@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/dist/standalone/install-apps-cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/standalone/install-apps-cli.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+// `oyster install-apps`: seed, build on the Oyster's own Computer, and install
+// the starter Apps (Tourtois, Bonsai, Shed, Inkcap, Trellis, Prints and
+// Grove). Each App comes from its own public repository by default, or from a
+// Botanical checkout with `--from <directory>`.
+//
+//   OYSTER_URL=https://… OYSTER_OWNER_KEY=… oyster install-apps
+//     [--repositories <base URL>] [--ref <branch or tag>]
+//     [--from <checkout directory>] [--concurrency 1-3] [--timings <file>]
+import { execFileSync } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import process from "node:process";
+import { parseArgs } from "node:util";
+import { defaultStarterBuildConcurrency, installStandaloneAppSet, } from "./app-set.js";
+/** The starter Apps' public source repositories. */
+const defaultRepositories = "https://github.com/fungi-computer";
+const usage = "Usage: oyster install-apps [--repositories <base URL>] [--ref <ref>] [--from <checkout>] [--concurrency 1-3] [--timings <file>]";
+function seconds(milliseconds) {
+    return `${(milliseconds / 1000).toFixed(1)}s`;
+}
+function timingTable(results) {
+    const rows = results.map(({ installationId, timings }) => [
+        installationId,
+        seconds(timings.fetch),
+        seconds(timings.publish),
+        seconds(timings.queue),
+        seconds(timings.build),
+        timings.computer === null ? "-" : seconds(timings.computer.clone),
+        timings.computer === null ? "-" : seconds(timings.computer.install),
+        timings.computer === null ? "-" : seconds(timings.computer.build),
+        timings.computer === null ? "-" : seconds(timings.computer.upload),
+        seconds(timings.install),
+    ]);
+    const header = [
+        "App",
+        "fetch",
+        "seed",
+        "queue",
+        "build",
+        "clone",
+        "deps",
+        "compile",
+        "upload",
+        "install",
+    ];
+    return [header, ...rows].map((row) => row.join("\t")).join("\n");
+}
+async function installApps(args) {
+    const { values } = parseArgs({
+        args: [...args],
+        options: {
+            repositories: { type: "string" },
+            ref: { type: "string" },
+            from: { type: "string" },
+            concurrency: { type: "string" },
+            timings: { type: "string" },
+        },
+        strict: true,
+    });
+    const url = process.env.OYSTER_URL;
+    const key = process.env.OYSTER_OWNER_KEY;
+    if (!url || !key)
+        throw new Error("Set OYSTER_URL and OYSTER_OWNER_KEY");
+    if (values.from !== undefined && values.repositories !== undefined)
+        throw new Error("Choose either --from or --repositories");
+    const concurrency = values.concurrency === undefined
+        ? defaultStarterBuildConcurrency
+        : Number(values.concurrency);
+    const scratch = await mkdtemp(join(tmpdir(), "oyster-install-apps-"));
+    try {
+        let source;
+        if (values.from === undefined)
+            source = {
+                kind: "repositories",
+                base: (values.repositories ?? defaultRepositories).replace(/\/+$/u, ""),
+                ref: values.ref ?? "main",
+                scratch,
+            };
+        else {
+            const directory = resolve(values.from);
+            const revision = execFileSync("git", ["rev-parse", "HEAD"], {
+                cwd: directory,
+                encoding: "utf8",
+            }).trim();
+            source = { kind: "checkout", directory, revision: `git:${revision}` };
+        }
+        const started = performance.now();
+        const results = await installStandaloneAppSet({
+            source,
+            url,
+            key,
+            concurrency,
+            report: (message) => {
+                process.stdout.write(`${message}\n`);
+            },
+        });
+        const elapsed = performance.now() - started;
+        process.stdout.write(`\n${timingTable(results)}\n`);
+        process.stdout.write(`\nInstalled ${String(results.length)} Apps in ${seconds(elapsed)}. Open ${url}/ to use Tourtois and the installed Apps.\n`);
+        if (values.timings !== undefined)
+            await writeFile(values.timings, JSON.stringify({
+                concurrency,
+                elapsedMs: elapsed,
+                apps: results.map(({ installationId, jobId, timings }) => ({
+                    installationId,
+                    jobId,
+                    timings,
+                })),
+            }, null, 2) + "\n");
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+}
+const [command, ...rest] = process.argv.slice(2);
+if (command !== "install-apps") {
+    process.stderr.write(`${usage}\n`);
+    process.exitCode = 2;
+}
+else
+    await installApps(rest).catch((cause) => {
+        process.stderr.write(`${cause instanceof Error ? cause.message : String(cause)}\n`);
+        process.exitCode = 1;
+    });

package/dist/standalone/instance.d.ts

@@ -0,0 +1,35 @@
+import { type OysterBindingTable } from "../workers.js";
+import { OysterGitInstance, OysterWebhooks, type HostRecipientEvent, type OysterGitWorkerEnv } from "../workers-git.js";
+import { type StandaloneAgentsEnv } from "./agents.js";
+import { type StandaloneComputerEnv } from "./computer.js";
+import { type OysterMediaEnv } from "./media.js";
+import { type AppSourceBindingEnv } from "./app-source.js";
+import { type WorkflowBindingEnv, type WorkflowEventEnv, type WorkflowGitPassEnv } from "./workflow-binding.js";
+export type StandaloneInstanceEnv = OysterGitWorkerEnv & WorkflowBindingEnv & WorkflowEventEnv & WorkflowGitPassEnv & StandaloneComputerEnv & StandaloneAgentsEnv & OysterMediaEnv & AppSourceBindingEnv;
+/** Git and Events plus the declared Computer, Media, Workflow, Agent and App
+ * source bindings. */
+export declare const standaloneBindings: OysterBindingTable<StandaloneInstanceEnv>;
+declare const OysterBinding_base: abstract new (ctx: ExecutionContext, env: StandaloneInstanceEnv) => CloudflareWorkersModule.WorkerEntrypoint<StandaloneInstanceEnv, Readonly<{
+    instanceId: string;
+    binding: import("@fungi.computer/puffball/app").AppBackendBindingName;
+    frameId: string;
+}>>;
+/** The standalone root's one guest binding entrypoint, over `standaloneBindings`. */
+export declare class OysterBinding extends OysterBinding_base {
+}
+/** The standalone Instance serves `standaloneBindings`; its root names `hostFor`. */
+export declare abstract class StandaloneInstance<Env extends StandaloneInstanceEnv = StandaloneInstanceEnv> extends OysterGitInstance<Env> {
+    protected readonly bindings: OysterBindingTable<Env>;
+}
+/**
+ * The tenant's event delivery owner, whose host recipients are Workflows
+ * libraries. A library that is down keeps its own row pending and retried, or
+ * failed after the last retry; the emitting App's write has already returned.
+ */
+export declare class StandaloneEventDelivery extends OysterWebhooks<WorkflowEventEnv> {
+    protected deliverToRecipient(delivery: Readonly<{
+        recipient: string;
+        event: HostRecipientEvent;
+    }>): Promise<void>;
+}
+export {};

package/dist/standalone/instance.js

@@ -0,0 +1,74 @@
+import { AppInstanceError } from "../index.js";
+import { oysterBindingEntrypoint, } from "../workers.js";
+import { OysterGitInstance, OysterWebhooks, eventsBindingFor, gitBindings, } from "../workers-git.js";
+import { agentFrameMethods, dispatchAgentBinding, } from "./agents.js";
+import { computerFrameMethods, computerInvocation, standaloneWorkspace, } from "./computer.js";
+import { dispatchMediaBinding, mediaFrameMethods, } from "./media.js";
+import { appSourceFrameMethods, dispatchAppSourceBinding, } from "./app-source.js";
+import { workflowFrameMethods, dispatchWorkflowBinding, deliverWorkflowEvent, openWorkflowGitPass, workflowEventRecipients, } from "./workflow-binding.js";
+import { appsFrameMethods, dispatchAppsBuildsBinding, } from "./app-builds-binding.js";
+/** Git and Events plus the declared Computer, Media, Workflow, Agent and App
+ * source bindings. */
+export const standaloneBindings = {
+    ...gitBindings,
+    /** Catalog and fork are source operations; build, status and select
+     * run on this Oyster's Computer and installations. */
+    APPS: {
+        methods: { ...appSourceFrameMethods.APPS, ...appsFrameMethods.APPS },
+        dispatch: (context, frame, props, method, args) => Object.hasOwn(appSourceFrameMethods.APPS, method)
+            ? dispatchAppSourceBinding(context.env, context.scope(), frame, method, args)
+            : dispatchAppsBuildsBinding(context.env, context.scope(), frame, props, method, args, context.backgroundHost),
+    },
+    COMPUTER: {
+        methods: computerFrameMethods.COMPUTER,
+        async dispatch(context, frame, _props, method, args) {
+            if (method !== "workflowGitPass")
+                return computerInvocation(context.env, frame, method, args);
+            // A published Workflow Git step's pass, minted by the library that runs it.
+            const host = await context.backgroundHost();
+            if (host === null)
+                throw new AppInstanceError("revoked");
+            return openWorkflowGitPass(context.env, host.installations, frame, args);
+        },
+    },
+    MEDIA: {
+        methods: mediaFrameMethods.MEDIA,
+        dispatch: (context, frame, props, method, args) => dispatchMediaBinding(context.env, frame, props, method, args, standaloneWorkspace(context.env)),
+    },
+    WORKFLOWS: {
+        methods: workflowFrameMethods.WORKFLOWS,
+        dispatch: (context, frame, props, method, args) => dispatchWorkflowBinding(context.env, frame, props, method, args),
+    },
+    INBOX: {
+        methods: agentFrameMethods.INBOX,
+        dispatch: (context, frame, props, method, args) => dispatchAgentBinding(context.env, context.scope(), frame, props, method, args),
+    },
+    AGENTS: {
+        methods: agentFrameMethods.AGENTS,
+        dispatch: (context, frame, props, method, args) => dispatchAgentBinding(context.env, context.scope(), frame, props, method, args),
+    },
+    /** The emit commits to the delivery owner; Workflows libraries receive it afterwards. */
+    EVENTS: eventsBindingFor(async (context) => {
+        const host = await context.backgroundHost();
+        if (host === null)
+            throw new AppInstanceError("revoked");
+        return workflowEventRecipients(host.installations);
+    }),
+};
+/** The standalone root's one guest binding entrypoint, over `standaloneBindings`. */
+export class OysterBinding extends oysterBindingEntrypoint(standaloneBindings) {
+}
+/** The standalone Instance serves `standaloneBindings`; its root names `hostFor`. */
+export class StandaloneInstance extends OysterGitInstance {
+    bindings = standaloneBindings;
+}
+/**
+ * The tenant's event delivery owner, whose host recipients are Workflows
+ * libraries. A library that is down keeps its own row pending and retried, or
+ * failed after the last retry; the emitting App's write has already returned.
+ */
+export class StandaloneEventDelivery extends OysterWebhooks {
+    deliverToRecipient(delivery) {
+        return deliverWorkflowEvent(this.env, delivery.recipient, delivery.event);
+    }
+}

package/dist/standalone/media.d.ts

@@ -0,0 +1,76 @@
+import type { FrameBindingProps } from "../cloudflare.js";
+import type { InvocationFrame } from "../invocation.js";
+import type { OysterBindingResult } from "../workers.js";
+import * as Schema from "effect/Schema";
+import { type MediaServiceHost } from "@fungi.computer/darkroom/server";
+import { type MediaAiPort, type MediaImagePort } from "@fungi.computer/darkroom/cloudflare";
+import { type OysterCapability } from "../host.js";
+import type { FileSource } from "../files.js";
+/** Bindings for Media generation into the standalone Oyster workspace. */
+export type OysterMediaEnv = Readonly<{
+    /** Workers AI provider, admitted by this Worker. */
+    AI: MediaAiPort;
+    /** Darkroom's durable operation namespace. */
+    MEDIA_OPERATION: MediaServiceHost["operations"];
+    /** Native image decoding and bounded reference fitting. */
+    IMAGES?: MediaImagePort;
+    /** The AI Gateway third-party models (GPT Image 2, Seedance, Veo) route
+     * through. The background retry owner already reads this same binding
+     * name for its own provider, so one var wires both doors. */
+    AI_GATEWAY_ID?: string;
+}>;
+/** Media capability using Darkroom execution and the existing workspace FileSource. */
+export declare function workersMedia(env: OysterMediaEnv, workspace: Readonly<{
+    computerId: string;
+    files: FileSource;
+}>): readonly OysterCapability[];
+/** The Instance gate and native guest entrypoint share these argument codecs. */
+export declare const mediaFrameMethods: {
+    MEDIA: {
+        [k: string]: {
+            decodeArgs: (raw: readonly unknown[]) => [Record<string, never> | {
+                kind: "image";
+                requestId: string;
+                libraryPath: string;
+                settings: {
+                    width: number;
+                    height: number;
+                    model: string;
+                    prompt: string;
+                    resolution?: "480p" | "720p" | "768p" | "1080p" | "4k" | undefined;
+                    aspectRatio?: "16:9" | "4:3" | "1:1" | "3:4" | "9:16" | "21:9" | "9:21" | undefined;
+                    references?: {
+                        path: string;
+                        role?: "first-frame" | "last-frame" | "reference" | undefined;
+                    }[] | undefined;
+                    generateAudio?: boolean | undefined;
+                    steps?: number | undefined;
+                };
+                outputFormat?: "png" | "jpeg" | "webp" | undefined;
+            } | {
+                kind: "video";
+                requestId: string;
+                libraryPath: string;
+                settings: {
+                    model: "bytedance/seedance-2.0" | "google/veo-3.1" | "bytedance/seedance-2.0-fast" | "bytedance/seedance-2.0-mini" | "google/veo-3.1-fast" | "minimax/h3-max";
+                    prompt: string;
+                    resolution?: "480p" | "720p" | "768p" | "1080p" | "4k" | undefined;
+                    aspectRatio?: "16:9" | "4:3" | "1:1" | "3:4" | "9:16" | "21:9" | "9:21" | undefined;
+                    durationSeconds?: number | undefined;
+                    generateAudio?: boolean | undefined;
+                    references?: {
+                        path: string;
+                        role: "first-frame" | "last-frame" | "reference";
+                    }[] | undefined;
+                };
+            }];
+            decodeResult: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => Schema.Json;
+            requiredOperations: () => string[];
+        };
+    };
+};
+/** Called only after the Instance resolves the captured frame and current grants. */
+export declare function dispatchMediaBinding(env: OysterMediaEnv, frame: InvocationFrame, props: FrameBindingProps, method: string, args: readonly unknown[], workspace: Readonly<{
+    computerId: string;
+    files: FileSource;
+}>): Promise<OysterBindingResult>;

package/dist/standalone/media.js

@@ -0,0 +1,227 @@
+import { z } from "zod";
+import { MAX_REFERENCE_BYTES, MediaSettingsError, } from "@fungi.computer/darkroom";
+import { AppInstanceError } from "../index.js";
+import { readMediaFailure } from "@fungi.computer/darkroom/browser";
+import { appMediaGenerationResultSchema } from "@fungi.computer/darkroom/app-media-contracts";
+import { mediaSlot } from "../media.js";
+import { Hono } from "hono";
+import * as Schema from "effect/Schema";
+import { pendingSchema } from "@fungi.computer/agar/backend-definition";
+import { mediaGenerationDescriptionSchema, mediaGenerationJsonRequestSchema, mediaGenerationReferenceSchema, } from "@fungi.computer/agar/media-json";
+import { createMediaService, mediaPendingSchema, mediaResultSchema, mediaBindingCallSchema, mediaBindingRequest, parseMediaBindingCall, readMediaBindingReply, } from "@fungi.computer/darkroom/server";
+import { createWorkersAiMediaProvider, createImagesReferenceFitter, } from "@fungi.computer/darkroom/cloudflare";
+import { oysterPrincipalId, } from "../host.js";
+import { normalizeFilePath } from "../files.js";
+/** Media capability using Darkroom execution and the existing workspace FileSource. */
+export function workersMedia(env, workspace) {
+    const { computerId } = workspace;
+    const routes = new Hono();
+    const service = (principal) => standaloneMediaService(env, oysterPrincipalId(principal), workspace);
+    routes.get("/describe", async (context) => {
+        const response = await service(context.env.principal).request("http://media/models");
+        return context.json(Schema.decodeUnknownSync(mediaGenerationDescriptionSchema)({
+            computerId,
+            canGenerate: true,
+            models: await response.json(),
+        }));
+    });
+    routes.post("/generate", async (context) => {
+        const input = Schema.decodeUnknownOption(Schema.fromJsonString(mediaGenerationJsonRequestSchema), { onExcessProperty: "error" })(await context.req.text());
+        if (input._tag === "None")
+            return context.json(invalidRequest());
+        const path = normalizeFilePath(input.value.destination.path);
+        if (path === null || path === "/")
+            return context.json(invalidRequest());
+        const references = input.value.settings.references?.map((reference) => ({
+            ...reference,
+            computerId,
+            path: normalizeFilePath(reference.path),
+        }));
+        if (references?.some((reference) => reference.path === null || reference.path === "/"))
+            return context.json(invalidRequest());
+        const response = await service(context.env.principal).request("http://media/generate", {
+            method: "POST",
+            signal: context.req.raw.signal,
+            headers: {
+                "Content-Type": "application/json",
+                "X-Request-Id": input.value.requestId,
+            },
+            body: JSON.stringify({
+                path,
+                settings: { ...input.value.settings, references },
+            }),
+        });
+        if (!response.ok) {
+            const failure = await readMediaFailure(response);
+            return context.json({
+                kind: "failed",
+                failure: failure === null
+                    ? {
+                        message: "Invalid media service response",
+                        code: "PROTOCOL",
+                        retryable: false,
+                    }
+                    : {
+                        message: failure.error,
+                        code: failure.code,
+                        stage: failure.stage,
+                        retryable: failure.retryable,
+                    },
+            });
+        }
+        if (response.status === 202) {
+            const pending = mediaPendingSchema.parse(await response.json());
+            return context.json(pendingSchema.parse({
+                kind: "pending",
+                retryAfterMs: pending.retryAfterSeconds * 1_000,
+            }));
+        }
+        const { path: destination, ...result } = mediaResultSchema.parse(await response.json());
+        return context.json({
+            kind: "succeeded",
+            result: {
+                ...result,
+                destination: { computerId, path: destination },
+            },
+        });
+    });
+    routes.post("/cancel-attempt", async (context) => {
+        const reference = Schema.decodeUnknownOption(Schema.fromJsonString(mediaGenerationReferenceSchema), { onExcessProperty: "error" })(await context.req.text());
+        if (reference._tag === "None" || reference.value.computerId !== computerId)
+            return context.json({ error: "Invalid workspace media reference" }, 400);
+        // The page aborts its active requests. Durable generation remains restorable.
+        return context.json(null);
+    });
+    return [
+        {
+            ...mediaSlot,
+            permission: "media.generation",
+            routes,
+        },
+    ];
+}
+function invalidRequest() {
+    return {
+        kind: "failed",
+        failure: {
+            message: "Invalid workspace media request",
+            stage: "settings",
+            code: "INVALID_ARGUMENT",
+            retryable: false,
+        },
+    };
+}
+function workspacePath(path) {
+    const normalized = normalizeFilePath(path);
+    if (normalized === null || normalized === "/")
+        throw new Error("Media destination must be an absolute workspace file path");
+    return normalized;
+}
+/** Both the HTTP capability and guest binding construct the existing Darkroom service. */
+function standaloneMediaService(env, actorId, workspace, owner = "owner", libraryPath) {
+    const { computerId, files } = workspace;
+    const fit = env.IMAGES === undefined
+        ? undefined
+        : createImagesReferenceFitter(env.IMAGES);
+    const destination = {
+        authorize: async (path) => {
+            workspacePath(path);
+            if (libraryPath !== undefined)
+                await files.mkdir(workspacePath(libraryPath));
+        },
+        write: (path, bytes) => files.write(workspacePath(path), bytes),
+    };
+    const admittedDestination = fit === undefined
+        ? destination
+        : {
+            ...destination,
+            readReference: async (reference) => {
+                if (reference.computerId !== computerId)
+                    throw new MediaSettingsError("reference Computer is not selected");
+                const bytes = await files.read(workspacePath(reference.path));
+                if (bytes === null ||
+                    bytes.byteLength === 0 ||
+                    bytes.byteLength > MAX_REFERENCE_BYTES)
+                    throw new MediaSettingsError("reference image is unavailable or exceeds the byte limit");
+                return {
+                    ...(await fit(bytes)),
+                    filename: reference.path.split("/").at(-1) ?? "reference",
+                };
+            },
+        };
+    return createMediaService({
+        scope: { actorId, namespace: "oyster", owner, destinationId: computerId },
+        operations: env.MEDIA_OPERATION,
+        provider: createWorkersAiMediaProvider(env.AI, env.AI_GATEWAY_ID === undefined
+            ? undefined
+            : { gateway: { id: env.AI_GATEWAY_ID } }),
+        metering: "unmetered",
+        destination: admittedDestination,
+    });
+}
+/** The Instance gate and native guest entrypoint share these argument codecs. */
+export const mediaFrameMethods = {
+    MEDIA: Object.fromEntries(["models", "generate"].map((method) => [
+        method,
+        {
+            decodeArgs: (raw) => z
+                .tuple([
+                mediaBindingCallSchema.options[method === "models" ? 0 : 1].shape
+                    .input,
+            ])
+                .parse(raw),
+            decodeResult: Schema.decodeUnknownSync(Schema.Json),
+            requiredOperations: () => [method],
+        },
+    ])),
+};
+/** Called only after the Instance resolves the captured frame and current grants. */
+export async function dispatchMediaBinding(env, frame, props, method, args, workspace) {
+    frame.signal.throwIfAborted();
+    if (props.binding !== "MEDIA" ||
+        frame.facts.subject.kind !== "call" ||
+        frame.facts.selection.owner.kind !== "installation")
+        throw new AppInstanceError("revoked");
+    const caller = frame.facts.subject.context;
+    if (caller.computerId !== workspace.computerId ||
+        caller.actor.kind === "team-key")
+        throw new AppInstanceError("revoked");
+    const parsed = parseMediaBindingCall(Schema.decodeUnknownSync(Schema.Json)({
+        operation: method,
+        input: args[0],
+    }));
+    if (parsed.kind === "refused")
+        return Schema.decodeUnknownSync(Schema.Json)(parsed.result);
+    const actorId = caller.actor.kind === "member"
+        ? caller.actor.memberId
+        : caller.actor.agentId;
+    const input = parsed.call;
+    const service = standaloneMediaService(env, actorId, workspace, frame.facts.selection.owner.id, input.operation === "generate" ? input.input.libraryPath : undefined);
+    let response;
+    if (input.operation === "models")
+        response = await service.request("/models");
+    else {
+        const body = mediaBindingRequest(input.input, workspace.computerId);
+        const generated = await service.request("/generate", {
+            method: "POST",
+            signal: frame.signal,
+            headers: {
+                "Content-Type": "application/json",
+                "X-Request-Id": input.input.requestId,
+            },
+            body: JSON.stringify(body),
+        });
+        if (generated.ok && generated.status !== 202) {
+            const result = mediaResultSchema.parse(await generated.json());
+            const { path, ...saved } = result;
+            response = Response.json(appMediaGenerationResultSchema.parse({
+                ...saved,
+                destination: { computerId: workspace.computerId, path },
+            }));
+        }
+        else
+            response = generated;
+    }
+    frame.signal.throwIfAborted();
+    return Schema.decodeUnknownSync(Schema.Json)(await readMediaBindingReply(input, workspace.computerId, response));
+}

package/dist/standalone/preview.d.ts

@@ -0,0 +1,51 @@
+import * as Schema from "effect/Schema";
+import { ComputerPortPreview } from "@fungi.computer/computer/preview";
+export declare const previewSelectorSchema: Schema.Struct<{
+    readonly ownerId: Schema.NonEmptyString;
+    readonly installationId: Schema.NonEmptyString;
+    readonly selection: Schema.Struct<{
+        readonly instanceId: Schema.Codec<import("../index.js").InstanceId, string, never, never>;
+        readonly owner: Schema.Struct<{
+            readonly kind: Schema.Literals<readonly ["installation", "deployment"]>;
+            readonly id: Schema.NonEmptyString;
+        }>;
+        readonly appId: Schema.refine<import("@fungi.computer/puffball").AppId, Schema.String>;
+        readonly releaseId: Schema.refine<import("@fungi.computer/puffball").ReleaseId, Schema.String>;
+        readonly authorityVersion: Schema.Number;
+    }>;
+    readonly artifactDigest: Schema.refine<import("@fungi.computer/puffball").Sha256Digest, Schema.String>;
+}>;
+export type PreviewSelector = Schema.Schema.Type<typeof previewSelectorSchema>;
+export type PreviewOrigins = Readonly<{
+    owner: string;
+    preview: string;
+}>;
+export type StandalonePreviewEnv = Readonly<{
+    OYSTER_ORIGIN?: string;
+    OYSTER_PREVIEW_ORIGIN?: string;
+}>;
+export declare function previewOrigins(env: StandalonePreviewEnv): PreviewOrigins | null;
+/**
+ * The native Computer's preview port. `current` re-proves the selector's
+ * owner and Installation against live authority before every issue and
+ * every forwarded request.
+ */
+export type PreviewNative = Readonly<{
+    current: (selector: PreviewSelector) => Promise<void>;
+    accept: (selector: PreviewSelector) => void;
+    list: (accept: () => void) => Promise<{
+        ports: number[];
+    }>;
+    forward: (port: number, request: Request, accept: () => void) => Promise<Response>;
+}>;
+export declare class PreviewRefused extends Error {
+}
+export declare function createStandalonePreview(storage: ConstructorParameters<typeof ComputerPortPreview>[0], computerId: string, origin: string, native: PreviewNative): {
+    issue(selector: PreviewSelector, port: number): Promise<{
+        previewUrl: string;
+        expiresAt: number;
+    }>;
+    fetch(signature: string, port: number, request: Request): Promise<Response>;
+};
+export declare function passivePreviewResponse(response: Response): Promise<Response>;
+export declare function standalonePreviewRequest(request: Request, env: StandalonePreviewEnv, computerId: string, forward: (signature: string, port: number, request: Request) => Promise<Response>): Promise<Response | null>;