@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/dist/app-builds.js

@@ -0,0 +1,499 @@
+/**
+ * Oyster's App build owner: an App's registered source, its build jobs on the
+ * host's own Computer, and the Releases those builds produce.
+ *
+ * A build runs the shared job lifecycle (`build/build-jobs.ts`) and the fixed
+ * captured builder command on one Computer. The Computer holds no key: its
+ * clone is admitted at egress for exactly the job's one repository (read
+ * only), and its candidate upload for exactly the job. A source is either a
+ * repository in an installation's Git (a fork, through the Git door) or the
+ * App's own published template, built only at a recorded seed revision of
+ * its pinned recipe (no installed App is needed). The build streams each
+ * built object into the host's artifact store itself, through the egress, and
+ * then submits a small manifest naming them. This owner only records facts:
+ * it checks each named object's stored size and digest, writes the asset
+ * manifest and App root in Oyster's one immutable artifact representation
+ * (the same objects a packed upload writes), verifies the Release like any
+ * installed one, and records it; installing it is a separate owner act.
+ */
+import * as Schema from "effect/Schema";
+import { parseArtifactRef, parseReleaseId, } from "@fungi.computer/puffball";
+import { appIdSchema, releaseSchema, sha256DigestSchema, sourceRevisionSchema, } from "@fungi.computer/puffball/effect";
+import { capturedPinnedRecipeSchema, digestPinnedRecipe, fitsPinnedRecipe, pinnedRecipeObjectBound, } from "./build/effect.js";
+import { candidateManifestObjects, decodeCandidateBackend, digestTeamAppCandidateManifest, } from "./build/submission-contract.js";
+import { contentObjectRef } from "./build/content-objects.js";
+import { createTeamBuildPublisher, teamAppBuildCommand, } from "./build/build-jobs.js";
+import { writeArtifactRoot, } from "./build/artifact-writer.js";
+import { buildGitPassPrefix } from "./git-auth.js";
+import { defaultAssetPolicy, readVerified, verifyRelease, } from "./release.js";
+import { appForTemplateRepository, templateRepositoryForApp, } from "./source/template-repository.js";
+/** A Computer's whole-build budget: a cold build on a 6 GiB Computer measured 185-270 s. */
+export const oysterAppBuildTimeoutMs = 900_000;
+/** The job, its clone admission and its upload grant end together. */
+const jobTtlMs = oysterAppBuildTimeoutMs + 5 * 60_000;
+/** Host names the Computer's egress serves for a build; never public hosts. */
+export const oysterBuildGitHost = "git.team.internal";
+export const oysterBuildReportHost = "build.team.internal";
+/** Where an App's source is cloned from. */
+export const oysterBuildLocationSchema = Schema.Union([
+    Schema.Struct({
+        kind: Schema.Literal("installation"),
+        /** The installation whose Git holds the repository (Bonsai for a fork). */
+        installationId: Schema.String.check(Schema.isPattern(/^[a-zA-Z0-9_-]{1,256}$/u)),
+        repository: Schema.String.check(Schema.isPattern(/^[a-zA-Z0-9._-]{1,128}$/u)),
+    }),
+    /** The App's own published template (`templateRepositoryForApp`). */
+    Schema.Struct({ kind: Schema.Literal("template") }),
+]);
+/** An App's registered build source: where it is cloned and its pinned recipe. */
+export const oysterBuildSourceSchema = Schema.Struct({
+    appId: appIdSchema,
+    location: oysterBuildLocationSchema,
+    recipe: capturedPinnedRecipeSchema,
+    buildRecipeDigest: sha256DigestSchema,
+});
+/** One Computer as the build owner reaches it. */
+/** The Computer established no terminal result for a build command, for
+ * example because its connection to the container dropped mid-command. */
+class BuildOutcomeUnknown extends Error {
+    constructor() {
+        super("Build outcome unknown");
+    }
+}
+/** The repository a job clones: its installation repository, or its App's template. */
+const cloneRepository = (job) => job.location.kind === "installation"
+    ? job.location.repository
+    : templateRepositoryForApp(job.app_id);
+const jobRow = Schema.Struct({
+    job_id: Schema.String,
+    app_id: Schema.String,
+    release_id: Schema.String,
+    source_revision: Schema.String,
+    /** The job's clone location, as its source named it when the job started. */
+    location: Schema.fromJsonString(oysterBuildLocationSchema),
+    recipe: Schema.String,
+    recipe_digest: Schema.String,
+    requested_by: Schema.String,
+    credential_id: Schema.String,
+    upload_grant_digest: Schema.String,
+    status: Schema.Literals(["running", "succeeded", "failed", "revoked"]),
+    artifact_digest: Schema.NullOr(Schema.String),
+    artifact_bytes: Schema.NullOr(Schema.Number),
+    detail: Schema.NullOr(Schema.String),
+    issued_at: Schema.Number,
+    expires_at: Schema.Number,
+    executable_until: Schema.Number,
+});
+const decodeJob = Schema.decodeUnknownSync(jobRow);
+const sourceRow = Schema.Struct({ source: Schema.String });
+const releaseRow = Schema.Struct({ release: Schema.String });
+const sourceCodec = Schema.fromJsonString(oysterBuildSourceSchema);
+const releaseCodec = Schema.fromJsonString(releaseSchema);
+const recipeCodec = Schema.fromJsonString(capturedPinnedRecipeSchema);
+const locationCodec = Schema.fromJsonString(oysterBuildLocationSchema);
+/** Unguessable hex identity from the platform CSPRNG. */
+function randomHex(bytes) {
+    return Array.from(crypto.getRandomValues(new Uint8Array(bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Hex(bytes) {
+    return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** Constant-time comparison of two equal-length hex digests. */
+function sameDigest(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.length; index += 1)
+        difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+    return difference === 0;
+}
+/**
+ * The SQLite tables one Oyster build owner keeps. Creation and any carrying
+ * forward of retained facts run as one transaction of the owner's storage, so
+ * an interrupted conversion leaves the facts as they were for a retry.
+ */
+export function migrateOysterAppBuilds(owner) {
+    const { sql } = owner;
+    owner.transactionSync(() => {
+        sql.exec("CREATE TABLE IF NOT EXISTS oyster_build_sources (app_id TEXT PRIMARY KEY, source TEXT NOT NULL) STRICT");
+        // Sources recorded before the location union named only an installation
+        // repository; carry each forward once, in place.
+        sql.exec(`UPDATE oyster_build_sources SET source = json_set(
+       json_remove(source, '$.installationId', '$.repository'), '$.location',
+       json_object('kind', 'installation',
+         'installationId', json_extract(source, '$.installationId'),
+         'repository', json_extract(source, '$.repository')))
+     WHERE json_type(source, '$.location') IS NULL`);
+        const jobColumns = `
+      job_id TEXT PRIMARY KEY, app_id TEXT NOT NULL, release_id TEXT NOT NULL UNIQUE,
+      source_revision TEXT NOT NULL, location TEXT NOT NULL,
+      recipe TEXT NOT NULL, recipe_digest TEXT NOT NULL, requested_by TEXT NOT NULL,
+      credential_id TEXT NOT NULL, upload_grant_digest TEXT NOT NULL,
+      status TEXT NOT NULL, artifact_digest TEXT, artifact_bytes INTEGER, detail TEXT,
+      issued_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, executable_until INTEGER NOT NULL`;
+        sql.exec(`CREATE TABLE IF NOT EXISTS oyster_build_jobs (${jobColumns}) STRICT`);
+        // Jobs recorded before the location union named an installation repository
+        // in two columns; carry each into the one location column, once.
+        if (sql
+            .exec("SELECT name FROM pragma_table_info('oyster_build_jobs') WHERE name='installation_id'")
+            .toArray().length > 0) {
+            sql.exec(`CREATE TABLE oyster_build_jobs_current (${jobColumns}) STRICT`);
+            sql.exec(`INSERT INTO oyster_build_jobs_current SELECT job_id, app_id, release_id,
+         source_revision,
+         json_object('kind', 'installation', 'installationId', installation_id,
+           'repository', repository),
+         recipe, recipe_digest, requested_by, credential_id, upload_grant_digest,
+         status, artifact_digest, artifact_bytes, detail, issued_at, expires_at,
+         executable_until
+       FROM oyster_build_jobs`);
+            sql.exec("DROP TABLE oyster_build_jobs");
+            sql.exec("ALTER TABLE oyster_build_jobs_current RENAME TO oyster_build_jobs");
+        }
+        sql.exec("CREATE TABLE IF NOT EXISTS oyster_build_releases (release_id TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE, release TEXT NOT NULL) STRICT");
+    });
+}
+/** The build owner over one tenant's SQLite, Computer and artifact store. */
+export function createOysterAppBuilds(options) {
+    const { owner } = options;
+    const now = options.now ?? Date.now;
+    // The host store overwrites on put, so write-once is checked here first.
+    const storeObjects = {
+        async create(artifactRef, bytes) {
+            if ((await options.artifacts.get(artifactRef)) !== null)
+                return "exists";
+            await options.artifacts.put(artifactRef, bytes);
+            return "created";
+        },
+        read: (artifactRef) => options.artifacts.get(artifactRef),
+    };
+    migrateOysterAppBuilds(owner);
+    // A job outlives the owner instance that started it: the Computer keeps
+    // building and its own reports (objects, candidate, status) settle the
+    // job, so an owner restart must not fail it. A job that reaches its expiry
+    // without a result can never settle, so it fails then instead of reading
+    // as running for as long as anyone asks.
+    const expire = () => owner.sql.exec("UPDATE oyster_build_jobs SET status='failed', detail=? WHERE status='running' AND expires_at<=?", "Build expired without a result", now());
+    expire();
+    const decodeRecipe = (recipe) => Schema.decodeUnknownSync(recipeCodec)(recipe);
+    const grantAdmits = async (job, grant) => sameDigest(job.upload_grant_digest, await sha256Hex(new TextEncoder().encode(grant)));
+    const readJob = (jobId) => {
+        const [row] = owner.sql
+            .exec("SELECT * FROM oyster_build_jobs WHERE job_id=?", jobId)
+            .toArray();
+        return row === undefined ? null : decodeJob(row);
+    };
+    const live = (job) => job !== null && job.status === "running" && job.expires_at > now();
+    const readRelease = (jobId) => {
+        const [row] = owner.sql
+            .exec("SELECT release FROM oyster_build_releases WHERE job_id=?", jobId)
+            .toArray();
+        return row === undefined
+            ? null
+            : Schema.decodeUnknownSync(releaseCodec)(Schema.decodeUnknownSync(releaseRow)(row).release);
+    };
+    const lifecycleJob = (job) => ({
+        jobId: job.job_id,
+        computerId: options.computer.name,
+        credentialId: job.credential_id,
+        issuedAt: job.issued_at,
+        repository: cloneRepository(job),
+        expiresAt: job.expires_at,
+        remote: job.location.kind === "installation"
+            ? `https://${oysterBuildGitHost}/git/${job.location.installationId}/${job.location.repository}.git`
+            : `https://${oysterBuildGitHost}/${cloneRepository(job)}.git`,
+        reportUrl: `https://${oysterBuildReportHost}/jobs/${job.job_id}`,
+        status: job.status,
+        artifact: job.artifact_digest === null || job.artifact_bytes === null
+            ? null
+            : { digest: job.artifact_digest, bytes: job.artifact_bytes },
+        detail: job.detail,
+    });
+    const settle = (jobId, status, detail) => {
+        owner.sql.exec("UPDATE oyster_build_jobs SET status=?, detail=?, expires_at=MIN(expires_at, ?) WHERE job_id=? AND status='running'", status, detail, now(), jobId);
+    };
+    const required = (jobId) => {
+        const job = readJob(jobId);
+        if (job === null)
+            throw new Error("Unknown build job");
+        return job;
+    };
+    const publisher = createTeamBuildPublisher({
+        teamId: options.tenantId,
+        now,
+        maxPermissionAgeMs: jobTtlMs,
+        team: {
+            // The job row is minted in `start`; the lifecycle only reads it back.
+            mintTeamBuildCredential: ({ jobId }) => Promise.resolve(lifecycleJob(required(jobId))),
+            revokeTeamBuild: (jobId) => {
+                settle(jobId, "revoked", "Build revoked");
+                return Promise.resolve(lifecycleJob(required(jobId)));
+            },
+            build: () => Promise.resolve({
+                prepare: (jobId) => Promise.resolve(lifecycleJob(required(jobId))),
+                read: (jobId) => {
+                    const job = readJob(jobId);
+                    return Promise.resolve(job === null ? null : lifecycleJob(job));
+                },
+                complete: (jobId, status, detail) => {
+                    settle(jobId, status, detail);
+                    return Promise.resolve(lifecycleJob(required(jobId)));
+                },
+                // Oyster's egress writes job facts here directly; nothing is queued.
+                deliverProjection: () => Promise.resolve(),
+                [Symbol.dispose]: () => undefined,
+            }),
+        },
+        computer: () => ({
+            applyBuildDecision: (decision) => {
+                owner.sql.exec("UPDATE oyster_build_jobs SET executable_until=? WHERE job_id=?", decision.status === "allowed" ? decision.expiresAt : 0, decision.jobId);
+                return Promise.resolve();
+            },
+            execute: async (input) => {
+                const result = await options.computer.port.runBuild({
+                    jobId: input.jobId,
+                    command: input.command,
+                    timeoutMs: input.timeoutMs,
+                });
+                if (result.output === undefined || result.output === null)
+                    throw new BuildOutcomeUnknown();
+                return result;
+            },
+            deliverTeamGitEvents: () => Promise.resolve(0),
+        }),
+    });
+    const readSource = (appId) => {
+        const [row] = owner.sql
+            .exec("SELECT source FROM oyster_build_sources WHERE app_id=?", appId)
+            .toArray();
+        return row === undefined
+            ? null
+            : Schema.decodeUnknownSync(sourceCodec)(Schema.decodeUnknownSync(sourceRow)(row).source);
+    };
+    const run = async (jobId, command) => {
+        try {
+            await publisher.run({
+                jobId,
+                command,
+                timeoutMs: oysterAppBuildTimeoutMs,
+            });
+        }
+        catch (cause) {
+            // Without a terminal result the build may still be running on the
+            // Computer; its own reports settle the job, or its expiry fails it.
+            if (!(cause instanceof BuildOutcomeUnknown))
+                settle(jobId, "failed", cause instanceof Error ? cause.message : "Build failed");
+        }
+        return view(required(jobId));
+    };
+    const view = (job) => ({
+        jobId: job.job_id,
+        appId: job.app_id,
+        releaseId: job.release_id,
+        sourceRevision: job.source_revision,
+        status: job.status,
+        detail: job.detail,
+        release: readRelease(job.job_id),
+    });
+    return Object.freeze({
+        /** Record (or replace) an App's build source; the caller is the owner. */
+        registerSource(source) {
+            if (digestPinnedRecipe(source.recipe) !== source.buildRecipeDigest)
+                throw new Error("Build recipe digest does not match its recipe");
+            owner.sql.exec("INSERT INTO oyster_build_sources(app_id, source) VALUES(?, ?) ON CONFLICT(app_id) DO UPDATE SET source=excluded.source", source.appId, Schema.encodeUnknownSync(sourceCodec)(source));
+            return source;
+        },
+        readSource,
+        /**
+         * Mint one build job for an App's registered source at one exact commit.
+         * A template source builds only a seed revision recorded for its pinned
+         * recipe.
+         * Answers the job and its one run, which the caller keeps alive (the
+         * upload grant exists only inside that run's fixed command).
+         */
+        async start(input) {
+            const sourceRevision = Schema.decodeUnknownSync(sourceRevisionSchema)(input.sourceRevision);
+            const source = readSource(input.appId);
+            if (source === null)
+                throw new Error("App has no build source");
+            if (source.location.kind === "template") {
+                const receipt = await options.templates.read(source.appId, sourceRevision);
+                if (receipt?.buildRecipeDigest !== source.buildRecipeDigest)
+                    throw new Error("Revision is not a seed of this App's template");
+            }
+            const jobId = `build_${randomHex(16)}`;
+            const releaseId = parseReleaseId(`rel_${sourceRevision.slice("git:".length, "git:".length + 12)}${randomHex(4)}`);
+            const uploadGrant = randomHex(32);
+            const issuedAt = now();
+            owner.sql.exec(`INSERT INTO oyster_build_jobs(job_id, app_id, release_id, source_revision, location,
+          recipe, recipe_digest, requested_by, credential_id, upload_grant_digest,
+          status, artifact_digest, artifact_bytes, detail, issued_at, expires_at, executable_until)
+        VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'running', NULL, NULL, NULL, ?, ?, 0)`, jobId, source.appId, releaseId, sourceRevision, Schema.encodeUnknownSync(locationCodec)(source.location), Schema.encodeUnknownSync(recipeCodec)(source.recipe), source.buildRecipeDigest, input.requestedBy, randomHex(32), await sha256Hex(new TextEncoder().encode(uploadGrant)), issuedAt, issuedAt + jobTtlMs);
+            // The grant leaves this owner only inside the fixed command.
+            const command = teamAppBuildCommand({ appId: source.appId, sourceRevision, source }, uploadGrant);
+            return { build: view(required(jobId)), run: () => run(jobId, command) };
+        },
+        read(jobId) {
+            expire();
+            const job = readJob(jobId);
+            return job === null ? null : view(job);
+        },
+        /** A built Release by id, for an owner to install or select. */
+        release(releaseId) {
+            const [row] = owner.sql
+                .exec("SELECT release FROM oyster_build_releases WHERE release_id=?", releaseId)
+                .toArray();
+            return row === undefined
+                ? null
+                : Schema.decodeUnknownSync(releaseCodec)(Schema.decodeUnknownSync(releaseRow)(row).release);
+        },
+        /** May this Computer execute this job now? Re-checked by the Computer. */
+        admitExecution(jobId, computerObjectId) {
+            const job = readJob(jobId);
+            return (computerObjectId === options.computer.objectId &&
+                live(job) &&
+                job.executable_until > now());
+        },
+        /** The live job a build report from this Computer may speak for. */
+        admitBuild(jobId, computerObjectId) {
+            const job = readJob(jobId);
+            return computerObjectId === options.computer.objectId && live(job)
+                ? { credentialId: job.credential_id }
+                : null;
+        },
+        /**
+         * The clone credential the egress presents for this Computer's live job
+         * on exactly this repository, read only; null when no job admits it.
+         */
+        gitPassFor(computerObjectId, target) {
+            if (computerObjectId !== options.computer.objectId ||
+                target.scope !== "read")
+                return null;
+            const job = owner.sql
+                .exec(`SELECT * FROM oyster_build_jobs WHERE json_extract(location, '$.kind')='installation'
+            AND json_extract(location, '$.installationId')=? AND json_extract(location, '$.repository')=?
+            AND status='running' AND expires_at>? ORDER BY issued_at DESC LIMIT 1`, target.installationId, target.repository, now())
+                .toArray()
+                .map((row) => decodeJob(row))[0];
+            return job === undefined
+                ? null
+                : `${buildGitPassPrefix}${job.job_id}.${job.credential_id}`;
+        },
+        /** Admit a presented clone credential at the Git door: one repository, read. */
+        admitGitPass(pass, target) {
+            const match = /^obp\.(build_[0-9a-f]{32})\.([0-9a-f]{64})$/u.exec(pass);
+            if (match === null || target.scope !== "read")
+                return null;
+            const job = readJob(match[1] ?? "");
+            return live(job) &&
+                job.location.kind === "installation" &&
+                sameDigest(job.credential_id, match[2] ?? "") &&
+                job.location.installationId === target.installationId &&
+                job.location.repository === target.repository
+                ? { requestedBy: job.requested_by }
+                : null;
+        },
+        /**
+         * May this Computer's clone read this template repository now? Only while
+         * a live template job on this Computer names it.
+         */
+        admitTemplateClone(computerObjectId, repository) {
+            if (computerObjectId !== options.computer.objectId)
+                return false;
+            // The template repository names exactly one App (templateRepositoryForApp).
+            const appId = appForTemplateRepository(repository);
+            if (appId === null)
+                return false;
+            return (owner.sql
+                .exec(`SELECT 1 FROM oyster_build_jobs WHERE app_id=? AND json_extract(location, '$.kind')='template'
+              AND status='running' AND expires_at>? LIMIT 1`, appId, now())
+                .toArray().length > 0);
+        },
+        /** A reported artifact or status for a live job. */
+        record(event) {
+            const job = readJob(event.jobId);
+            if (!live(job) || job.credential_id !== event.credentialId)
+                return;
+            if (event.kind === "build-artifact")
+                owner.sql.exec("UPDATE oyster_build_jobs SET artifact_digest=?, artifact_bytes=? WHERE job_id=?", event.digest, event.bytes, event.jobId);
+            // Success is the recorded Release's fact, never the report's alone.
+            else if (event.status === "failed" || readRelease(event.jobId) !== null)
+                settle(event.jobId, event.status, event.detail);
+        },
+        /**
+         * May this live job's build upload one object now, and how large? The
+         * grant is the one inside the job's fixed command; the bound is its
+         * recipe's (`pinnedRecipeObjectBound`).
+         */
+        async admitObjectUpload(jobId, computerObjectId, grant) {
+            const job = readJob(jobId);
+            if (computerObjectId !== options.computer.objectId ||
+                !live(job) ||
+                !(await grantAdmits(job, grant)))
+                return null;
+            return {
+                maxObjectBytes: pinnedRecipeObjectBound(decodeRecipe(job.recipe)),
+            };
+        },
+        /**
+         * The Computer's candidate manifest for a live job: checked against the
+         * job and its pinned recipe, each named object found stored with its
+         * size and verified digest (one at a time; only the backend descriptor
+         * is read), its asset manifest and App root written, verified as an
+         * installable Release and recorded. An over-policy candidate stores
+         * nothing.
+         */
+        async submitCandidate(jobId, manifest, grant, credentialId) {
+            const job = readJob(jobId);
+            if (!live(job) ||
+                job.credential_id !== credentialId ||
+                !(await grantAdmits(job, grant)))
+                return new Response(null, { status: 403 });
+            if (manifest.appId !== job.app_id ||
+                manifest.provenance.sourceRevision !== job.source_revision ||
+                manifest.provenance.buildRecipeDigest !== job.recipe_digest)
+                return new Response(null, { status: 409 });
+            if (readRelease(jobId) !== null)
+                return new Response(null, { status: 409 });
+            const recipe = decodeRecipe(job.recipe);
+            let release;
+            try {
+                if (!fitsPinnedRecipe(manifest.output, recipe))
+                    throw new Error("Candidate exceeds its pinned recipe");
+                for (const object of candidateManifestObjects(manifest.output)) {
+                    const head = await options.artifacts.head(contentObjectRef(object.digest));
+                    if (head?.byteLength !== object.byteLength ||
+                        head.digest !== object.digest)
+                        throw new Error("Candidate object is not stored as named");
+                }
+                if (manifest.output.kind !== "ui")
+                    decodeCandidateBackend(await readVerified(options.artifacts, contentObjectRef(manifest.output.backend.digest), manifest.output.backend.digest));
+                const root = await writeArtifactRoot(manifest.output, storeObjects, {
+                    rootArtifactRef: parseArtifactRef(`artifact:sha256-${await digestTeamAppCandidateManifest(manifest)}`),
+                    assetPolicy: recipe.assets,
+                });
+                release = Schema.decodeUnknownSync(releaseSchema)({
+                    releaseId: job.release_id,
+                    appId: manifest.appId,
+                    artifact: {
+                        artifactRef: root.artifactRef,
+                        artifactDigest: root.artifactDigest,
+                        provenance: manifest.provenance,
+                    },
+                });
+                // Each object was checked by its stored digest above.
+                await verifyRelease(options.artifacts, release, defaultAssetPolicy, false);
+            }
+            catch {
+                settle(jobId, "failed", "Candidate could not be stored as a Release");
+                return new Response(null, { status: 422 });
+            }
+            owner.transactionSync(() => {
+                owner.sql.exec("INSERT INTO oyster_build_releases(release_id, job_id, release) VALUES(?, ?, ?)", release.releaseId, jobId, Schema.encodeUnknownSync(releaseCodec)(release));
+            });
+            return Response.json({
+                kind: "submitted",
+                release: Schema.encodeUnknownSync(releaseSchema)(release),
+            });
+        },
+    });
+}

package/dist/app-sandbox.d.ts

@@ -0,0 +1,2 @@
+/** The sandbox every installed App frame runs in, shell-mounted or not. */
+export declare const appSandbox = "allow-scripts allow-modals allow-popups allow-forms";

package/dist/app-sandbox.js

@@ -0,0 +1,2 @@
+/** The sandbox every installed App frame runs in, shell-mounted or not. */
+export const appSandbox = "allow-scripts allow-modals allow-popups allow-forms";

package/dist/app-sources.d.ts

@@ -0,0 +1,31 @@
+import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+import type { Artifacts } from "@fungi.computer/burrow";
+import type { CloudflareArtifactsRepositoryMetadataStore } from "@fungi.computer/burrow/cloudflare";
+import { type TeamAppPublisherRegistry } from "@fungi.computer/puffball/publisher";
+import { type PublisherTemplateSeedReceipts } from "./source/index.js";
+/**
+ * Oyster's own storage for App source templates, Team-owned fork
+ * registrations and the recorded Artifacts repository metadata their fork
+ * provenance depends on. Each factory is a pure adapter over a generic
+ * synchronous SQLite port, so it is unit-testable with a Node `DatabaseSync`
+ * and identically correct over a Durable Object's `ctx.storage.sql`.
+ */
+export declare function ensureAppSourceTables(sql: WatchdogSqliteOwner["sql"]): void;
+/** Append-only App source seed receipts, owned by one Oyster's registry. */
+export declare function createOysterAppSourceReceipts(sql: WatchdogSqliteOwner["sql"]): PublisherTemplateSeedReceipts;
+/** Team-owned App publisher registrations (fork destinations), one per App. */
+export declare function createOysterAppRegistrations(sql: WatchdogSqliteOwner["sql"]): TeamAppPublisherRegistry;
+/** Durable repository provenance for Oyster's own `createCloudflareArtifacts`. */
+export declare function createOysterArtifactsRepositoryMetadataStore(sql: WatchdogSqliteOwner["sql"]): CloudflareArtifactsRepositoryMetadataStore;
+/** Translate one local Git smart-HTTP request into an admitted Artifacts
+ * exchange; the identical shape Hub's Publisher keeps for its own template
+ * writes (`services/app-publisher/src/source-git.ts`), scoped to Oyster's own
+ * Artifacts composition since a package cannot depend on that service. */
+export declare function exchangeOysterTemplateGit(artifacts: Pick<Artifacts, "exchangeGit">, remote: string, repository: string, request: Request, permission?: "read" | "write"): Promise<Response>;
+/** The operator's smart-HTTP door to one App's template repository: an
+ * ordinary `git push` (or the fetch before it) to
+ * `<base>/<suffix>` reaches `template-<app>` through the same admitted
+ * Artifacts exchange, which streams both bodies and holds every provider
+ * credential. An advertisement first opens the repository, so a fresh Oyster's
+ * first seed creates it. Admission (the owner) is the caller's. */
+export declare function exchangeOysterTemplateSource(artifacts: Pick<Artifacts, "ensureRepository" | "exchangeGit">, rawAppId: string, suffix: string, request: Request): Promise<Response>;