilities sharing the existing `/files/` wire and one file source. */
+export declare function fileCapabilities(source: FileSource): readonly OysterCapability[];

package/dist/files.js

@@ -0,0 +1,123 @@
+/**
+ * Files for Apps on a standalone Oyster: one file-source contract, routes the App
+ * page calls. Apps reach files through Agar's
+ * `computer.list`, `computer.readFile` and `computer.writeFile` contracts, so
+ * an App written for a Computer (an editor, a workflow step) works against
+ * the Oyster's workspace unchanged. Other sources (a git repository) implement
+ * the same `FileSource`.
+ */
+import { Hono } from "hono";
+import * as Schema from "effect/Schema";
+import { computerList, computerReadFile, computerWriteFile, } from "@fungi.computer/agar/computer";
+const MAX_FILE_BYTES = 25 * 1024 * 1024;
+const MAX_LIST = 1000;
+/** Normalize an absolute path; `null` when it is not one or escapes the root. */
+export function normalizeFilePath(raw) {
+    if (!raw.startsWith("/") || raw.length > 4096 || raw.includes("\0"))
+        return null;
+    const parts = [];
+    for (const part of raw.split("/")) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..")
+            return null;
+        parts.push(part);
+    }
+    return `/${parts.join("/")}`;
+}
+const replaceSchema = Schema.Struct({
+    path: Schema.String,
+    expectedContent: Schema.String,
+    content: Schema.String,
+});
+const mkdirSchema = Schema.Struct({ path: Schema.String });
+function refusal(status, error) {
+    return Response.json({ error }, { status });
+}
+/** File capabilities sharing the existing `/files/` wire and one file source. */
+export function fileCapabilities(source) {
+    const routes = createFileRoutes(source);
+    const shared = { base: "/files/", routes };
+    return [
+        {
+            ...shared,
+            id: "computer.list",
+            permission: "computer.list",
+            version: computerList.version,
+            methods: { list: { kind: "json", method: "GET", path: "list" } },
+        },
+        {
+            ...shared,
+            id: "computer.readFile",
+            permission: "computer.readFile",
+            version: computerReadFile.version,
+            methods: { open: { kind: "read", method: "GET", path: "content" } },
+        },
+        {
+            ...shared,
+            id: "computer.writeFile",
+            permission: "computer.writeFile",
+            version: computerWriteFile.version,
+            methods: {
+                open: { kind: "write", method: "PUT", path: "content" },
+                mkdir: { kind: "json", method: "POST", path: "mkdir" },
+                replace: { kind: "json", method: "POST", path: "replace" },
+            },
+        },
+    ];
+}
+function createFileRoutes(source) {
+    const routes = new Hono();
+    const pathOf = (raw) => normalizeFilePath(raw ?? "");
+    routes.get("/list", async (context) => {
+        const path = pathOf(context.req.query("path"));
+        if (path === null)
+            return refusal(400, "Invalid path");
+        const limit = Math.min(MAX_LIST, Math.max(1, Number(context.req.query("limit") ?? "256") || 256));
+        const offset = Math.max(0, Number(context.req.query("offset") ?? "0") || 0);
+        const listing = await source.list(path, limit, offset);
+        return listing === null
+            ? refusal(404, "No such directory")
+            : Response.json(listing);
+    });
+    routes.get("/content", async (context) => {
+        const path = pathOf(context.req.query("path"));
+        if (path === null)
+            return refusal(400, "Invalid path");
+        const bytes = await source.read(path);
+        return bytes === null
+            ? refusal(404, "No such file")
+            : new Response(bytes, {
+                headers: { "Content-Type": "application/octet-stream" },
+            });
+    });
+    routes.put("/content", async (context) => {
+        const path = pathOf(context.req.query("path"));
+        if (path === null || path === "/")
+            return refusal(400, "Invalid path");
+        const length = Number(context.req.header("content-length") ?? "0");
+        if (length > MAX_FILE_BYTES)
+            return refusal(413, "File too large");
+        const bytes = new Uint8Array(await context.req.arrayBuffer());
+        if (bytes.length > MAX_FILE_BYTES)
+            return refusal(413, "File too large");
+        await source.write(path, bytes);
+        return new Response(null, { status: 204 });
+    });
+    routes.post("/mkdir", async (context) => {
+        const body = Schema.decodeUnknownOption(mkdirSchema)(await context.req.json());
+        const path = body._tag === "Some" ? normalizeFilePath(body.value.path) : null;
+        if (path === null || path === "/")
+            return refusal(400, "Invalid path");
+        await source.mkdir(path);
+        return new Response(null, { status: 204 });
+    });
+    routes.post("/replace", async (context) => {
+        const body = Schema.decodeUnknownOption(replaceSchema)(await context.req.json());
+        const path = body._tag === "Some" ? normalizeFilePath(body.value.path) : null;
+        if (body._tag === "None" || path === null)
+            return refusal(400, "Invalid request");
+        return Response.json(await source.replace(path, body.value.expectedContent, body.value.content));
+    });
+    return routes;
+}

package/dist/frame-binding-wire-script.d.ts

@@ -0,0 +1,2 @@
+/** Maintained wire decoder bundled for the native Loader facade. */
+export declare const frameBindingWireScript: string;

package/dist/frame-binding-wire-script.js

@@ -0,0 +1 @@
+export const frameBindingWireScript = "var X;function l(e,t,r){function n(u,c){if(u._zod||Object.defineProperty(u,\"_zod\",{value:{def:c,constr:s,traits:new Set},enumerable:!1}),u._zod.traits.has(e))return;u._zod.traits.add(e),t(u,c);let a=s.prototype,p=Object.keys(a);for(let f=0;f<p.length;f++){let d=p[f];d in u||(u[d]=a[d].bind(u))}}let o=r?.Parent??Object;class i extends o{}Object.defineProperty(i,\"name\",{value:e});function s(u){var c;let a=r?.Parent?new i:this;n(a,u),(c=a._zod).deferred??(c.deferred=[]);for(let p of a._zod.deferred)p();return a}return Object.defineProperty(s,\"init\",{value:n}),Object.defineProperty(s,Symbol.hasInstance,{value:u=>r?.Parent&&u instanceof r.Parent?!0:u?._zod?.traits?.has(e)}),Object.defineProperty(s,\"name\",{value:e}),s}var $=class extends Error{constructor(){super(\"Encountered Promise during synchronous parse. Use .parseAsync() instead.\")}};(X=globalThis).__zod_globalConfig??(X.__zod_globalConfig={});var j=globalThis.__zod_globalConfig;function v(e){return e&&Object.assign(j,e),j}function H(e){let t=Object.values(e).filter(n=>typeof n==\"number\");return Object.entries(e).filter(([n,o])=>t.indexOf(+n)===-1).map(([n,o])=>o)}function Q(e,t){return typeof t==\"bigint\"?t.toString():t}function D(e){return{get value(){{let r=e();return Object.defineProperty(this,\"value\",{value:r}),r}throw new Error(\"cached value already set\")}}}function ee(e){let t=e.startsWith(\"^\")?1:0,r=e.endsWith(\"$\")?e.length-1:e.length;return e.slice(t,r)}var Y=Symbol(\"evaluating\");function g(e,t,r){let n;Object.defineProperty(e,t,{get(){if(n!==Y)return n===void 0&&(n=Y,n=r()),n},set(o){Object.defineProperty(e,t,{value:o})},configurable:!0})}var L=\"captureStackTrace\"in Error?Error.captureStackTrace:(...e)=>{};function A(e){return typeof e==\"object\"&&e!==null&&!Array.isArray(e)}function te(e){if(A(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!=\"function\")return!0;let r=t.prototype;return!(A(r)===!1||Object.prototype.hasOwnProperty.call(r,\"isPrototypeOf\")===!1)}var re=new Set([\"string\",\"number\",\"symbol\"]);function C(e){return e.replace(/[.*+?^${}()|[\\]\\\\]/g,\"\\\\$&\")}function U(e,t,r){let n=new e._zod.constr(t??e._zod.def);return(!t||r?.parent)&&(n._zod.parent=e),n}function _(e){let t=e;if(!t)return{};if(typeof t==\"string\")return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw new Error(\"Cannot specify both `message` and `error` params\");t.error=t.message}return delete t.message,typeof t.error==\"string\"?{...t,error:()=>t.error}:t}function ne(e){return Object.keys(e).filter(t=>e[t]._zod.optin===\"optional\"&&e[t]._zod.optout===\"optional\")}var xt={safeint:[Number.MIN_SAFE_INTEGER,Number.MAX_SAFE_INTEGER],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-34028234663852886e22,34028234663852886e22],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]};function y(e,t=0){if(e.aborted===!0)return!0;for(let r=t;r<e.issues.length;r++)if(e.issues[r]?.continue!==!0)return!0;return!1}function oe(e,t=0){if(e.aborted===!0)return!0;for(let r=t;r<e.issues.length;r++)if(e.issues[r]?.continue===!1)return!0;return!1}function b(e,t){return t.map(r=>{var n;return(n=r).path??(n.path=[]),r.path.unshift(e),r})}function T(e){return typeof e==\"string\"?e:e?.message}function Z(e,t,r){let n=e.message?e.message:T(e.inst?._zod.def?.error?.(e))??T(t?.error?.(e))??T(r.customError?.(e))??T(r.localeError?.(e))??\"Invalid input\",{inst:o,continue:i,input:s,...u}=e;return u.path??(u.path=[]),u.message=n,t?.reportInput&&(u.input=s),u}function B(...e){let[t,r,n]=e;return typeof t==\"string\"?{message:t,code:\"custom\",input:r,inst:n}:{...t}}var ie=(e,t)=>{e.name=\"$ZodError\",Object.defineProperty(e,\"_zod\",{value:e._zod,enumerable:!1}),Object.defineProperty(e,\"issues\",{value:t,enumerable:!1}),e.message=JSON.stringify(t,Q,2),Object.defineProperty(e,\"toString\",{value:()=>e.message,enumerable:!1})},se=l(\"$ZodError\",ie),M=l(\"$ZodError\",ie,{Parent:Error});var We=e=>(t,r,n,o)=>{let i=n?{...n,async:!1}:{async:!1},s=t._zod.run({value:r,issues:[]},i);if(s instanceof Promise)throw new $;if(s.issues.length){let u=new(o?.Err??e)(s.issues.map(c=>Z(c,i,v())));throw L(u,o?.callee),u}return s.value},w=We(M),Ke=e=>async(t,r,n,o)=>{let i=n?{...n,async:!0}:{async:!0},s=t._zod.run({value:r,issues:[]},i);if(s instanceof Promise&&(s=await s),s.issues.length){let u=new(o?.Err??e)(s.issues.map(c=>Z(c,i,v())));throw L(u,o?.callee),u}return s.value},k=Ke(M),Ge=e=>(t,r,n)=>{let o=n?{...n,async:!1}:{async:!1},i=t._zod.run({value:r,issues:[]},o);if(i instanceof Promise)throw new $;return i.issues.length?{success:!1,error:new(e??se)(i.issues.map(s=>Z(s,o,v())))}:{success:!0,data:i.value}},I=Ge(M),Je=e=>async(t,r,n)=>{let o=n?{...n,async:!0}:{async:!0},i=t._zod.run({value:r,issues:[]},o);return i instanceof Promise&&(i=await i),i.issues.length?{success:!1,error:new e(i.issues.map(s=>Z(s,o,v())))}:{success:!0,data:i.value}},S=Je(M);var qe=\"(?:(?:\\\\d\\\\d[2468][048]|\\\\d\\\\d[13579][26]|\\\\d\\\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\\\d|30)|(?:02)-(?:0[1-9]|1\\\\d|2[0-8])))\",Xe=new RegExp(`^${qe}$`);var ue=e=>{let t=e?`[\\\\s\\\\S]{${e?.minimum??0},${e?.maximum??\"\"}}`:\"[\\\\s\\\\S]*\";return new RegExp(`^${t}$`)};var ce=/^-?\\d+(?:\\.\\d+)?$/;var V=l(\"$ZodCheck\",(e,t)=>{var r;e._zod??(e._zod={}),e._zod.def=t,(r=e._zod).onattach??(r.onattach=[])});var pe={major:4,minor:4,patch:3};var h=l(\"$ZodType\",(e,t)=>{var r;e??(e={}),e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=pe;let n=[...e._zod.def.checks??[]];e._zod.traits.has(\"$ZodCheck\")&&n.unshift(e);for(let o of n)for(let i of o._zod.onattach)i(e);if(n.length===0)(r=e._zod).deferred??(r.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let o=(s,u,c)=>{let a=y(s),p;for(let f of u){if(f._zod.def.when){if(oe(s)||!f._zod.def.when(s))continue}else if(a)continue;let d=s.issues.length,m=f._zod.check(s);if(m instanceof Promise&&c?.async===!1)throw new $;if(p||m instanceof Promise)p=(p??Promise.resolve()).then(async()=>{await m,s.issues.length!==d&&(a||(a=y(s,d)))});else{if(s.issues.length===d)continue;a||(a=y(s,d))}}return p?p.then(()=>s):s},i=(s,u,c)=>{if(y(s))return s.aborted=!0,s;let a=o(u,n,c);if(a instanceof Promise){if(c.async===!1)throw new $;return a.then(p=>e._zod.parse(p,c))}return e._zod.parse(a,c)};e._zod.run=(s,u)=>{if(u.skipChecks)return e._zod.parse(s,u);if(u.direction===\"backward\"){let a=e._zod.parse({value:s.value,issues:[]},{...u,skipChecks:!0});return a instanceof Promise?a.then(p=>i(p,s,u)):i(a,s,u)}let c=e._zod.parse(s,u);if(c instanceof Promise){if(u.async===!1)throw new $;return c.then(a=>o(a,n,u))}return o(c,n,u)}}g(e,\"~standard\",()=>({validate:o=>{try{let i=I(e,o);return i.success?{value:i.data}:{issues:i.error?.issues}}catch{return S(e,o).then(s=>s.success?{value:s.data}:{issues:s.error?.issues})}},vendor:\"zod\",version:1}))}),xe=l(\"$ZodString\",(e,t)=>{h.init(e,t),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??ue(e._zod.bag),e._zod.parse=(r,n)=>{if(t.coerce)try{r.value=String(r.value)}catch{}return typeof r.value==\"string\"||r.issues.push({expected:\"string\",code:\"invalid_type\",input:r.value,inst:e}),r}});var ge=l(\"$ZodUnknown\",(e,t)=>{h.init(e,t),e._zod.parse=r=>r}),ze=l(\"$ZodNever\",(e,t)=>{h.init(e,t),e._zod.parse=(r,n)=>(r.issues.push({expected:\"never\",code:\"invalid_type\",input:r.value,inst:e}),r)});function le(e,t,r){e.issues.length&&t.issues.push(...b(r,e.issues)),t.value[r]=e.value}var $e=l(\"$ZodArray\",(e,t)=>{h.init(e,t),e._zod.parse=(r,n)=>{let o=r.value;if(!Array.isArray(o))return r.issues.push({expected:\"array\",code:\"invalid_type\",input:o,inst:e}),r;r.value=Array(o.length);let i=[];for(let s=0;s<o.length;s++){let u=o[s],c=t.element._zod.run({value:u,issues:[]},n);c instanceof Promise?i.push(c.then(a=>le(a,r,s))):le(c,r,s)}return i.length?Promise.all(i).then(()=>r):r}});function R(e,t,r,n,o,i){let s=r in n;if(e.issues.length){if(o&&i&&!s)return;t.issues.push(...b(r,e.issues))}if(!s&&!o){e.issues.length||t.issues.push({code:\"invalid_type\",expected:\"nonoptional\",input:void 0,path:[r]});return}e.value===void 0?s&&(t.value[r]=void 0):t.value[r]=e.value}function He(e){let t=Object.keys(e.shape);for(let n of t)if(!e.shape?.[n]?._zod?.traits?.has(\"$ZodType\"))throw new Error(`Invalid element at key \"${n}\": expected a Zod schema`);let r=ne(e.shape);return{...e,keys:t,keySet:new Set(t),numKeys:t.length,optionalKeys:new Set(r)}}function Qe(e,t,r,n,o,i){let s=[],u=o.keySet,c=o.catchall._zod,a=c.def.type,p=c.optin===\"optional\",f=c.optout===\"optional\";for(let d in t){if(d===\"__proto__\"||u.has(d))continue;if(a===\"never\"){s.push(d);continue}let m=c.run({value:t[d],issues:[]},n);m instanceof Promise?e.push(m.then(z=>R(z,r,d,t,p,f))):R(m,r,d,t,p,f)}return s.length&&r.issues.push({code:\"unrecognized_keys\",keys:s,input:t,inst:i}),e.length?Promise.all(e).then(()=>r):r}var ve=l(\"$ZodObject\",(e,t)=>{if(h.init(e,t),!Object.getOwnPropertyDescriptor(t,\"shape\")?.get){let u=t.shape;Object.defineProperty(t,\"shape\",{get:()=>{let c={...u};return Object.defineProperty(t,\"shape\",{value:c}),c}})}let n=D(()=>He(t));g(e._zod,\"propValues\",()=>{let u=t.shape,c={};for(let a in u){let p=u[a]._zod;if(p.values){c[a]??(c[a]=new Set);for(let f of p.values)c[a].add(f)}}return c});let o=A,i=t.catchall,s;e._zod.parse=(u,c)=>{s??(s=n.value);let a=u.value;if(!o(a))return u.issues.push({expected:\"object\",code:\"invalid_type\",input:a,inst:e}),u;u.value={};let p=[],f=s.shape;for(let d of s.keys){let m=f[d],z=m._zod.optin===\"optional\",q=m._zod.optout===\"optional\",N=m._zod.run({value:a[d],issues:[]},c);N instanceof Promise?p.push(N.then(Be=>R(Be,u,d,a,z,q))):R(N,u,d,a,z,q)}return i?Qe(p,a,u,c,n.value,e):p.length?Promise.all(p).then(()=>u):u}});function fe(e,t,r,n){for(let i of e)if(i.issues.length===0)return t.value=i.value,t;let o=e.filter(i=>!y(i));return o.length===1?(t.value=o[0].value,o[0]):(t.issues.push({code:\"invalid_union\",input:t.value,inst:r,errors:e.map(i=>i.issues.map(s=>Z(s,n,v())))}),t)}var be=l(\"$ZodUnion\",(e,t)=>{h.init(e,t),g(e._zod,\"optin\",()=>t.options.some(n=>n._zod.optin===\"optional\")?\"optional\":void 0),g(e._zod,\"optout\",()=>t.options.some(n=>n._zod.optout===\"optional\")?\"optional\":void 0),g(e._zod,\"values\",()=>{if(t.options.every(n=>n._zod.values))return new Set(t.options.flatMap(n=>Array.from(n._zod.values)))}),g(e._zod,\"pattern\",()=>{if(t.options.every(n=>n._zod.pattern)){let n=t.options.map(o=>o._zod.pattern);return new RegExp(`^(${n.map(o=>ee(o.source)).join(\"|\")})$`)}});let r=t.options.length===1?t.options[0]._zod.run:null;e._zod.parse=(n,o)=>{if(r)return r(n,o);let i=!1,s=[];for(let u of t.options){let c=u._zod.run({value:n.value,issues:[]},o);if(c instanceof Promise)s.push(c),i=!0;else{if(c.issues.length===0)return c;s.push(c)}}return i?Promise.all(s).then(u=>fe(u,n,e,o)):fe(s,n,e,o)}});var Ze=l(\"$ZodDiscriminatedUnion\",(e,t)=>{t.inclusive=!1,be.init(e,t);let r=e._zod.parse;g(e._zod,\"propValues\",()=>{let o={};for(let i of t.options){let s=i._zod.propValues;if(!s||Object.keys(s).length===0)throw new Error(`Invalid discriminated union option at index \"${t.options.indexOf(i)}\"`);for(let[u,c]of Object.entries(s)){o[u]||(o[u]=new Set);for(let a of c)o[u].add(a)}}return o});let n=D(()=>{let o=t.options,i=new Map;for(let s of o){let u=s._zod.propValues?.[t.discriminator];if(!u||u.size===0)throw new Error(`Invalid discriminated union option at index \"${t.options.indexOf(s)}\"`);for(let c of u){if(i.has(c))throw new Error(`Duplicate discriminator value \"${String(c)}\"`);i.set(c,s)}}return i});e._zod.parse=(o,i)=>{let s=o.value;if(!A(s))return o.issues.push({code:\"invalid_type\",expected:\"object\",input:s,inst:e}),o;let u=n.value.get(s?.[t.discriminator]);return u?u._zod.run(o,i):t.unionFallback||i.direction===\"backward\"?r(o,i):(o.issues.push({code:\"invalid_union\",errors:[],note:\"No matching discriminator\",discriminator:t.discriminator,options:Array.from(n.value.keys()),input:s,path:[t.discriminator],inst:e}),o)}});var W=l(\"$ZodTuple\",(e,t)=>{h.init(e,t);let r=t.items;e._zod.parse=(n,o)=>{let i=n.value;if(!Array.isArray(i))return n.issues.push({input:i,inst:e,expected:\"tuple\",code:\"invalid_type\"}),n;n.value=[];let s=[],u=de(r,\"optin\"),c=de(r,\"optout\");if(!t.rest){if(i.length<u)return n.issues.push({code:\"too_small\",minimum:u,inclusive:!0,input:i,inst:e,origin:\"array\"}),n;i.length>r.length&&n.issues.push({code:\"too_big\",maximum:r.length,inclusive:!0,input:i,inst:e,origin:\"array\"})}let a=new Array(r.length);for(let p=0;p<r.length;p++){let f=r[p]._zod.run({value:i[p],issues:[]},o);f instanceof Promise?s.push(f.then(d=>{a[p]=d})):a[p]=f}if(t.rest){let p=r.length-1,f=i.slice(r.length);for(let d of f){p++;let m=t.rest._zod.run({value:d,issues:[]},o);m instanceof Promise?s.push(m.then(z=>me(z,n,p))):me(m,n,p)}}return s.length?Promise.all(s).then(()=>he(a,n,r,i,c)):he(a,n,r,i,c)}});function de(e,t){for(let r=e.length-1;r>=0;r--)if(e[r]._zod[t]!==\"optional\")return r+1;return 0}function me(e,t,r){e.issues.length&&t.issues.push(...b(r,e.issues)),t.value[r]=e.value}function he(e,t,r,n,o){for(let i=0;i<r.length;i++){let s=e[i],u=i<n.length;if(s.issues.length){if(!u&&i>=o){t.value.length=i;break}t.issues.push(...b(i,s.issues))}t.value[i]=s.value}for(let i=t.value.length-1;i>=n.length&&(r[i]._zod.optout===\"optional\"&&t.value[i]===void 0);i--)t.value.length=i;return t}var ye=l(\"$ZodRecord\",(e,t)=>{h.init(e,t),e._zod.parse=(r,n)=>{let o=r.value;if(!te(o))return r.issues.push({expected:\"record\",code:\"invalid_type\",input:o,inst:e}),r;let i=[],s=t.keyType._zod.values;if(s){r.value={};let u=new Set;for(let a of s)if(typeof a==\"string\"||typeof a==\"number\"||typeof a==\"symbol\"){u.add(typeof a==\"number\"?a.toString():a);let p=t.keyType._zod.run({value:a,issues:[]},n);if(p instanceof Promise)throw new Error(\"Async schemas not supported in object keys currently\");if(p.issues.length){r.issues.push({code:\"invalid_key\",origin:\"record\",issues:p.issues.map(m=>Z(m,n,v())),input:a,path:[a],inst:e});continue}let f=p.value,d=t.valueType._zod.run({value:o[a],issues:[]},n);d instanceof Promise?i.push(d.then(m=>{m.issues.length&&r.issues.push(...b(a,m.issues)),r.value[f]=m.value})):(d.issues.length&&r.issues.push(...b(a,d.issues)),r.value[f]=d.value)}let c;for(let a in o)u.has(a)||(c=c??[],c.push(a));c&&c.length>0&&r.issues.push({code:\"unrecognized_keys\",input:o,inst:e,keys:c})}else{r.value={};for(let u of Reflect.ownKeys(o)){if(u===\"__proto__\"||!Object.prototype.propertyIsEnumerable.call(o,u))continue;let c=t.keyType._zod.run({value:u,issues:[]},n);if(c instanceof Promise)throw new Error(\"Async schemas not supported in object keys currently\");if(typeof u==\"string\"&&ce.test(u)&&c.issues.length){let f=t.keyType._zod.run({value:Number(u),issues:[]},n);if(f instanceof Promise)throw new Error(\"Async schemas not supported in object keys currently\");f.issues.length===0&&(c=f)}if(c.issues.length){t.mode===\"loose\"?r.value[u]=o[u]:r.issues.push({code:\"invalid_key\",origin:\"record\",issues:c.issues.map(f=>Z(f,n,v())),input:u,path:[u],inst:e});continue}let p=t.valueType._zod.run({value:o[u],issues:[]},n);p instanceof Promise?i.push(p.then(f=>{f.issues.length&&r.issues.push(...b(u,f.issues)),r.value[c.value]=f.value})):(p.issues.length&&r.issues.push(...b(u,p.issues)),r.value[c.value]=p.value)}}return i.length?Promise.all(i).then(()=>r):r}});var we=l(\"$ZodEnum\",(e,t)=>{h.init(e,t);let r=H(t.entries),n=new Set(r);e._zod.values=n,e._zod.pattern=new RegExp(`^(${r.filter(o=>re.has(typeof o)).map(o=>typeof o==\"string\"?C(o):o.toString()).join(\"|\")})$`),e._zod.parse=(o,i)=>{let s=o.value;return n.has(s)||o.issues.push({code:\"invalid_value\",values:r,input:s,inst:e}),o}}),ke=l(\"$ZodLiteral\",(e,t)=>{if(h.init(e,t),t.values.length===0)throw new Error(\"Cannot create literal schema with no valid values\");let r=new Set(t.values);e._zod.values=r,e._zod.pattern=new RegExp(`^(${t.values.map(n=>typeof n==\"string\"?C(n):n?C(n.toString()):String(n)).join(\"|\")})$`),e._zod.parse=(n,o)=>{let i=n.value;return r.has(i)||n.issues.push({code:\"invalid_value\",values:t.values,input:i,inst:e}),n}});var Pe=l(\"$ZodFunction\",(e,t)=>(h.init(e,t),e._def=t,e._zod.def=t,e.implement=r=>{if(typeof r!=\"function\")throw new Error(\"implement() must be called with a function\");return function(...n){let o=e._def.input?w(e._def.input,n):n,i=Reflect.apply(r,this,o);return e._def.output?w(e._def.output,i):i}},e.implementAsync=r=>{if(typeof r!=\"function\")throw new Error(\"implementAsync() must be called with a function\");return async function(...n){let o=e._def.input?await k(e._def.input,n):n,i=await Reflect.apply(r,this,o);return e._def.output?await k(e._def.output,i):i}},e._zod.parse=(r,n)=>typeof r.value!=\"function\"?(r.issues.push({code:\"invalid_type\",expected:\"function\",input:r.value,inst:e}),r):(e._def.output&&e._def.output._zod.def.type===\"promise\"?r.value=e.implementAsync(r.value):r.value=e.implement(r.value),r),e.input=(...r)=>{let n=e.constructor;return Array.isArray(r[0])?new n({type:\"function\",input:new W({type:\"tuple\",items:r[0],rest:r[1]}),output:e._def.output}):new n({type:\"function\",input:r[0],output:e._def.output})},e.output=r=>{let n=e.constructor;return new n({type:\"function\",input:e._def.input,output:r})},e)),Ae=l(\"$ZodPromise\",(e,t)=>{h.init(e,t),e._zod.parse=(r,n)=>Promise.resolve(r.value).then(o=>t.innerType._zod.run({value:o,issues:[]},n))});var Ee=l(\"$ZodCustom\",(e,t)=>{V.init(e,t),h.init(e,t),e._zod.parse=(r,n)=>r,e._zod.check=r=>{let n=r.value,o=t.fn(n);if(o instanceof Promise)return o.then(i=>_e(i,r,n,e));_e(o,r,n,e)}});function _e(e,t,r,n){if(!e){let o={code:\"custom\",input:r,inst:n,path:[...n._zod.def.path??[]],continue:!n._zod.def.abort};n._zod.def.params&&(o.params=n._zod.def.params),t.issues.push(B(o))}}function Me(e,t){return new e({type:\"string\",..._(t)})}function Ie(e){return new e({type:\"unknown\"})}function Se(e,t){return new e({type:\"never\",..._(t)})}function Te(e,t,r){let n=_(r);return n.abort??(n.abort=!0),new e({type:\"custom\",check:\"custom\",fn:t,...n})}var x=l(\"ZodMiniType\",(e,t)=>{if(!e._zod)throw new Error(\"Uninitialized schema in ZodMiniType.\");h.init(e,t),e.def=t,e.type=t.type,e.parse=(r,n)=>w(e,r,n,{callee:e.parse}),e.safeParse=(r,n)=>I(e,r,n),e.parseAsync=async(r,n)=>k(e,r,n,{callee:e.parseAsync}),e.safeParseAsync=async(r,n)=>S(e,r,n),e.check=(...r)=>e.clone({...t,checks:[...t.checks??[],...r.map(n=>typeof n==\"function\"?{_zod:{check:n,def:{check:\"custom\"},onattach:[]}}:n)]},{parent:!0}),e.with=e.check,e.clone=(r,n)=>U(e,r,n),e.brand=()=>e,e.register=((r,n)=>(r.add(e,n),e)),e.apply=r=>r(e)}),rt=l(\"ZodMiniString\",(e,t)=>{xe.init(e,t),x.init(e,t)});function O(e){return Me(rt,e)}var nt=l(\"ZodMiniUnknown\",(e,t)=>{ge.init(e,t),x.init(e,t)});function P(){return Ie(nt)}var ot=l(\"ZodMiniNever\",(e,t)=>{ze.init(e,t),x.init(e,t)});function it(e){return Se(ot,e)}var st=l(\"ZodMiniArray\",(e,t)=>{$e.init(e,t),x.init(e,t)});function K(e,t){return new st({type:\"array\",element:e,..._(t)})}var Re=l(\"ZodMiniObject\",(e,t)=>{ve.init(e,t),x.init(e,t),g(e,\"shape\",()=>t.shape)});function Oe(e,t){let r={type:\"object\",shape:e??{},..._(t)};return new Re(r)}function G(e,t){return new Re({type:\"object\",shape:e,catchall:it(),..._(t)})}var ut=l(\"ZodMiniDiscriminatedUnion\",(e,t)=>{Ze.init(e,t),x.init(e,t)});function Ne(e,t,r){return new ut({type:\"union\",options:t,discriminator:e,..._(r)})}var ct=l(\"ZodMiniTuple\",(e,t)=>{W.init(e,t),x.init(e,t)});function at(e,t,r){let n=t instanceof h,o=n?r:t,i=n?t:null;return new ct({type:\"tuple\",items:e,rest:i,..._(o)})}var Ce=l(\"ZodMiniRecord\",(e,t)=>{ye.init(e,t),x.init(e,t)});function je(e,t,r){return!t||!t._zod?new Ce({type:\"record\",keyType:O(),valueType:e,..._(t)}):new Ce({type:\"record\",keyType:e,valueType:t,..._(r)})}var pt=l(\"ZodMiniEnum\",(e,t)=>{we.init(e,t),x.init(e,t),e.options=Object.values(t.entries)});function Fe(e,t){let r=Array.isArray(e)?Object.fromEntries(e.map(n=>[n,n])):e;return new pt({type:\"enum\",entries:r,..._(t)})}var lt=l(\"ZodMiniLiteral\",(e,t)=>{ke.init(e,t),x.init(e,t)});function J(e,t){return new lt({type:\"literal\",values:Array.isArray(e)?e:[e],..._(t)})}var ft=l(\"ZodMiniPromise\",(e,t)=>{Ae.init(e,t),x.init(e,t)});function De(e){return new ft({type:\"promise\",innerType:e})}var dt=l(\"ZodMiniCustom\",(e,t)=>{Ee.init(e,t),x.init(e,t)});function mt(e,t){return Te(dt,e??(()=>!0),t)}function Le(e,t={}){let r=mt(n=>n instanceof e,t);return r._zod.bag.Class=e,r._zod.check=n=>{n.value instanceof e||n.issues.push({code:\"invalid_type\",expected:e.name,input:n.value,inst:r,path:[...r._zod.def.path??[]]})},r}var ht=l(\"ZodMiniFunction\",(e,t)=>{Pe.init(e,t),x.init(e,t)});function Ue(e){return new ht({type:\"function\",input:Array.isArray(e?.input)?at(e?.input):e?.input??K(P()),output:e?.output??P()})}var _t=je(O(),Le(Object));function go(e){let t=Ne(\"kind\",[G({kind:J(\"result\"),value:P()}),G({kind:J(\"local_refusal\"),code:Fe(e)})]);class r extends Error{constructor(u){super(`App binding refused: ${u}`);this.code=u}code;name=\"AppInstanceError\"}let n=i=>t.parse(i),o=i=>{let s=t.parse(i);if(s.kind===\"local_refusal\")throw new r(s.code);return s.value};return{decode:n,wrap(i){return Object.fromEntries(Object.entries(_t.parse(i)).map(([s,u])=>[s,new Proxy({},{get(c,a){let p=O().safeParse(a);if(!(!p.success||p.data===\"then\"))return async(...f)=>{let d=Ue({input:K(P()),output:De(P())}),m=Oe({[p.data]:d}).parse(Object.create(u))[p.data];if(m===void 0)throw new Error(\"App binding method unavailable\");return o(await m.apply(u,[...f]))}}})]))}}}export{go as createFrameBindingWire};\n";

package/dist/frame-binding-wire.d.ts

@@ -0,0 +1,28 @@
+import * as z from "zod/mini";
+import type { AppInstanceErrorCode } from "./index.js";
+/** Private RPC envelope. Domain results, including domain refusals, stay inside value. */
+export type FrameBindingReply<Value> = Readonly<{
+    kind: "result";
+    value: Value;
+}> | Readonly<{
+    kind: "local_refusal";
+    code: AppInstanceErrorCode;
+}>;
+/** Native entrypoint methods carry the envelope; guest interfaces are restored by wrap. */
+export type FrameBindingWire<Methods> = {
+    [Name in keyof Methods]: Methods[Name] extends (...args: infer Args) => Promise<infer Value> ? (...args: Args) => Promise<FrameBindingReply<Value>> : never;
+};
+declare const frameStubsSchema: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniCustom<Object, Object>>;
+type FrameBindingStubs = z.output<typeof frameStubsSchema>;
+/** The host supplies its one closed refusal vocabulary to both copies of this decoder. */
+export declare function createFrameBindingWire<const Codes extends readonly [string, ...string[]]>(codes: Codes): {
+    decode: (raw: unknown) => {
+        kind: "result";
+        value: unknown;
+    } | {
+        kind: "local_refusal";
+        code: ({ [k_1 in Codes[number]]: k_1; } extends infer T ? { [k in keyof T]: T[k]; } : never)[Codes[number]];
+    };
+    wrap(bindings: FrameBindingStubs): object;
+};
+export {};

package/dist/frame-binding-wire.js

@@ -0,0 +1,54 @@
+import * as z from "zod/mini";
+const frameStubsSchema = z.record(z.string(), z.instanceof(Object));
+/** The host supplies its one closed refusal vocabulary to both copies of this decoder. */
+export function createFrameBindingWire(codes) {
+    const replySchema = z.discriminatedUnion("kind", [
+        z.strictObject({ kind: z.literal("result"), value: z.unknown() }),
+        z.strictObject({ kind: z.literal("local_refusal"), code: z.enum(codes) }),
+    ]);
+    class LocalRefusal extends Error {
+        code;
+        name = "AppInstanceError";
+        constructor(code) {
+            super(`App binding refused: ${code}`);
+            this.code = code;
+        }
+    }
+    const decode = (raw) => replySchema.parse(raw);
+    const unwrap = (raw) => {
+        const reply = replySchema.parse(raw);
+        if (reply.kind === "local_refusal")
+            throw new LocalRefusal(reply.code);
+        return reply.value;
+    };
+    return {
+        decode,
+        wrap(bindings) {
+            return Object.fromEntries(Object.entries(frameStubsSchema.parse(bindings)).map(([name, stub]) => {
+                return [
+                    name,
+                    new Proxy({}, {
+                        get(_target, method) {
+                            const named = z.string().safeParse(method);
+                            if (!named.success || named.data === "then")
+                                return undefined;
+                            return async (...args) => {
+                                const callSchema = z.function({
+                                    input: z.array(z.unknown()),
+                                    output: z.promise(z.unknown()),
+                                });
+                                // Select one native method without enumerating the opaque stub.
+                                const call = z
+                                    .object({ [named.data]: callSchema })
+                                    .parse(Object.create(stub))[named.data];
+                                if (call === undefined)
+                                    throw new Error("App binding method unavailable");
+                                return unwrap(await call.apply(stub, [...args]));
+                            };
+                        },
+                    }),
+                ];
+            }));
+        },
+    };
+}

package/dist/git-admission.d.ts

@@ -0,0 +1,52 @@
+/** One admitted path for external and installation-authored repository writes. */
+import { type AppGitPushFact, type GitBinding, type GitExchangeRequest, type GitExchangeResponse, type GitPushQuestion, type GitPushVerdict, type GitWriter } from "@fungi.computer/agar/git";
+import type { HostActor } from "@fungi.computer/puffball/app-method-runtime";
+import type { AppDeclaration } from "@fungi.computer/puffball/app";
+import type { Installation } from "./apps/installation.js";
+/** Installation-scoped storage; transport and credentials stay with its provider adapter. */
+export type GitStore = GitBinding;
+/** Live host authority, reopened before every provider call. Null is an anonymous reader. */
+export type GitGrants = Readonly<{
+    /** Reopen the host authority for this repository and requested scope. */
+    admits(writer: GitWriter | null, repository: string, scope: "read" | "write"): Promise<boolean>;
+}>;
+/** Reuse the live installation/verified Release rule without opening provider storage. */
+export declare function createInstallationGitAdmission(ports: Readonly<{
+    currentInstallation(): Promise<Installation | null>;
+    declaration(current: Installation): Promise<AppDeclaration | null>;
+}>): GitGrants["admits"];
+/** Repository rules owned by the selected App; a missing or malformed answer refuses. */
+export type GitPolicy = Readonly<{
+    /** Ask the selected App to decide every ref update in the whole push. */
+    authorize(question: GitPushQuestion): Promise<GitPushVerdict>;
+}>;
+/** Durable accepted-ref journal; record commits before the provider result is acknowledged. */
+export type GitJournal = Readonly<{
+    /** Read the last durably accepted hash for a ref, or null if unknown. */
+    tip(repository: string, ref: string): Promise<string | null>;
+    /** Persist accepted refs and their fact before acknowledging the push. */
+    record(fact: AppGitPushFact): Promise<void>;
+}>;
+/** Host-held read/write path; Apps receive only its installation-authored binding. */
+export type AdmittedGit = Readonly<{
+    /** Admit an external writer through host authority, App policy and the journal. */
+    push(writer: Extract<GitWriter, {
+        kind: "actor";
+    }>, repository: string, request: GitExchangeRequest): Promise<GitExchangeResponse>;
+    /** Recheck host read authority before exchanging provider bytes. */
+    read(writer: Extract<GitWriter, {
+        kind: "actor";
+    }> | null, repository: string, request: GitExchangeRequest): Promise<GitExchangeResponse>;
+    /** Bind installation-authored operations; null attribution is lifecycle-only. */
+    binding(onBehalfOf: HostActor | null): GitBinding;
+}>;
+/** Fixed order: host grant, Workflow ceiling, App policy, provider exchange, durable journal. */
+export declare function createAdmittedGit(ports: Readonly<{
+    installationId: string;
+    store: GitStore;
+    grants: GitGrants;
+    policy: GitPolicy;
+    journal: GitJournal;
+    /** Host-held invocation closure, checked after asynchronous authority admission. */
+    beforeProvider?: (() => void) | undefined;
+}>): AdmittedGit;