@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/dist/app-sources.js

@@ -0,0 +1,370 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { appIdSchema, sha256DigestSchema, sourceRevisionSchema, } from "@fungi.computer/puffball/effect";
+import { teamAppPublisherRegistrationSchema, } from "@fungi.computer/puffball/publisher";
+import { capturedPinnedRecipeSchema, digestPinnedRecipe, } from "./build-contract.js";
+import { sameReceipt, seedReceiptInputSchema, templateRepositoryForApp, } from "./source/index.js";
+import { smartHttpExchange } from "./git-door.js";
+import { parseAppId } from "@fungi.computer/puffball";
+/**
+ * Oyster's own storage for App source templates, Team-owned fork
+ * registrations and the recorded Artifacts repository metadata their fork
+ * provenance depends on. Each factory is a pure adapter over a generic
+ * synchronous SQLite port, so it is unit-testable with a Node `DatabaseSync`
+ * and identically correct over a Durable Object's `ctx.storage.sql`.
+ */
+export function ensureAppSourceTables(sql) {
+    sql.exec(`CREATE TABLE IF NOT EXISTS oyster_app_sources (
+      app_id TEXT NOT NULL,
+      seed_revision TEXT NOT NULL,
+      source_revision TEXT NOT NULL,
+      source_tree_digest TEXT NOT NULL,
+      recipe_json TEXT NOT NULL,
+      build_recipe_digest TEXT NOT NULL,
+      PRIMARY KEY (app_id, seed_revision)
+    ) STRICT`);
+    sql.exec(`CREATE TABLE IF NOT EXISTS oyster_app_registrations (
+      app_id TEXT PRIMARY KEY,
+      record TEXT NOT NULL
+    ) STRICT`);
+    sql.exec(`CREATE TABLE IF NOT EXISTS oyster_artifacts_repositories (
+      repository_name TEXT PRIMARY KEY,
+      provider_id TEXT NOT NULL,
+      default_branch TEXT NOT NULL,
+      remote TEXT NOT NULL,
+      parent_repository TEXT
+    ) STRICT`);
+    sql.exec(`CREATE TABLE IF NOT EXISTS oyster_artifacts_repositories_pending (
+      repository_name TEXT PRIMARY KEY,
+      provider_id TEXT NOT NULL,
+      default_branch TEXT NOT NULL,
+      remote TEXT NOT NULL,
+      parent_repository TEXT,
+      initial_token TEXT NOT NULL
+    ) STRICT`);
+}
+const seedReceiptRowSchema = Schema.Struct({
+    app_id: appIdSchema,
+    seed_revision: sourceRevisionSchema,
+    source_revision: sourceRevisionSchema,
+    source_tree_digest: sha256DigestSchema,
+    recipe_json: Schema.String,
+    build_recipe_digest: sha256DigestSchema,
+});
+function receiptFromRow(row) {
+    return {
+        appId: row.app_id,
+        repository: templateRepositoryForApp(row.app_id),
+        sourceRevision: row.source_revision,
+        sourceTreeDigest: row.source_tree_digest,
+        seedRevision: row.seed_revision,
+        recipe: Schema.decodeUnknownSync(Schema.fromJsonString(capturedPinnedRecipeSchema), { onExcessProperty: "error" })(row.recipe_json),
+        buildRecipeDigest: row.build_recipe_digest,
+    };
+}
+/** Append-only App source seed receipts, owned by one Oyster's registry. */
+export function createOysterAppSourceReceipts(sql) {
+    const read = (appId, seedRevision) => {
+        const row = sql
+            .exec(`SELECT app_id, seed_revision, source_revision, source_tree_digest,
+                recipe_json, build_recipe_digest
+         FROM oyster_app_sources WHERE app_id = ? AND seed_revision = ?`, appId, seedRevision)
+            .toArray()[0];
+        if (row === undefined)
+            return Promise.resolve(null);
+        const receipt = receiptFromRow(Schema.decodeUnknownSync(seedReceiptRowSchema, {
+            onExcessProperty: "error",
+        })(row));
+        if (digestPinnedRecipe(receipt.recipe) !== receipt.buildRecipeDigest)
+            throw new Error("Oyster App source seed receipt recipe conflicts");
+        return Promise.resolve(receipt);
+    };
+    const record = async (untrusted) => {
+        const input = Schema.decodeUnknownSync(seedReceiptInputSchema, {
+            onExcessProperty: "error",
+        })(untrusted);
+        const receipt = {
+            ...input,
+            repository: templateRepositoryForApp(input.appId),
+        };
+        if (digestPinnedRecipe(receipt.recipe) !== receipt.buildRecipeDigest)
+            throw new Error("Oyster App source seed recipe digest conflicts");
+        sql.exec(`INSERT OR IGNORE INTO oyster_app_sources (
+        app_id, seed_revision, source_revision, source_tree_digest,
+        recipe_json, build_recipe_digest
+      ) VALUES (?, ?, ?, ?, ?, ?)`, receipt.appId, receipt.seedRevision, receipt.sourceRevision, receipt.sourceTreeDigest, JSON.stringify(receipt.recipe), receipt.buildRecipeDigest);
+        const stored = await read(receipt.appId, receipt.seedRevision);
+        if (stored === null || !sameReceipt(stored, receipt))
+            throw new Error("Oyster App source seed receipt conflicts");
+        return stored;
+    };
+    return Object.freeze({ read, record });
+}
+const registrationRowSchema = Schema.Struct({
+    app_id: Schema.String,
+    record: Schema.String,
+});
+/** Team-owned App publisher registrations (fork destinations), one per App. */
+export function createOysterAppRegistrations(sql) {
+    const read = (appId) => {
+        const row = sql
+            .exec("SELECT app_id, record FROM oyster_app_registrations WHERE app_id = ?", appId)
+            .toArray()[0];
+        if (row === undefined)
+            return Promise.resolve({ kind: "absent" });
+        const parsed = Schema.decodeUnknownSync(registrationRowSchema, {
+            onExcessProperty: "error",
+        })(row);
+        return Promise.resolve({
+            kind: "found",
+            registration: Schema.decodeUnknownSync(teamAppPublisherRegistrationSchema, { onExcessProperty: "error" })(JSON.parse(parsed.record)),
+        });
+    };
+    return {
+        read,
+        register: async (registration) => {
+            const record = JSON.stringify(registration);
+            const inserted = sql
+                .exec(`INSERT INTO oyster_app_registrations (app_id, record) VALUES (?, ?)
+           ON CONFLICT (app_id) DO NOTHING
+           RETURNING app_id`, registration.appId, record)
+                .toArray();
+            const current = await read(registration.appId);
+            if (current.kind === "absent")
+                throw new Error("Oyster App registration was not retained");
+            const matches = JSON.stringify(current.registration) === record;
+            if (!matches)
+                return { kind: "conflict" };
+            return {
+                kind: inserted.length > 0 ? "created" : "existing",
+                registration: current.registration,
+            };
+        },
+        authorize: async (appId, teamId) => {
+            const current = await read(appId);
+            if (current.kind === "absent")
+                return current;
+            return current.registration.teamId === teamId
+                ? { kind: "authorized", registration: current.registration }
+                : { kind: "denied" };
+        },
+    };
+}
+const repositoryMetadataSchema = Schema.Struct({
+    id: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+    name: Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(128))),
+    defaultBranch: Schema.Literal("main"),
+    remote: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+    parentRepository: Schema.NullOr(Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(128)))),
+});
+const repositoryRowSchema = Schema.Struct({
+    repository_name: Schema.String,
+    provider_id: Schema.String,
+    default_branch: Schema.String,
+    remote: Schema.String,
+    parent_repository: Schema.NullOr(Schema.String),
+});
+const pendingRepositoryRowSchema = Schema.Struct({
+    repository_name: Schema.String,
+    provider_id: Schema.String,
+    default_branch: Schema.String,
+    remote: Schema.String,
+    parent_repository: Schema.NullOr(Schema.String),
+    initial_token: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+});
+function metadataFromRow(row) {
+    return Schema.decodeUnknownSync(repositoryMetadataSchema, {
+        onExcessProperty: "error",
+    })({
+        id: row.provider_id,
+        name: row.repository_name,
+        defaultBranch: row.default_branch,
+        remote: row.remote,
+        parentRepository: row.parent_repository,
+    });
+}
+function sameMetadata(left, right) {
+    return (left.id === right.id &&
+        left.name === right.name &&
+        left.defaultBranch === right.defaultBranch &&
+        left.remote === right.remote &&
+        left.parentRepository === right.parentRepository);
+}
+/** Durable repository provenance for Oyster's own `createCloudflareArtifacts`. */
+export function createOysterArtifactsRepositoryMetadataStore(sql) {
+    const readPending = (name) => {
+        const row = sql
+            .exec(`SELECT repository_name, provider_id, default_branch, remote,
+                parent_repository, initial_token
+         FROM oyster_artifacts_repositories_pending WHERE repository_name = ?`, name)
+            .toArray()[0];
+        if (row === undefined)
+            return Promise.resolve(null);
+        const decoded = Schema.decodeUnknownSync(pendingRepositoryRowSchema, {
+            onExcessProperty: "error",
+        })(row);
+        return Promise.resolve(Object.freeze({
+            metadata: metadataFromRow(decoded),
+            initialToken: decoded.initial_token,
+        }));
+    };
+    /** The active row alone; activation checks its own promotion with this. */
+    const readActive = (name) => {
+        const row = sql
+            .exec(`SELECT repository_name, provider_id, default_branch, remote,
+                parent_repository
+         FROM oyster_artifacts_repositories WHERE repository_name = ?`, name)
+            .toArray()[0];
+        return Promise.resolve(row === undefined
+            ? null
+            : metadataFromRow(Schema.decodeUnknownSync(repositoryRowSchema, {
+                onExcessProperty: "error",
+            })(row)));
+    };
+    /** Public reads hide a repository while its initial token is pending. */
+    const read = async (name) => (await readPending(name)) === null ? readActive(name) : null;
+    return Object.freeze({
+        read,
+        readPending,
+        recordPending: async (untrusted, initialToken) => {
+            const metadata = Schema.decodeUnknownSync(repositoryMetadataSchema, {
+                onExcessProperty: "error",
+            })(untrusted);
+            sql.exec(`INSERT OR IGNORE INTO oyster_artifacts_repositories_pending (
+          repository_name, provider_id, default_branch, remote,
+          parent_repository, initial_token
+        ) VALUES (?, ?, ?, ?, ?, ?)`, metadata.name, metadata.id, metadata.defaultBranch, metadata.remote, metadata.parentRepository, initialToken);
+            const pending = await readPending(metadata.name);
+            if (pending !== null) {
+                if (!sameMetadata(pending.metadata, metadata) ||
+                    pending.initialToken !== initialToken)
+                    throw new Error("Oyster Artifacts recovery state conflicts");
+                return;
+            }
+            const stored = await read(metadata.name);
+            if (stored === null || !sameMetadata(stored, metadata))
+                throw new Error("Oyster Artifacts recovery state was not saved");
+        },
+        activate: async (untrusted, initialToken) => {
+            const metadata = Schema.decodeUnknownSync(repositoryMetadataSchema, {
+                onExcessProperty: "error",
+            })(untrusted);
+            sql.exec(`INSERT OR IGNORE INTO oyster_artifacts_repositories (
+          repository_name, provider_id, default_branch, remote, parent_repository
+        ) SELECT repository_name, provider_id, default_branch, remote, parent_repository
+          FROM oyster_artifacts_repositories_pending
+          WHERE repository_name = ? AND provider_id = ? AND default_branch = ?
+            AND remote = ? AND parent_repository IS ? AND initial_token = ?`, metadata.name, metadata.id, metadata.defaultBranch, metadata.remote, metadata.parentRepository, initialToken);
+            const active = await readActive(metadata.name);
+            if (active === null || !sameMetadata(active, metadata))
+                throw new Error("Oyster Artifacts metadata conflicts");
+            sql.exec(`DELETE FROM oyster_artifacts_repositories_pending
+         WHERE repository_name = ? AND provider_id = ? AND default_branch = ?
+           AND remote = ? AND parent_repository IS ? AND initial_token = ?`, metadata.name, metadata.id, metadata.defaultBranch, metadata.remote, metadata.parentRepository, initialToken);
+        },
+    });
+}
+/** Translate one local Git smart-HTTP request into an admitted Artifacts
+ * exchange; the identical shape Hub's Publisher keeps for its own template
+ * writes (`services/app-publisher/src/source-git.ts`), scoped to Oyster's own
+ * Artifacts composition since a package cannot depend on that service. */
+export async function exchangeOysterTemplateGit(artifacts, remote, repository, request, permission = "write") {
+    const url = new URL(request.url);
+    const registered = new URL(remote);
+    const internal = url.origin === "https://git.team.internal";
+    const base = internal ? `/${repository}.git` : registered.pathname;
+    if (url.username ||
+        url.password ||
+        url.hash ||
+        (!internal && url.origin !== registered.origin))
+        return new Response(null, { status: 403 });
+    const protocol = request.headers.get("Git-Protocol");
+    const signal = AbortSignal.any([
+        request.signal,
+        AbortSignal.timeout(120_000),
+    ]);
+    const common = { repository, signal };
+    let input;
+    if (request.method === "GET" && url.pathname === `${base}/info/refs`) {
+        if (url.search === "?service=git-upload-pack")
+            input = { ...common, operation: "upload-pack-advertisement" };
+        else if (url.search === "?service=git-receive-pack")
+            input = { ...common, operation: "receive-pack-advertisement" };
+        else
+            return new Response(null, { status: 403 });
+    }
+    else if (request.method === "POST" && url.search === "") {
+        const raw = request.body;
+        if (raw === null)
+            return new Response(null, { status: 403 });
+        // A real identity passthrough, not a type assertion: the ambient
+        // `Request.body` resolves to `ReadableStream<any>` in this workspace's
+        // merged lib types, so this pipes it through a stream genuinely typed
+        // `ReadableStream<Uint8Array>` for `GitExchange`'s own `body` field.
+        const body = raw.pipeThrough(new TransformStream());
+        if (url.pathname === `${base}/git-upload-pack`)
+            input = { ...common, operation: "upload-pack", body };
+        else if (url.pathname === `${base}/git-receive-pack`)
+            input = { ...common, operation: "receive-pack", body };
+        else
+            return new Response(null, { status: 403 });
+    }
+    else
+        return new Response(null, { status: 403 });
+    if (protocol !== null)
+        input = { ...input, protocol };
+    if (permission === "read" && input.operation.startsWith("receive-pack"))
+        return new Response(null, { status: 403 });
+    const response = await Effect.runPromise(Effect.tryPromise(() => artifacts.exchangeGit(input)), { signal });
+    const type = `application/x-git-${input.operation.startsWith("upload-pack") ? "upload-pack" : "receive-pack"}-${input.operation.endsWith("advertisement") ? "advertisement" : "result"}`;
+    if (!response.ok || response.headers.get("content-type") !== type) {
+        await response.body?.cancel();
+        return new Response(null, { status: 503 });
+    }
+    return new Response(response.body, {
+        status: response.status,
+        headers: { "Content-Type": type, "Cache-Control": "no-store" },
+    });
+}
+/** The operator's smart-HTTP door to one App's template repository: an
+ * ordinary `git push` (or the fetch before it) to
+ * `<base>/<suffix>` reaches `template-<app>` through the same admitted
+ * Artifacts exchange, which streams both bodies and holds every provider
+ * credential. An advertisement first opens the repository, so a fresh Oyster's
+ * first seed creates it. Admission (the owner) is the caller's. */
+export async function exchangeOysterTemplateSource(artifacts, rawAppId, suffix, request) {
+    let appId;
+    try {
+        appId = parseAppId(rawAppId);
+    }
+    catch {
+        return new Response("Not an App", { status: 404 });
+    }
+    const url = new URL(request.url);
+    const exchange = smartHttpExchange(request.method, url, suffix);
+    if (exchange === null)
+        return new Response("Not a git route", { status: 404 });
+    // The provider exchange carries no content coding; refuse rather than corrupt.
+    if (request.headers.has("content-encoding"))
+        return new Response("Compressed Git requests are not supported", {
+            status: 400,
+        });
+    const repository = templateRepositoryForApp(appId);
+    if (exchange.advertise)
+        await artifacts.ensureRepository(repository);
+    const headers = new Headers();
+    for (const name of ["content-type", "accept", "git-protocol"]) {
+        const value = request.headers.get(name);
+        if (value !== null)
+            headers.set(name, value);
+    }
+    const init = {
+        method: request.method,
+        headers,
+        body: exchange.advertise ? null : request.body,
+        signal: request.signal,
+    };
+    if (init.body !== null)
+        Object.assign(init, { duplex: "half" });
+    return exchangeOysterTemplateGit(artifacts, `https://git.team.internal/${repository}.git`, repository, new Request(`https://git.team.internal/${repository}.git/${suffix}${url.search}`, init), "write");
+}

package/dist/app-storage.d.ts

@@ -0,0 +1,141 @@
+/**
+ * `env.APP_STORAGE`: the App's own key/value store, as its backend receives
+ * it. One contract for every Oyster host (standalone and the Fungi Hub).
+ *
+ * - **Same handle everywhere.** Method handlers and lifecycle handlers (such
+ *   as `onGitPush`) run in the same facet and receive the same `env`. When the
+ *   Release declares the `APP_STORAGE` binding, both get this handle with the
+ *   same operations.
+ * - **Who writes.** In a method call, a member writes their own `member`
+ *   layer; an admitted owner may also write the `team` layer, as from the UI.
+ *   A lifecycle handler has no
+ *   member, so it writes the installation's shared `team` layer; a `member`
+ *   write from a lifecycle handler is rejected with `owner_required`.
+ * - **Visible to watchers.** Every accepted write or reset is committed by the
+ *   host's storage owner, bumps the key's revision and is published to
+ *   `appStorage.watch` subscribers, exactly like a write from the App's UI.
+ *   A push that writes a key therefore refreshes every open UI watching it.
+ * - **Same limits.** Declared keys, scopes, per-key size and quotas, and
+ *   `basedOn` compare-and-set apply unchanged; rejections use Agar's
+ *   `AppStorageError` codes.
+ */
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+import { type AppStorageKey } from "@fungi.computer/puffball";
+import * as Stream from "effect/Stream";
+import { AppStorageError, type AppStorageResult, type AppStorageWrite, type AppStorageReset, type ResolvedAppStorage } from "@fungi.computer/agar/storage";
+/** The App storage handle in `env.APP_STORAGE`. */
+export type AppStorageBinding = Readonly<{
+    /** Read one declared key, resolved across the team and member layers. */
+    read(key: string): Promise<AppStorageResult<ResolvedAppStorage>>;
+    /** Write one layer of a declared key; `basedOn` is the expected revision. */
+    write(input: AppStorageWrite): Promise<AppStorageResult<{
+        revision: number;
+    }>>;
+    /** Remove one layer of a declared key. */
+    reset(input: AppStorageReset): Promise<AppStorageResult<{
+        revision: number;
+    }>>;
+}>;
+/** Trusted backend writer: owners may also edit the Team layer; lifecycle has no member. */
+export type AppStorageWriter = Readonly<{
+    kind: "member";
+    memberId: string;
+    isOwner: boolean;
+}> | Readonly<{
+    kind: "lifecycle";
+    handler: string;
+}>;
+/** Whether `writer` may mutate `scope`; anything else is `owner_required`. */
+export declare function appStorageWritable(writer: AppStorageWriter, scope: AppStorageWrite["scope"]): boolean;
+/** Trusted live App admission, never supplied by the App or an HTTP body. */
+export type AppStorageAdmission = Readonly<{
+    address: string;
+    appId: string;
+    memberId: string;
+    membershipVersion: number;
+    isOwner: boolean;
+    keys: readonly AppStorageKey[];
+    /** Recheck local membership, installation and Release inside the transaction. */
+    assertCurrent: () => void;
+}>;
+/** Trusted installation lifecycle admission, with no member identity or private layer. */
+export type AppStorageInstallationAdmission = Pick<AppStorageAdmission, "address" | "appId" | "keys" | "assertCurrent">;
+/** SQLite tables, indexes and initial revision state used by the App storage owner. */
+export declare const appStorageSchemaStatements: readonly ["CREATE TABLE IF NOT EXISTS hub_app_storage (\n    address TEXT NOT NULL, app_id TEXT NOT NULL, key TEXT NOT NULL,\n    scope TEXT NOT NULL CHECK(scope IN ('team','member')), member_id TEXT NOT NULL, membership_version INTEGER NOT NULL,\n    value TEXT NOT NULL, revision INTEGER NOT NULL, bytes INTEGER NOT NULL,\n    PRIMARY KEY(address,app_id,key,scope,member_id,membership_version),\n    CHECK((scope='team' AND member_id='' AND membership_version=0) OR (scope='member' AND member_id<>'' AND membership_version>0))) STRICT", "CREATE INDEX IF NOT EXISTS hub_app_storage_member ON hub_app_storage(member_id) WHERE scope='member'", "CREATE TABLE IF NOT EXISTS hub_app_storage_clock (id INTEGER PRIMARY KEY CHECK(id=1), revision INTEGER NOT NULL) STRICT", "INSERT OR IGNORE INTO hub_app_storage_clock VALUES(1,0)", "CREATE TABLE IF NOT EXISTS hub_app_storage_writes (address TEXT NOT NULL, member_id TEXT NOT NULL, membership_version INTEGER NOT NULL, started_at INTEGER NOT NULL, count INTEGER NOT NULL, PRIMARY KEY(address,member_id,membership_version)) STRICT"];
+/** Called only inside the installation owner's delete transaction. */
+export declare function purgeAppStorageInCommit(sql: WatchdogSqliteOwner["sql"], address: string): void;
+/** Called only inside the membership owner's removal transaction. */
+export declare function purgeAppMemberStorageInCommit(sql: WatchdogSqliteOwner["sql"], memberId: string, throughVersion: number): void;
+/** One SQLite owner for scoped App values; its views bind the admitted member. */
+export declare function createAppStorage(options: {
+    /** The SQLite connection shared with installation and membership changes. */
+    sql: WatchdogSqliteOwner["sql"];
+    /** Millisecond clock used for the existing per-principal write-rate limit. */
+    now?: () => number;
+    /** Commit the supplied mutation atomically before publishing its invalidation. */
+    commit: <A>(body: () => A) => Effect.Effect<A, Error>;
+}): {
+    /** Remove an installation's values and write counters inside its delete transaction. */
+    purgeInstallation: (address: string) => void;
+    /** Remove a member's private values and counters through the revoked membership version. */
+    purgeMember: (memberId: string, throughVersion: number) => void;
+    /** Bind a lifecycle view to fresh installation admission; only declared team layers are accessible. */
+    openInstallation(authorize: () => Effect.Effect<AppStorageInstallationAdmission, Error>): {
+        /** Read the declared team layer without exposing any member's private value. */
+        read: (key: string) => Effect.Effect<{
+            readonly value: Schema.Json;
+            readonly source: "team" | "member" | "none";
+            readonly team: {
+                readonly value: Schema.Json;
+                readonly revision: number;
+            } | null;
+            readonly member: {
+                readonly value: Schema.Json;
+                readonly revision: number;
+            } | null;
+            readonly canWriteTeam: boolean;
+        }, AppStorageError, never>;
+        /** Commit a declared team-layer write and publish its new revision to watchers. */
+        write: (input: AppStorageWrite) => Effect.Effect<{
+            revision: number;
+        }, AppStorageError, never>;
+        /** Reset a declared team layer; member scope is rejected with owner_required. */
+        reset: (input: AppStorageReset) => Effect.Effect<{
+            revision: number;
+        }, AppStorageError, never>;
+    };
+    /** Bind a member view to live admission, declared keys and the current membership version. */
+    open(authorize: () => Effect.Effect<AppStorageAdmission, Error>): {
+        /** Resolve declared member and team layers under current live admission. */
+        read: (key: string) => Effect.Effect<{
+            readonly value: Schema.Json;
+            readonly source: "team" | "member" | "none";
+            readonly team: {
+                readonly value: Schema.Json;
+                readonly revision: number;
+            } | null;
+            readonly member: {
+                readonly value: Schema.Json;
+                readonly revision: number;
+            } | null;
+            readonly canWriteTeam: boolean;
+        }, AppStorageError, never>;
+        /** Commit an admitted layer write with revision and quota checks, then notify watchers. */
+        write: (input: AppStorageWrite) => Effect.Effect<{
+            revision: number;
+        }, AppStorageError, never>;
+        /** Remove an admitted layer at its expected revision and notify watchers. */
+        reset: (input: AppStorageReset) => Effect.Effect<{
+            revision: number;
+        }, AppStorageError, never>;
+        /** One bounded invalidation stream. Null marks an armed subscription. */
+        events: (key: string) => Stream.Stream<{
+            readonly appId: string;
+            readonly key: string;
+            readonly scope: "team" | "member";
+            readonly revision: number;
+        } | null, AppStorageError, never>;
+    };
+};