@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/dist/standalone/preview.js

@@ -0,0 +1,167 @@
+import * as Schema from "effect/Schema";
+import * as z from "zod";
+import { ComputerPortPreview } from "@fungi.computer/computer/preview";
+import { selectionSchema } from "../index.js";
+import { sha256DigestSchema } from "@fungi.computer/puffball/effect";
+import { computerPortInputSchema } from "@fungi.computer/computer/operations";
+export const previewSelectorSchema = Schema.Struct({
+    ownerId: Schema.NonEmptyString,
+    installationId: Schema.NonEmptyString,
+    selection: selectionSchema,
+    artifactDigest: sha256DigestSchema,
+});
+const originSchema = z
+    .url()
+    .transform((input) => new URL(input))
+    .refine((url) => url.protocol === "https:" &&
+    !url.username &&
+    !url.password &&
+    url.pathname === "/" &&
+    !url.search &&
+    !url.hash);
+export function previewOrigins(env) {
+    if (env.OYSTER_PREVIEW_ORIGIN === undefined)
+        return null;
+    const parsed = z
+        .object({ owner: originSchema, preview: originSchema })
+        .safeParse({
+        owner: env.OYSTER_ORIGIN,
+        preview: env.OYSTER_PREVIEW_ORIGIN,
+    });
+    if (!parsed.success)
+        return null;
+    const { owner, preview } = parsed.data;
+    // The preview tunnel must be a distinct origin from the canonical owner
+    // origin: it carries no cookies and no owner credential, so it cannot be
+    // the same origin the owner signs in on. Which two origins those are is a
+    // deploy-time choice (this Worker's own custom domain plus its workers.dev
+    // address, or any other pair the operator actually controls) — never a
+    // literal this module hard-codes.
+    if (owner.origin === preview.origin)
+        return null;
+    return { owner: owner.origin, preview: preview.origin };
+}
+/**
+ * The configured preview tunnel origin alone, independent of whether the
+ * owner origin also validates. Once an operator points OYSTER_PREVIEW_ORIGIN
+ * at a host, that host is always treated as preview-only and never falls
+ * through to the normal router — even if the rest of the config (the owner
+ * origin) is separately broken. Only a host nothing configured as preview
+ * is left to the caller's own routing.
+ */
+function configuredPreviewOrigin(env) {
+    const parsed = originSchema.safeParse(env.OYSTER_PREVIEW_ORIGIN);
+    return parsed.success ? parsed.data.origin : null;
+}
+export class PreviewRefused extends Error {
+}
+export function createStandalonePreview(storage, computerId, origin, native) {
+    const tickets = new ComputerPortPreview(storage, {
+        selector: previewSelectorSchema,
+        previewUrl: (signature, base) => `${base}/${signature}/`,
+        accept: native.accept,
+        listPorts: native.list,
+        forward: native.forward,
+        portDenied: () => {
+            throw new PreviewRefused();
+        },
+        dispatchFailure: (cause) => {
+            if (cause instanceof PreviewRefused)
+                return new Response(null, { status: 403 });
+            console.error("Standalone preview native dispatch failed", cause);
+            return new Response(null, { status: 502 });
+        },
+        invalidClaims: () => {
+            console.error("Standalone preview ticket claims refused");
+        },
+    });
+    return {
+        async issue(selector, port) {
+            await native.current(selector);
+            return tickets.issueAfterAcceptance(selector, port, `${origin}/preview/${encodeURIComponent(computerId)}/${String(port)}`);
+        },
+        async fetch(signature, port, request) {
+            return tickets.dispatchSigned(signature, request, async (selector, selectedPort, incoming) => {
+                if (selectedPort !== port)
+                    return new Response(null, { status: 403 });
+                try {
+                    await native.current(selector);
+                    return await passivePreviewResponse(await tickets.dispatch(selector, port, incoming));
+                }
+                catch (cause) {
+                    if (cause instanceof PreviewRefused)
+                        return new Response(null, { status: 403 });
+                    console.error("Standalone preview current authority check failed", cause);
+                    return new Response(null, { status: 503 });
+                }
+            });
+        },
+    };
+}
+export async function passivePreviewResponse(response) {
+    if (response.status < 200 ||
+        response.status >= 300 ||
+        response.headers.has("Refresh")) {
+        await response.body?.cancel();
+        return new Response(null, {
+            status: response.headers.has("Refresh") ||
+                (response.status >= 300 && response.status < 400)
+                ? 502
+                : response.status,
+        });
+    }
+    const contentType = response.headers
+        .get("Content-Type")
+        ?.split(";")[0]
+        ?.trim()
+        .toLowerCase();
+    if (contentType !== "text/html" && contentType !== "text/plain") {
+        await response.body?.cancel();
+        return new Response(null, { status: 415 });
+    }
+    const headers = new Headers({
+        "Content-Type": `${contentType}; charset=utf-8`,
+        "Content-Security-Policy": "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+        "Cache-Control": "no-store",
+        "X-Robots-Tag": "noindex, nofollow",
+        "Referrer-Policy": "no-referrer",
+        "X-Content-Type-Options": "nosniff",
+    });
+    return new Response(response.body, { status: response.status, headers });
+}
+export async function standalonePreviewRequest(request, env, computerId, forward) {
+    const incoming = new URL(request.url);
+    const previewHost = configuredPreviewOrigin(env);
+    // A host nothing configured as the preview tunnel is left to the caller's
+    // own routing, like any other Host this module doesn't recognize.
+    if (previewHost === null || incoming.origin !== previewHost)
+        return null;
+    // Past this point the Host is the configured preview tunnel: it never
+    // falls through to the normal router, even if the rest of the pair (the
+    // owner origin) turns out to be broken — the checks below just decide
+    // 403/404/503 vs. forwarding.
+    if (!["GET", "HEAD"].includes(request.method) ||
+        request.headers.has("Upgrade"))
+        return new Response(null, { status: 404 });
+    const path = /^\/preview\/([^/]+)\/([0-9]{1,5})\/([a-z2-7]{20})(\/.*)$/u.exec(incoming.pathname);
+    if (path?.[1] !== encodeURIComponent(computerId) ||
+        path[3] === undefined ||
+        path[4] === undefined)
+        return new Response(null, { status: 404 });
+    if (previewOrigins(env) === null)
+        return new Response(null, { status: 404 });
+    const input = computerPortInputSchema.safeParse({ port: Number(path[2]) });
+    if (!input.success || String(input.data.port) !== path[2])
+        return new Response(null, { status: 404 });
+    const service = new URL("http://localhost");
+    service.pathname = path[4];
+    service.search = incoming.search;
+    const headers = new Headers(request.headers);
+    for (const name of ["cookie", "authorization", "proxy-authorization", "host"])
+        headers.delete(name);
+    return forward(path[3], input.data.port, new Request(service, {
+        method: request.method,
+        headers,
+        signal: request.signal,
+    }));
+}

package/dist/standalone/registry.d.ts

@@ -0,0 +1,102 @@
+import { OysterRegistry, type OysterWorkerEnv } from "../workers.js";
+import type { TenantId } from "../tenant.js";
+import { type OysterGitEnv } from "../workers-git.js";
+import { type AppSourceForkResult, type TemplateSeedClaim } from "../source/index.js";
+import { type CloudflareArtifactsOptions } from "@fungi.computer/burrow/cloudflare";
+import { type OysterBuildSource, type OysterBuildView } from "../app-builds.js";
+import type { TeamAppCandidateManifest } from "../build-contract.js";
+import type { BuildGitEvent } from "../build-egress.js";
+import { type StandaloneTenancyEnv } from "./tenancy.js";
+import type { ComputerDO } from "./computer.js";
+/** What the registry needs to build Apps on the standalone's one Computer. */
+export type StandaloneRegistryEnv = OysterWorkerEnv & StandaloneTenancyEnv & OysterGitEnv & Readonly<{
+    OYSTER_COMPUTER_ID: string;
+    COMPUTER: DurableObjectNamespace<ComputerDO>;
+}>;
+/** One repository a build clone may read, at one installation. */
+export type BuildTarget = Readonly<{
+    installationId: string;
+    repository: string;
+    scope: "read" | "write";
+}>;
+/** The Git transports of the maintained Artifacts owner, which the host's
+ * composition may supply; absent, Git goes to the provider's own remotes. */
+export type StandaloneRegistryGit = Pick<CloudflareArtifactsOptions, "gitFetch" | "gitHttp">;
+/** The existing REGISTRY class identity with standalone host-owned admission. */
+export declare class StandaloneRegistry extends OysterRegistry {
+    #private;
+    constructor(state: DurableObjectState, env: StandaloneRegistryEnv, git?: StandaloneRegistryGit);
+    /** One atomic registry admission proves the stored creator is still the owner. */
+    protected currentOwner(memberId: string, tenantId: TenantId): Promise<string | null>;
+    /** Operator-only: one smart-HTTP exchange with an App's template
+     * repository, the `git push` that seeds it. */
+    exchangeTemplateSource(rawAppId: string, suffix: string, request: Request): Promise<Response>;
+    /** Operator-only: record the seed the operator just pushed to this
+     * Oyster's editable App source template, register the platform App itself
+     * as this tenant's own publisher so a later `forkApp` can authorize
+     * against it (`fork.ts` reads this record), and make that template the
+     * App's build source with the recipe its seed receipt pins, so the
+     * published seed revision builds on the Computer. */
+    publishSource(rawAppId: string, claim: TemplateSeedClaim, teamId: string): Promise<{
+        readonly kind: "conflict";
+        readonly receipt?: undefined;
+    } | {
+        readonly kind: "recorded" | "existing";
+        readonly receipt: {
+            readonly appId: import("@fungi.computer/puffball").AppId;
+            readonly repository: string;
+            readonly sourceRevision: import("@fungi.computer/puffball").SourceRevision;
+            readonly sourceTreeDigest: import("@fungi.computer/puffball").Sha256Digest;
+            readonly seedRevision: import("@fungi.computer/puffball").SourceRevision;
+            readonly buildRecipeDigest: import("@fungi.computer/puffball").Sha256Digest;
+        };
+    } | {
+        readonly kind: "unavailable";
+        readonly receipt?: undefined;
+    }>;
+    /** Fork a published platform App's source into its own Team-owned App,
+     * as repository `name` of the calling installation's Git (so its owner
+     * edits and merges it there), and register that repository as the new
+     * App's build source with the template's pinned recipe, so a merged
+     * commit builds without further setup. */
+    forkApp(input: Readonly<{
+        teamId: string;
+        platformAppId: string;
+        /** The installation whose Git holds the fork, e.g. Bonsai. */
+        installationId: string;
+        /** That installation's provider repository prefix (`TenantScope`). */
+        repositoryPrefix: string;
+        name: string;
+    }>): Promise<AppSourceForkResult>;
+    /** Owner: record an App's build source (one repository, pinned recipe). */
+    registerBuildSource(source: OysterBuildSource): Promise<void>;
+    /** Owner: start one build of an App's source at one commit; it runs on. */
+    startBuild(input: {
+        appId: string;
+        sourceRevision: string;
+        requestedBy: string;
+    }): Promise<OysterBuildView>;
+    readBuild(jobId: string): Promise<OysterBuildView | null>;
+    /** The Computer re-admits each build execution here. */
+    admitBuildExecution(jobId: string, computerObjectId: string): Promise<boolean>;
+    /** The egress: which live job a build report from this Computer speaks for. */
+    admitBuildReport(jobId: string, computerObjectId: string): Promise<Readonly<{
+        credentialId: string;
+    }> | null>;
+    /** The egress: the clone pass for this Computer's live job on one repository. */
+    buildGitPassFor(computerObjectId: string, target: BuildTarget): Promise<string | null>;
+    /** The Git door: admit a presented build clone pass. */
+    admitBuildGitPass(pass: string, target: BuildTarget): Promise<Readonly<{
+        requestedBy: string;
+    }> | null>;
+    /** The egress: one read-only Git exchange with a template repository, for
+     * this Computer's live template build job only. */
+    exchangeBuildTemplate(computerObjectId: string, repository: string, request: Request): Promise<Response>;
+    recordBuildEvent(event: BuildGitEvent): Promise<void>;
+    /** The egress: may this Computer's live job upload one object, how large? */
+    admitBuildObject(jobId: string, computerObjectId: string, grant: string): Promise<Readonly<{
+        maxObjectBytes: number;
+    }> | null>;
+    /** The egress: a live job's candidate manifest; its objects are stored. */
+    submitBuildCandidate(jobId: string, manifest: TeamAppCandidateManifest, grant: string, credentialId: string): Promise<Response>;
+}

package/dist/standalone/registry.js

@@ -0,0 +1,193 @@
+import { OysterRegistry, r2ArtifactStore, } from "../workers.js";
+import { artifactsOf } from "../workers-git.js";
+import { forkAppSource, recordTemplateSeed, templateRepositoryForApp, } from "../source/index.js";
+import { exchangeOysterTemplateGit, exchangeOysterTemplateSource, } from "../app-sources.js";
+import { createCloudflareArtifacts, } from "@fungi.computer/burrow/cloudflare";
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import * as Schema from "effect/Schema";
+import { parseAppId } from "@fungi.computer/puffball";
+import { appIdSchema } from "@fungi.computer/puffball/effect";
+import { createOysterAppBuilds, } from "../app-builds.js";
+import { standaloneTenancy } from "./tenancy.js";
+const standaloneAppForkIds = defineIdFamily({
+    family: "oyster-app-fork",
+    version: 1,
+    kinds: { app: { prefix: "app" } },
+});
+/** The existing REGISTRY class identity with standalone host-owned admission. */
+export class StandaloneRegistry extends OysterRegistry {
+    #env;
+    #git;
+    #builds;
+    constructor(state, env, git = {}) {
+        super(state, env);
+        this.#env = env;
+        this.#git = git;
+    }
+    /** One atomic registry admission proves the stored creator is still the owner. */
+    async currentOwner(memberId, tenantId) {
+        const shared = await standaloneTenancy(this.#env);
+        if (tenantId !== shared.tenantId)
+            return null;
+        return (await shared.owner())?.actor.memberId === memberId
+            ? memberId
+            : null;
+    }
+    #artifacts() {
+        return createCloudflareArtifacts({
+            ...this.#git,
+            namespace: artifactsOf(this.#env),
+            repositories: this.artifactsRepositories,
+        });
+    }
+    /** Operator-only: one smart-HTTP exchange with an App's template
+     * repository, the `git push` that seeds it. */
+    async exchangeTemplateSource(rawAppId, suffix, request) {
+        return exchangeOysterTemplateSource(this.#artifacts(), rawAppId, suffix, request);
+    }
+    /** Operator-only: record the seed the operator just pushed to this
+     * Oyster's editable App source template, register the platform App itself
+     * as this tenant's own publisher so a later `forkApp` can authorize
+     * against it (`fork.ts` reads this record), and make that template the
+     * App's build source with the recipe its seed receipt pins, so the
+     * published seed revision builds on the Computer. */
+    async publishSource(rawAppId, claim, teamId) {
+        const result = await recordTemplateSeed(this.appSourceReceipts, this.#artifacts(), rawAppId, claim);
+        if (result.kind === "recorded" || result.kind === "existing") {
+            const appId = parseAppId(rawAppId);
+            const registered = await this.appRegistrations.register({
+                appId,
+                teamId,
+                source: {
+                    provider: "artifacts",
+                    repository: templateRepositoryForApp(appId),
+                    branch: "main",
+                },
+            });
+            if (registered.kind === "conflict")
+                return { kind: "conflict" };
+            const receipt = await this.appSourceReceipts.read(appId, result.receipt.seedRevision);
+            if (receipt === null)
+                return { kind: "conflict" };
+            (await this.#appBuilds()).registerSource({
+                appId,
+                location: { kind: "template" },
+                recipe: receipt.recipe,
+                buildRecipeDigest: receipt.buildRecipeDigest,
+            });
+        }
+        return result;
+    }
+    /** Fork a published platform App's source into its own Team-owned App,
+     * as repository `name` of the calling installation's Git (so its owner
+     * edits and merges it there), and register that repository as the new
+     * App's build source with the template's pinned recipe, so a merged
+     * commit builds without further setup. */
+    async forkApp(input) {
+        const appId = Schema.decodeUnknownSync(appIdSchema)(standaloneAppForkIds.app.generate());
+        const platformAppId = parseAppId(input.platformAppId);
+        const forked = await forkAppSource({
+            teamId: input.teamId,
+            platformAppId,
+            appId,
+            repository: `${input.repositoryPrefix}${input.name}`,
+        }, {
+            registry: this.appRegistrations,
+            artifacts: this.#artifacts(),
+            receipts: this.appSourceReceipts,
+        });
+        if (forked.kind !== "forked")
+            return forked;
+        const registration = await this.appRegistrations.read(appId);
+        const seed = registration.kind === "found"
+            ? registration.registration.templateSeed
+            : undefined;
+        const receipt = seed === undefined
+            ? null
+            : await this.appSourceReceipts.read(seed.appId, seed.revision);
+        if (receipt === null)
+            return { kind: "conflict" };
+        (await this.#appBuilds()).registerSource({
+            appId,
+            location: {
+                kind: "installation",
+                installationId: input.installationId,
+                repository: input.name,
+            },
+            recipe: receipt.recipe,
+            buildRecipeDigest: receipt.buildRecipeDigest,
+        });
+        return { kind: "forked", appId, repository: input.name };
+    }
+    /** The tenant's App build owner on its one fixed Computer. */
+    #appBuilds() {
+        this.#builds ??= standaloneTenancy(this.#env).then((shared) => {
+            const env = this.#env;
+            const name = env.OYSTER_COMPUTER_ID;
+            return createOysterAppBuilds({
+                owner: {
+                    sql: this.ctx.storage.sql,
+                    transactionSync: (operation) => this.ctx.storage.transactionSync(operation),
+                },
+                tenantId: shared.tenantId,
+                computer: {
+                    name,
+                    objectId: env.COMPUTER.idFromName(name).toString(),
+                    port: {
+                        runBuild: (input) => env.COMPUTER.getByName(name).runBuild(input),
+                    },
+                },
+                artifacts: r2ArtifactStore(env.RELEASES),
+                templates: this.appSourceReceipts,
+            });
+        });
+        return this.#builds;
+    }
+    /** Owner: record an App's build source (one repository, pinned recipe). */
+    async registerBuildSource(source) {
+        (await this.#appBuilds()).registerSource(source);
+    }
+    /** Owner: start one build of an App's source at one commit; it runs on. */
+    async startBuild(input) {
+        const { build, run } = await (await this.#appBuilds()).start(input);
+        this.ctx.waitUntil(run());
+        return build;
+    }
+    async readBuild(jobId) {
+        return (await this.#appBuilds()).read(jobId);
+    }
+    /** The Computer re-admits each build execution here. */
+    async admitBuildExecution(jobId, computerObjectId) {
+        return (await this.#appBuilds()).admitExecution(jobId, computerObjectId);
+    }
+    /** The egress: which live job a build report from this Computer speaks for. */
+    async admitBuildReport(jobId, computerObjectId) {
+        return (await this.#appBuilds()).admitBuild(jobId, computerObjectId);
+    }
+    /** The egress: the clone pass for this Computer's live job on one repository. */
+    async buildGitPassFor(computerObjectId, target) {
+        return (await this.#appBuilds()).gitPassFor(computerObjectId, target);
+    }
+    /** The Git door: admit a presented build clone pass. */
+    async admitBuildGitPass(pass, target) {
+        return (await this.#appBuilds()).admitGitPass(pass, target);
+    }
+    /** The egress: one read-only Git exchange with a template repository, for
+     * this Computer's live template build job only. */
+    async exchangeBuildTemplate(computerObjectId, repository, request) {
+        if (!(await this.#appBuilds()).admitTemplateClone(computerObjectId, repository))
+            return new Response(null, { status: 403 });
+        return exchangeOysterTemplateGit(this.#artifacts(), `https://git.team.internal/${repository}.git`, repository, request, "read");
+    }
+    async recordBuildEvent(event) {
+        (await this.#appBuilds()).record(event);
+    }
+    /** The egress: may this Computer's live job upload one object, how large? */
+    async admitBuildObject(jobId, computerObjectId, grant) {
+        return (await this.#appBuilds()).admitObjectUpload(jobId, computerObjectId, grant);
+    }
+    /** The egress: a live job's candidate manifest; its objects are stored. */
+    async submitBuildCandidate(jobId, manifest, grant, credentialId) {
+        return (await this.#appBuilds()).submitCandidate(jobId, manifest, grant, credentialId);
+    }
+}

package/dist/standalone/tenancy.d.ts

@@ -0,0 +1,42 @@
+import { TenancyRegistryDO } from "../tenancy/cloudflare.js";
+import { type Identity, type Tenant, type ReadonlyTenancy } from "../tenancy/index.js";
+import type { OysterGitWorkerEnv } from "../workers-git.js";
+import { type OysterTenancy, type TenantId } from "../tenant.js";
+/** Trusted standalone provisioning inputs; credentials never enter the seed. */
+export type StandaloneSeed = Readonly<{
+    origin: string;
+    owner: Identity;
+}>;
+/** A fresh registry namespace with one host-provisioned standalone tenant. */
+export declare class StandaloneTenants extends TenancyRegistryDO {
+    #private;
+    constructor(state: DurableObjectState);
+    /** Reuse only the exact configured tenant and its current canonical owner. */
+    seed(input: StandaloneSeed): Promise<Tenant>;
+}
+/** The same trusted bindings are used by HTTP, MCP and cold root readers. */
+export type StandaloneTenancyEnv = Pick<OysterGitWorkerEnv, "OYSTER_ORIGIN" | "OYSTER_OWNER_NAME" | "OYSTER_OWNER_KEY" | "KEYS"> & Readonly<{
+    TENANTS: DurableObjectNamespace<StandaloneTenants>;
+}>;
+/** A live registry-owned owner; the configured label is never its member ID. */
+export type StandaloneOwner = Readonly<{
+    actor: Readonly<{
+        kind: "member";
+        memberId: string;
+    }>;
+    role: "owner";
+    membershipVersion: number;
+}>;
+/**
+ * Read-only kit authority and the canonical Oyster bridge share one seed.
+ * Every entry admits with exactly one TENANTS read: an HTTP request through
+ * `oyster.resolve`, and each `owner()` or `tenancy` call at its own top.
+ */
+export type StandaloneTenancy = Readonly<{
+    tenantId: TenantId;
+    tenancy: ReadonlyTenancy<"origin">;
+    oyster: OysterTenancy;
+    owner(): Promise<StandaloneOwner | null>;
+}>;
+/** Seed once per environment, then admit every entry from one fresh registry read. */
+export declare function standaloneTenancy(env: StandaloneTenancyEnv): Promise<StandaloneTenancy>;