@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/dist/workers-git.js

@@ -0,0 +1,1174 @@
+import * as z from "zod";
+import { defaultTenant, implicitTenancy, tenantScope, } from "./tenant.js";
+import { createOysterMcpOwner } from "./mcp-owner.js";
+import { createAdmittedGit, createInstallationGitAdmission, } from "./git-admission.js";
+import { resolveBackend } from "./release.js";
+/**
+ * Cloudflare adapters for git Apps on a standalone Oyster: the GIT binding
+ * over Artifacts, named keys for agents, and signed webhook delivery for App
+ * events. Every credential and secret stays in these host objects.
+ */
+import { DurableObject } from "cloudflare:workers";
+import { nativeGitFrameMethods, invokeNativeGit, } from "@fungi.computer/agar/git-rpc";
+import { APP_INVOCATION_CEILING_MS, invocationFacts, invocationCallerContext, } from "./invocation.js";
+import { AppInstanceError, selectionOf } from "./index.js";
+import { ownerOrKeyAuth } from "./auth.js";
+import { causeClass } from "./cause-class.js";
+import { Hono } from "hono";
+import * as Schema from "effect/Schema";
+import { defineIdFamily } from "@fungi.computer/cairn";
+import {} from "@fungi.computer/agar/git";
+import { parseAppMethodCallContext, workflowAttestationSchema, } from "@fungi.computer/puffball/app-method-runtime";
+import { lsRefsRequest, parseLsRefs, } from "./git.js";
+import { createKeyStore, } from "@fungi.computer/ear-tag/keys";
+import { oysterKeyVocabulary, } from "./keys.js";
+import { agentCapabilities, agentApprovalRoutes, agentMcpServerRoutes, } from "./agents.js";
+import { createArtifactsRestNamespace, } from "@fungi.computer/burrow";
+import { attemptWebhook } from "./webhook-delivery.js";
+import { createRecipientDeliveries, } from "./event-recipients.js";
+import { createOyster, oysterPrincipalIsOwner, } from "./host.js";
+import { OysterInstance, oysterBindingEntrypoint, oysterBindings, oysterWorkerHost, r2FileSource, r2ArtifactStore, } from "./workers.js";
+import { registryInstallations } from "./internal/registry-installations.js";
+const infoSchema = Schema.Struct({
+    name: Schema.String,
+    defaultBranch: Schema.String,
+    remote: Schema.String,
+    lastPushAt: Schema.optional(Schema.NullOr(Schema.String)),
+    source: Schema.optional(Schema.NullOr(Schema.String)),
+});
+const pageSchema = Schema.Struct({
+    repos: Schema.Array(Schema.Struct({ name: Schema.String, status: Schema.String })),
+    cursor: Schema.optional(Schema.String),
+});
+const plaintextSchema = Schema.Struct({ plaintext: Schema.NonEmptyString });
+const tokenSchema = Schema.Struct({
+    ...plaintextSchema.fields,
+    expiresAt: Schema.DateFromString,
+});
+class CredentialRejected extends Error {
+}
+const codeSchema = Schema.Struct({ code: Schema.String });
+function errorCode(error) {
+    const parsed = Schema.decodeUnknownOption(codeSchema)(error);
+    return parsed._tag === "Some" ? parsed.value.code : null;
+}
+/** A provider failure as host diagnostics may name it: its code, never its text. */
+function providerCause(cause) {
+    return ((cause instanceof Error ? errorCode(cause) : null) ?? causeClass(cause));
+}
+function appCommit(commit) {
+    return {
+        ...commit,
+        author: { ...commit.author },
+        committer: { ...commit.committer },
+        parents: [...commit.parents],
+    };
+}
+const READY_TIMEOUT_MS = 60_000;
+const TOKEN_TTL_SECONDS = 600;
+const TOKEN_REUSE_MS = 8 * 60_000;
+const TOKEN_EXPIRY_MARGIN_MS = 30_000;
+// Eviction only causes another mint; it never limits repository work.
+const TOKEN_CACHE_ENTRIES = 256;
+const NAME = /^[a-zA-Z0-9._-]{1,100}$/u;
+function wait(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** The GIT binding over Artifacts for one installation (`prefix` scopes its names).
+ * Credentials remain host-held and are reused until thirty seconds before the
+ * provider expiry or eight minutes, whichever comes first. Every operation still
+ * checks its captured grant. Provider 401/403 discards the credential for remint.
+ */
+export function createArtifactsGit(binding, prefix, grant) {
+    // This public adapter owns a fresh cache; only the private Instance composition
+    // shares values between adapters, with a verified approval partition.
+    return artifactsGit(binding, prefix, grant, new Map(), null);
+}
+// Share only credential values. Every adapter retains its own admission callback
+// and in-flight mint promises; neither survives its invocation frame.
+function artifactsGit(binding, prefix, grant, tokens, approval) {
+    const credentialKey = (name, scope) => JSON.stringify(approval === null
+        ? [prefix, name, scope]
+        : [prefix, name, scope, approval.authorityVersion, approval.releaseId]);
+    const requireOperation = (operation) => {
+        if (!grant.operations.includes(operation))
+            throw new Error(`Git operation denied: ${operation}`);
+        grant.beforeProvider?.();
+    };
+    const provider = (name) => {
+        if (!NAME.test(name))
+            throw new Error("Invalid repository name");
+        const composed = `${prefix}${name}`;
+        if (composed.length > 128)
+            throw new Error("Invalid repository name");
+        return composed;
+    };
+    const local = (name) => name.startsWith(prefix) ? name.slice(prefix.length) : null;
+    const toInfo = (raw) => {
+        const info = Schema.decodeUnknownSync(infoSchema)(raw);
+        const source = info.source?.replace(/^artifacts:[^/]+\//u, "") ?? null;
+        return {
+            name: local(info.name) ?? info.name,
+            defaultBranch: info.defaultBranch,
+            lastPushAt: info.lastPushAt ?? null,
+            source: source === null ? null : local(source),
+        };
+    };
+    const minting = new Map();
+    const retrying = async (attempt) => {
+        for (let tries = 1;; tries += 1) {
+            try {
+                return await attempt();
+            }
+            catch (error) {
+                if (tries >= 4 ||
+                    error instanceof CredentialRejected ||
+                    Schema.isSchemaError(error) ||
+                    (error instanceof Error &&
+                        ["NOT_FOUND", "INVALID_RESPONSE"].includes(errorCode(error) ?? "")))
+                    throw error;
+                await wait(250 * tries);
+            }
+        }
+    };
+    const status = async (name) => {
+        let cursor;
+        do {
+            const page = Schema.decodeUnknownSync(pageSchema)(await binding.list(cursor === undefined ? { limit: 200 } : { limit: 200, cursor }));
+            const found = page.repos.find((repo) => repo.name === name);
+            if (found)
+                return found.status;
+            cursor = page.cursor;
+        } while (cursor !== undefined);
+        return "missing";
+    };
+    const whenReady = async (name) => {
+        const deadline = Date.now() + READY_TIMEOUT_MS;
+        while (Date.now() < deadline) {
+            if ((await status(name)) === "ready") {
+                try {
+                    return toInfo(await (await binding.get(name)).info());
+                }
+                catch (error) {
+                    const code = error instanceof Error ? errorCode(error) : null;
+                    if (code !== "FORK_IN_PROGRESS" && code !== "IMPORT_IN_PROGRESS")
+                        throw error;
+                }
+            }
+            await wait(400);
+        }
+        throw new Error("Repository did not become ready");
+    };
+    const credential = async (name, scope) => {
+        const target = provider(name);
+        grant.beforeProvider?.();
+        const key = credentialKey(name, scope);
+        const cached = tokens.get(key);
+        if (cached && cached.until > Date.now())
+            return { remote: cached.remote, token: cached.token };
+        if (cached !== undefined)
+            tokens.delete(key);
+        let pending = minting.get(key);
+        if (pending === undefined) {
+            pending = retrying(async () => {
+                grant.beforeProvider?.();
+                const startedAt = Date.now();
+                const repo = await binding.get(target);
+                grant.beforeProvider?.();
+                const info = Schema.decodeUnknownSync(infoSchema)(await repo.info());
+                grant.beforeProvider?.();
+                const rawToken = await repo.createToken(scope, TOKEN_TTL_SECONDS);
+                grant.beforeProvider?.();
+                const now = Date.now();
+                let issued;
+                let until;
+                try {
+                    issued = Schema.decodeUnknownSync(tokenSchema)(rawToken);
+                    until = Math.min(issued.expiresAt.getTime() - TOKEN_EXPIRY_MARGIN_MS, startedAt + TOKEN_REUSE_MS);
+                    if (until <= now)
+                        throw new CredentialRejected("Artifacts credential expires too soon");
+                }
+                catch (cause) {
+                    const rejected = new CredentialRejected("Artifacts credential rejected", { cause });
+                    const returned = Schema.decodeUnknownOption(plaintextSchema)(rawToken);
+                    if (returned._tag === "Some") {
+                        try {
+                            await repo.revokeToken(returned.value.plaintext);
+                        }
+                        catch (cleanupCause) {
+                            // Best effort: keep only safe cause classes, never provider text/token data.
+                            rejected.cause = {
+                                rejection: causeClass(cause),
+                                cleanup: causeClass(cleanupCause),
+                            };
+                            throw rejected;
+                        }
+                    }
+                    throw rejected;
+                }
+                for (const [cachedKey, value] of tokens)
+                    if (value.until <= now)
+                        tokens.delete(cachedKey);
+                if (!tokens.has(key) && tokens.size >= TOKEN_CACHE_ENTRIES) {
+                    const oldest = tokens.keys().next();
+                    if (!oldest.done)
+                        tokens.delete(oldest.value);
+                }
+                tokens.set(key, {
+                    remote: info.remote,
+                    token: issued.plaintext,
+                    until,
+                });
+                return { remote: info.remote, token: issued.plaintext };
+            });
+            minting.set(key, pending);
+        }
+        try {
+            const result = await pending;
+            grant.beforeProvider?.();
+            return result;
+        }
+        finally {
+            if (minting.get(key) === pending)
+                minting.delete(key);
+        }
+    };
+    const exchange = async (name, request) => {
+        let access;
+        try {
+            access = await credential(name, request.service === "receive-pack" ? "write" : "read");
+        }
+        catch (error) {
+            if (error instanceof Error && errorCode(error) === "NOT_FOUND")
+                return {
+                    status: 404,
+                    headers: { "content-type": "text/plain; charset=utf-8" },
+                    body: new TextEncoder().encode("Repository not found"),
+                };
+            throw error;
+        }
+        const { remote, token } = access;
+        const key = credentialKey(name, request.service === "receive-pack" ? "write" : "read");
+        const target = request.phase === "advertise"
+            ? `${remote}/info/refs?service=git-${request.service}`
+            : `${remote}/git-${request.service}`;
+        const incoming = new Headers(request.headers);
+        const headers = new Headers({ Authorization: `Bearer ${token}` });
+        for (const header of ["content-type", "accept", "git-protocol"]) {
+            const value = incoming.get(header);
+            if (value !== null)
+                headers.set(header, value);
+        }
+        grant.beforeProvider?.();
+        const response = await fetch(target, {
+            method: request.phase === "advertise" ? "GET" : "POST",
+            headers,
+            body: request.body === null ? null : new Uint8Array(request.body),
+            redirect: "manual",
+        });
+        if ((response.status === 401 || response.status === 403) &&
+            tokens.get(key)?.token === token)
+            tokens.delete(key);
+        if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel();
+            throw new Error("Artifacts Git redirect refused");
+        }
+        return {
+            status: response.status,
+            headers: Object.fromEntries(response.headers),
+            body: new Uint8Array(await response.arrayBuffer()),
+        };
+    };
+    const finishCreated = async (name, initialToken) => {
+        try {
+            await (await binding.get(name)).revokeToken(initialToken);
+        }
+        catch (revokeCause) {
+            // Provider codes are a closed provider vocabulary; never copy provider text.
+            const revoke = providerCause(revokeCause);
+            try {
+                await binding.delete(name);
+            }
+            catch (deleteCause) {
+                console.error("Artifacts repository activation cleanup failed", {
+                    repository: name,
+                    revoke,
+                    delete: providerCause(deleteCause),
+                });
+                throw new Error(`Artifacts initial token cleanup refused repository activation (revoke ${revoke}, delete ${providerCause(deleteCause)})`, { cause: deleteCause });
+            }
+            throw new Error(`Artifacts initial token cleanup refused repository activation (revoke ${revoke})`, { cause: revokeCause });
+        }
+    };
+    return {
+        async create(name, opts) {
+            requireOperation("create");
+            const target = provider(name);
+            const created = await binding.create(target, {
+                description: opts?.description ?? "",
+                readOnly: false,
+                setDefaultBranch: opts?.defaultBranch ?? "main",
+            });
+            await finishCreated(target, created.token);
+            return toInfo(created);
+        },
+        async fork(source, target, opts) {
+            requireOperation("fork");
+            const destination = provider(target);
+            const repo = await binding.get(provider(source));
+            grant.beforeProvider?.();
+            let created;
+            try {
+                created = await repo.fork(destination, {
+                    description: opts?.description ?? "",
+                    readOnly: false,
+                    defaultBranchOnly: false,
+                });
+            }
+            catch (forkCause) {
+                // A destination that already exists (an earlier attempt may have
+                // created it before failing) answers once ready; its `source` tells
+                // the caller whether it is the fork it asked for.
+                if ((await status(destination)) === "missing")
+                    throw forkCause;
+                const existing = await whenReady(destination);
+                console.warn("Artifacts fork destination already exists", {
+                    repository: destination,
+                    source: existing.source,
+                    fork: providerCause(forkCause),
+                });
+                return existing;
+            }
+            // Artifacts forks asynchronously: the destination refuses token and
+            // read operations until the copy is ready, so wait before cleanup.
+            const ready = await whenReady(destination);
+            await finishCreated(destination, created.token);
+            return ready;
+        },
+        async info(name) {
+            requireOperation("read");
+            try {
+                const repo = await binding.get(provider(name));
+                grant.beforeProvider?.();
+                return toInfo(await repo.info());
+            }
+            catch (error) {
+                if (error instanceof Error && errorCode(error) === "NOT_FOUND")
+                    return null;
+                throw error;
+            }
+        },
+        async delete(name) {
+            requireOperation("write");
+            tokens.delete(credentialKey(name, "read"));
+            tokens.delete(credentialKey(name, "write"));
+            return binding.delete(provider(name));
+        },
+        async log(name, opts) {
+            requireOperation("read");
+            const repo = await binding.get(provider(name));
+            grant.beforeProvider?.();
+            const commits = await repo.log({
+                ref: opts.ref,
+                limit: opts.limit ?? 50,
+                offset: opts.offset ?? 0,
+            });
+            return commits.map(appCommit);
+        },
+        async readCommit(name, hash) {
+            requireOperation("read");
+            const repo = await binding.get(provider(name));
+            grant.beforeProvider?.();
+            const commit = await repo.readCommit(hash);
+            return commit === null ? null : appCommit(commit);
+        },
+        async readTree(name, hash) {
+            requireOperation("read");
+            const repo = await binding.get(provider(name));
+            grant.beforeProvider?.();
+            const entries = await repo.readTree(hash);
+            return entries === null ? null : [...entries];
+        },
+        async readBlob(name, hash) {
+            requireOperation("read");
+            const repo = await binding.get(provider(name));
+            grant.beforeProvider?.();
+            const blob = await repo.readBlob(hash);
+            return blob === null ? null : new Uint8Array(await blob.arrayBuffer());
+        },
+        async refs(name) {
+            requireOperation("read");
+            const response = await exchange(name, {
+                service: "upload-pack",
+                phase: "exchange",
+                headers: {
+                    "content-type": "application/x-git-upload-pack-request",
+                    "git-protocol": "version=2",
+                },
+                body: lsRefsRequest(),
+            });
+            if (response.status !== 200)
+                throw new Error(`ls-refs failed (${String(response.status)})`);
+            return parseLsRefs(response.body);
+        },
+        async exchange(name, request) {
+            requireOperation("exchange");
+            return exchange(name, request);
+        },
+        async credential(name, scope) {
+            requireOperation(scope);
+            return credential(name, scope);
+        },
+    };
+}
+const webhookIds = defineIdFamily({
+    family: "oyster-webhooks",
+    version: 1,
+    kinds: { subscription: { prefix: "whk" } },
+});
+/**
+ * Named keys an owner issues directly: an Ear Tag key store scoped to this
+ * tenant. A key's id is the name the owner chose for it, so forks and other
+ * name-derived identities (`service.ts:95`) stay stable across a reissue.
+ * Plaintext keys are never stored.
+ */
+export class OysterKeys extends DurableObject {
+    #store;
+    constructor(ctx, env) {
+        super(ctx, env);
+        this.#store = createKeyStore({
+            sql: ctx.storage.sql,
+            commit: (body) => Promise.resolve(ctx.storage.transactionSync(body)),
+            vocabulary: oysterKeyVocabulary,
+            prefix: "oyk",
+            // The DO trusts only its Worker caller, which checks the owner on
+            // every path (gitAdminRoutes, ownerOrKeyAuth) before it ever calls
+            // here, so every actor this store admits is already the owner.
+            authorizeIssuer: () => Promise.resolve({ kind: "unrestricted" }),
+        });
+    }
+    /**
+     * Issue a key named `name`, its id too. Refuses `conflict` once a name has
+     * been used, including by a now-revoked key: a name is never reused.
+     */
+    issue(owner, input) {
+        return this.#store.issue(owner, {
+            name: input.name,
+            keyId: input.name,
+            grants: input.grants,
+            expiresAt: input.expiresAt,
+        });
+    }
+    /** Revoke a key by id; idempotent on repeat. */
+    revoke(owner, requestId, keyId) {
+        return this.#store.revoke(owner, { requestId, keyId });
+    }
+    /** Every key this tenant has issued, newest first. */
+    list(owner) {
+        return this.#store.list(owner);
+    }
+    /** Verify a bearer secret and return its current principal. */
+    verify(secret) {
+        return this.#store.verify(secret);
+    }
+    /** The live facts behind one key id, for the host's `keys.live` port; `null` for an unknown, revoked, expired or suspended key. */
+    async live(keyId) {
+        const result = await this.#store.read("host", keyId);
+        if (result.kind !== "ok")
+            return null;
+        return {
+            keyId: result.value.keyId,
+            owner: result.value.owner,
+            grantVersion: result.value.grantVersion,
+            grants: result.value.scope.grants,
+        };
+    }
+}
+const RETRY_DELAYS_MS = [10_000, 60_000, 300_000, 1_800_000, 7_200_000];
+const subscriptionRow = Schema.Struct({
+    id: Schema.String,
+    installation_id: Schema.String,
+    url: Schema.String,
+    types: Schema.String,
+    created_at: Schema.Number,
+});
+const deliveryRow = Schema.Struct({
+    id: Schema.String,
+    subscription: Schema.String,
+    type: Schema.String,
+    state: Schema.Literals(["pending", "delivered", "failed"]),
+    attempts: Schema.Number,
+    last_status: Schema.NullOr(Schema.Number),
+    updated_at: Schema.Number,
+});
+const typesSchema = Schema.fromJsonString(Schema.Array(Schema.String));
+function toSubscription(row) {
+    const decoded = Schema.decodeUnknownSync(subscriptionRow)(row);
+    return {
+        id: decoded.id,
+        installationId: decoded.installation_id,
+        url: decoded.url,
+        types: Schema.decodeUnknownSync(typesSchema)(decoded.types),
+        createdAt: decoded.created_at,
+    };
+}
+/**
+ * The tenant's App event delivery owner: webhook subscriptions with signed,
+ * retried deliveries, and host recipients with durable per-recipient records.
+ * An emit commits here and returns; every delivery happens on the alarm.
+ */
+export class OysterWebhooks extends DurableObject {
+    #recipients;
+    constructor(ctx, env) {
+        super(ctx, env);
+        ctx.storage.sql.exec(`
+      CREATE TABLE IF NOT EXISTS oyster_subscriptions (
+        id TEXT PRIMARY KEY, installation_id TEXT NOT NULL, url TEXT NOT NULL, secret TEXT NOT NULL,
+        types TEXT NOT NULL, created_at INTEGER NOT NULL) STRICT;
+      CREATE TABLE IF NOT EXISTS oyster_deliveries (
+        id TEXT PRIMARY KEY, subscription TEXT NOT NULL, type TEXT NOT NULL, body TEXT NOT NULL,
+        state TEXT NOT NULL, attempts INTEGER NOT NULL, next_at INTEGER NOT NULL,
+        last_status INTEGER, updated_at INTEGER NOT NULL) STRICT;
+      CREATE INDEX IF NOT EXISTS oyster_deliveries_due ON oyster_deliveries(state, next_at);
+    `);
+        this.#recipients = createRecipientDeliveries({
+            sql: ctx.storage.sql,
+            now: () => Date.now(),
+            wake: (at) => this.wakeBy(at),
+            deliver: (recipient, event) => this.deliverToRecipient({ recipient, event }),
+        });
+    }
+    /**
+     * A root that names host recipients delivers to them here. This host has
+     * none, so a row that names one fails rather than claiming delivery.
+     */
+    deliverToRecipient(delivery) {
+        return Promise.reject(new Error(`This host has no event recipient ${delivery.recipient}`));
+    }
+    /** Arm the one alarm no later than `at`; webhooks and recipients share it. */
+    async wakeBy(at) {
+        const current = await this.ctx.storage.getAlarm();
+        if (current === null || at < current)
+            await this.ctx.storage.setAlarm(at);
+    }
+    /** Recent deliveries to one host recipient, newest first. */
+    recipientDeliveries(recipient) {
+        return this.#recipients.deliveries(recipient);
+    }
+    /** Subscribe `url` to an installation's events; returns the secret once. */
+    subscribe(input) {
+        const secret = input.secret ??
+            `whsec_${btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(24))))}`;
+        const subscription = {
+            id: webhookIds.subscription.generate(),
+            installationId: input.installationId,
+            url: input.url,
+            types: [...input.types],
+            createdAt: Date.now(),
+        };
+        this.ctx.storage.sql.exec("INSERT INTO oyster_subscriptions (id, installation_id, url, secret, types, created_at) VALUES (?, ?, ?, ?, ?, ?)", subscription.id, subscription.installationId, subscription.url, secret, JSON.stringify(subscription.types), subscription.createdAt);
+        return { subscription, secret };
+    }
+    /** Every subscription. */
+    subscriptions() {
+        return this.ctx.storage.sql
+            .exec("SELECT id, installation_id, url, types, created_at FROM oyster_subscriptions ORDER BY created_at")
+            .toArray()
+            .map(toSubscription);
+    }
+    /** Remove a subscription and its deliveries. */
+    unsubscribe(id) {
+        const removed = this.ctx.storage.sql.exec("DELETE FROM oyster_subscriptions WHERE id = ?", id).rowsWritten > 0;
+        this.ctx.storage.sql.exec("DELETE FROM oyster_deliveries WHERE subscription = ?", id);
+        return removed;
+    }
+    /** Recent deliveries for one subscription, newest first. */
+    deliveries(subscription) {
+        return this.ctx.storage.sql
+            .exec("SELECT id, subscription, type, state, attempts, last_status, updated_at FROM oyster_deliveries WHERE subscription = ? ORDER BY updated_at DESC LIMIT 50", subscription)
+            .toArray()
+            .map((row) => {
+            const decoded = Schema.decodeUnknownSync(deliveryRow)(row);
+            return {
+                id: decoded.id,
+                subscription: decoded.subscription,
+                type: decoded.type,
+                state: decoded.state,
+                attempts: decoded.attempts,
+                lastStatus: decoded.last_status,
+                updatedAt: decoded.updated_at,
+            };
+        });
+    }
+    /**
+     * Accept an emitted event: queue it for every matching subscription and
+     * every named host recipient (idempotent per event id). Nothing is delivered
+     * before this returns, so no recipient can fail the emitter's write.
+     */
+    async enqueue(source, payload, eventId, recipients) {
+        const { installationId } = source;
+        const now = Date.now();
+        let queued = this.#recipients.enqueue({ source, type: payload.type, eventId, payload }, recipients);
+        for (const subscription of this.subscriptions()) {
+            if (subscription.installationId !== installationId)
+                continue;
+            if (subscription.types.length > 0 &&
+                !subscription.types.includes(payload.type))
+                continue;
+            queued += this.ctx.storage.sql.exec("INSERT OR IGNORE INTO oyster_deliveries (id, subscription, type, body, state, attempts, next_at, last_status, updated_at) VALUES (?, ?, ?, ?, 'pending', 0, ?, NULL, ?)", `${subscription.id}.${eventId}`, subscription.id, payload.type, JSON.stringify(payload), now, now).rowsWritten;
+        }
+        if (queued > 0)
+            await this.wakeBy(now);
+        return queued;
+    }
+    /** Deliver due webhooks and recipient rows, then schedule the next retry. */
+    async alarm() {
+        await this.#recipients.drain();
+        const now = Date.now();
+        const due = this.ctx.storage.sql
+            .exec("SELECT id, subscription, type, body, attempts FROM oyster_deliveries WHERE state = 'pending' AND next_at <= ? ORDER BY next_at LIMIT 25", now)
+            .toArray();
+        await Promise.all(due.map(async (delivery) => {
+            const target = this.ctx.storage.sql
+                .exec("SELECT url, secret FROM oyster_subscriptions WHERE id = ?", delivery.subscription)
+                .toArray()[0];
+            let status = null;
+            if (target !== undefined) {
+                const attempt = await attemptWebhook(target, delivery);
+                status = attempt.kind === "response" ? attempt.status : null;
+            }
+            const attempts = delivery.attempts + 1;
+            const delivered = status !== null && status >= 200 && status < 300;
+            this.ctx.storage.sql.exec("UPDATE oyster_deliveries SET state = ?, attempts = ?, next_at = ?, last_status = ?, updated_at = ? WHERE id = ?", delivered
+                ? "delivered"
+                : target === undefined || attempts > RETRY_DELAYS_MS.length
+                    ? "failed"
+                    : "pending", attempts, now + (RETRY_DELAYS_MS[attempts - 1] ?? 0), status, Date.now(), delivery.id);
+        }));
+        const next = this.ctx.storage.sql
+            .exec("SELECT MIN(next_at) AS at FROM oyster_deliveries WHERE state = 'pending'")
+            .one().at;
+        if (next !== null)
+            await this.wakeBy(Math.max(next, Date.now() + 250));
+    }
+}
+/** The Artifacts namespace: the binding when present, else the REST API. */
+export function artifactsOf(env) {
+    if (env.ARTIFACTS !== undefined)
+        return env.ARTIFACTS;
+    if (env.ARTIFACTS_ACCOUNT_ID === undefined ||
+        env.ARTIFACTS_NAMESPACE === undefined ||
+        env.ARTIFACTS_API_TOKEN === undefined)
+        throw new Error("Configure the ARTIFACTS binding or ARTIFACTS_ACCOUNT_ID, ARTIFACTS_NAMESPACE and ARTIFACTS_API_TOKEN");
+    return createArtifactsRestNamespace({
+        accountId: env.ARTIFACTS_ACCOUNT_ID,
+        namespace: env.ARTIFACTS_NAMESPACE,
+        apiToken: env.ARTIFACTS_API_TOKEN,
+    });
+}
+const eventArgs = Schema.Tuple([
+    Schema.String,
+    Schema.Struct({
+        type: Schema.String,
+        timestamp: Schema.String,
+        data: Schema.Json,
+    }),
+    Schema.String,
+]);
+const emitMethod = {
+    decodeArgs: Schema.decodeUnknownSync(eventArgs, {
+        onExcessProperty: "error",
+    }),
+    decodeResult: Schema.decodeUnknownSync(Schema.Undefined),
+    requiredOperations: () => ["emit"],
+};
+// Admission and in-flight provider work remain frame-local.
+const gitSessions = new WeakMap();
+// Keyed by the Instance's stable binding context, so physical credentials span
+// frames only within one Instance. Values are host-held, expiry-bounded and
+// partitioned by tenant/installation prefix, repository, read/write scope,
+// authority version and Release; every frame keeps its own admission.
+const gitCredentials = new WeakMap();
+/**
+ * EVENTS: commit the emit to this tenant's delivery owner and return. Webhook
+ * subscribers and the host recipients a root names are delivered afterwards,
+ * so a subscriber outage never fails the emitting App's write.
+ */
+export function eventsBindingFor(recipients) {
+    return {
+        methods: { emit: emitMethod },
+        async dispatch(context, frame, _props, _method, args) {
+            frame.signal.throwIfAborted();
+            const [type, payload, eventId] = emitMethod.decodeArgs(args);
+            if (payload.type !== type)
+                throw new Error("Event type does not match its payload");
+            const { owner, appId, releaseId } = frame.facts.selection;
+            const named = await recipients(context, frame);
+            frame.signal.throwIfAborted();
+            await context.env.WEBHOOKS.getByName(context.scope().durableName("webhooks")).enqueue({ installationId: owner.id, appId, releaseId }, payload, eventId, named);
+            frame.signal.throwIfAborted();
+            return undefined;
+        },
+    };
+}
+/** EVENTS for a host with webhook subscribers only. */
+export const eventsBinding = eventsBindingFor(() => Promise.resolve([]));
+/** The plain host's bindings plus native GIT over Artifacts and signed EVENTS. */
+export const gitBindings = {
+    ...oysterBindings,
+    GIT: {
+        methods: nativeGitFrameMethods,
+        async dispatch(context, frame, _props, method, args) {
+            frame.signal.throwIfAborted();
+            const scope = context.scope();
+            let credentials = gitCredentials.get(context);
+            if (credentials === undefined) {
+                credentials = new Map();
+                gitCredentials.set(context, credentials);
+            }
+            let gitStore = gitSessions.get(frame);
+            if (gitStore === undefined) {
+                gitStore = artifactsGit(artifactsOf(context.env), scope.repositoryPrefix(frame.facts.selection.owner.id), {
+                    operations: ["create", "fork", "read", "write", "exchange"],
+                    beforeProvider: () => {
+                        frame.signal.throwIfAborted();
+                    },
+                }, credentials, frame.facts.selection);
+                gitSessions.set(frame, gitStore);
+                frame.signal.addEventListener("abort", () => gitSessions.delete(frame), { once: true });
+            }
+            const installation = await registryInstallations(context.env, scope).get(frame.facts.selection.owner.id);
+            frame.signal.throwIfAborted();
+            if (installation === null)
+                throw new AppInstanceError("revoked");
+            const git = await oysterWorkerGit(context.env, { scope }, { invocation: frame, store: gitStore }).git(installation);
+            frame.signal.throwIfAborted();
+            const result = await invokeNativeGit(git.binding(frame.facts.subject.kind === "call"
+                ? frame.facts.subject.context.actor
+                : null), method, args);
+            frame.signal.throwIfAborted();
+            return result;
+        },
+    },
+    EVENTS: eventsBinding,
+};
+/** A git Worker's one guest binding entrypoint, over `gitBindings`. */
+export class OysterBinding extends oysterBindingEntrypoint(gitBindings) {
+}
+const subscribeSchema = Schema.Struct({
+    installationId: Schema.String,
+    url: Schema.String.check(Schema.isStartingWith("https://")),
+    types: Schema.optional(Schema.Array(Schema.String)),
+    secret: Schema.optional(Schema.String.check(Schema.isMinLength(16))),
+});
+const keyNamePattern = /^[a-z0-9][a-z0-9-]{0,39}$/u;
+/** `invocation.ts:486` uses `team-key:visitor` for anonymous readers; a key can never claim that name. */
+const reservedKeyName = "visitor";
+const issueKeySchema = Schema.Struct({
+    name: Schema.String.check(Schema.isPattern(keyNamePattern)),
+    grants: Schema.Unknown,
+    expiresAt: Schema.optional(Schema.Number),
+});
+const revokeKeySchema = Schema.Struct({
+    keyId: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256)),
+    requestId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_.:-]{1,112}$/u)),
+});
+const oysterGrantsArraySchema = z
+    .array(oysterKeyVocabulary.grantSchema)
+    .min(1)
+    .max(64);
+function keySummary(record) {
+    return {
+        keyId: record.keyId,
+        name: record.name,
+        grants: record.scope?.grants ?? [],
+        expiresAt: record.expiresAt,
+        createdAt: record.createdAt,
+        lastUsedAt: record.lastUsedAt,
+        revokedAt: record.revokedAt,
+    };
+}
+/** Owner routes for keys and webhooks; `createOyster` mounts them owner-only. */
+export function gitAdminRoutes(env, scope) {
+    const routes = new Hono();
+    const keys = () => env.KEYS.getByName(scope.durableName("keys"));
+    routes.get("/api/keys", async (context) => {
+        const owner = context.get("principal");
+        if (!oysterPrincipalIsOwner(owner))
+            return Response.json({ error: "Owner only" }, { status: 403 });
+        const listed = await keys().list(owner.actor.memberId);
+        if (listed.kind === "error")
+            return Response.json({ error: listed.error.code }, { status: 500 });
+        return Response.json({ keys: listed.value.map(keySummary) });
+    });
+    routes.post("/api/keys", async (context) => {
+        const body = Schema.decodeUnknownOption(issueKeySchema)(await context.req.json());
+        if (body._tag === "None")
+            return Response.json({ error: "Invalid key" }, { status: 400 });
+        if (body.value.name === reservedKeyName)
+            return Response.json({ error: "Invalid key name" }, { status: 400 });
+        const owner = context.get("principal");
+        if (!oysterPrincipalIsOwner(owner))
+            return Response.json({ error: "Owner only" }, { status: 403 });
+        const grants = oysterGrantsArraySchema.safeParse(body.value.grants);
+        if (!grants.success)
+            return Response.json({ error: "Invalid grants" }, { status: 400 });
+        const issued = await keys().issue(owner.actor.memberId, {
+            name: body.value.name,
+            grants: grants.data,
+            expiresAt: body.value.expiresAt,
+        });
+        if (issued.kind === "error")
+            return Response.json({ error: issued.error.code }, { status: issued.error.code === "conflict" ? 409 : 400 });
+        return Response.json({ plaintext: issued.value.key, key: keySummary(issued.value.record) }, { status: 201 });
+    });
+    routes.post("/api/keys/revoke", async (context) => {
+        const body = Schema.decodeUnknownOption(revokeKeySchema)(await context.req.json());
+        if (body._tag === "None")
+            return Response.json({ error: "Invalid request" }, { status: 400 });
+        const owner = context.get("principal");
+        if (!oysterPrincipalIsOwner(owner))
+            return Response.json({ error: "Owner only" }, { status: 403 });
+        const revoked = await keys().revoke(owner.actor.memberId, body.value.requestId, body.value.keyId);
+        if (revoked.kind === "error")
+            return Response.json({ error: revoked.error.code }, { status: revoked.error.code === "denied" ? 404 : 400 });
+        return Response.json({ key: keySummary(revoked.value) });
+    });
+    routes.post("/api/webhooks", async (context) => {
+        const body = Schema.decodeUnknownOption(subscribeSchema)(await context.req.json());
+        if (body._tag === "None")
+            return Response.json({ error: "Invalid subscription" }, { status: 400 });
+        return Response.json(await env.WEBHOOKS.getByName(scope.durableName("webhooks")).subscribe({
+            ...body.value,
+            types: body.value.types ?? [],
+        }), { status: 201 });
+    });
+    routes.get("/api/webhooks", async () => Response.json(await env.WEBHOOKS.getByName(scope.durableName("webhooks")).subscriptions()));
+    routes.get("/api/webhooks/:id/deliveries", async (context) => Response.json(await env.WEBHOOKS.getByName(scope.durableName("webhooks")).deliveries(context.req.param("id"))));
+    routes.delete("/api/webhooks/:id", async (context) => (await env.WEBHOOKS.getByName(scope.durableName("webhooks")).unsubscribe(context.req.param("id")))
+        ? new Response(null, { status: 204 })
+        : Response.json({ error: "Not found" }, { status: 404 }));
+    return routes;
+}
+/**
+ * An App Instance whose backend may also receive declared Git and Events
+ * bindings. Background wakes readmit members through the deployable root's
+ * `hostFor`, the same composition HTTP and MCP use.
+ */
+export class OysterGitInstance extends OysterInstance {
+    bindings = gitBindings;
+}
+/** Compose a Git Worker's root from its one options value. */
+export function oysterGitRoot(options) {
+    const environments = new WeakMap();
+    const stateOf = (env) => {
+        let state = environments.get(env);
+        if (state === undefined) {
+            state = { tenancy: options.tenancy(env), admissions: new WeakMap() };
+            environments.set(env, state);
+        }
+        return state;
+    };
+    return {
+        async admit(env, request) {
+            const state = stateOf(env);
+            const resolved = await state.tenancy.resolve(request);
+            if (resolved !== null)
+                state.admissions.set(request, resolved);
+            return resolved;
+        },
+        hostFor(env, scope) {
+            const state = stateOf(env);
+            return oysterGitWorkerHost(env, options, {
+                scope,
+                auth: pinnedTenantAuth(state.tenancy, scope, state.admissions),
+            });
+        },
+    };
+}
+/** The single-owner root's tenancy: the owner key or a named key, at the configured origin only. */
+export function ownerOrKeyTenancy(env) {
+    const scope = tenantScope(defaultTenant, env.OYSTER_ORIGIN);
+    return implicitTenancy(scope.origin, ownerOrKeyAuth(env.OYSTER_OWNER_KEY, env.OYSTER_OWNER_NAME ?? "owner", () => env.KEYS.getByName(scope.durableName("keys"))));
+}
+/** The standalone Worker's `fetch` handler with the git door and owner routes. */
+export function createOysterGitWorker(root) {
+    // Bound frontend host state; SDK sessions belong to the tenant MCP owner.
+    const maxCachedHosts = 32;
+    const environments = new WeakMap();
+    return {
+        async fetch(request, env, ctx) {
+            let hosts = environments.get(env);
+            if (hosts === undefined) {
+                hosts = new Map();
+                environments.set(env, hosts);
+            }
+            const resolved = await root.admit(env, request);
+            if (resolved === null)
+                return new Response("Not found", { status: 404 });
+            const { scope } = resolved;
+            const key = `${scope.tenantId}:${scope.origin}`;
+            let entry = hosts.get(key);
+            let cache = true;
+            if (entry === undefined) {
+                if (hosts.size >= maxCachedHosts) {
+                    const idle = [...hosts].find(([, item]) => item.active === 0);
+                    if (idle === undefined)
+                        cache = false;
+                    else {
+                        hosts.delete(idle[0]);
+                    }
+                }
+                entry = { app: createOyster(root.hostFor(env, scope)), active: 0 };
+                if (cache)
+                    hosts.set(key, entry);
+            }
+            else {
+                hosts.delete(key);
+                hosts.set(key, entry);
+            }
+            entry.active += 1;
+            try {
+                return await entry.app.fetch(request, env, ctx);
+            }
+            finally {
+                entry.active -= 1;
+            }
+        },
+    };
+}
+/**
+ * `host.git` for an Oyster Worker: the git door's writer projection and the
+ * admitted, installation-scoped Artifacts path with the App's push policy and
+ * the Instance journal. Set it on your own `createOyster` host; the full
+ * standalone composition (`oysterGitWorkerHost`) uses this same builder.
+ */
+export function oysterWorkerGit(env, options, frame) {
+    const { scope } = options;
+    const installations = registryInstallations(env, scope);
+    const git = {
+        writerOf: (who) => {
+            const context = invocationCallerContext(who, null);
+            return context.actor.kind === "member" && context.role !== undefined
+                ? { kind: "actor", actor: context.actor, role: context.role }
+                : { kind: "actor", actor: context.actor };
+        },
+        git: (installation) => {
+            if (installation.instanceId === null)
+                throw new AppInstanceError("instance_inactive");
+            const stub = env.INSTANCES.getByName(installation.instanceId);
+            const invocation = frame?.invocation;
+            const beforeProvider = () => {
+                invocation?.signal.throwIfAborted();
+            };
+            const backendFor = async (current) => {
+                beforeProvider();
+                if (invocation !== undefined) {
+                    const selected = invocation.facts.selection;
+                    const captured = invocation.host.artifact;
+                    if (selected.owner.kind !== "installation" ||
+                        selected.owner.id !== current.installationId ||
+                        selected.instanceId !== current.instanceId ||
+                        selected.authorityVersion !== current.authorityVersion ||
+                        selected.appId !== current.release.appId ||
+                        selected.releaseId !== current.release.releaseId ||
+                        captured.release.appId !== current.release.appId ||
+                        captured.release.releaseId !== current.release.releaseId ||
+                        captured.release.artifact.artifactRef !==
+                            current.release.artifact.artifactRef ||
+                        captured.release.artifact.artifactDigest !==
+                            current.release.artifact.artifactDigest ||
+                        captured.digest !== invocation.facts.artifactDigest)
+                        throw new AppInstanceError("revoked");
+                    return { ...captured, declaration: invocation.host.declaration };
+                }
+                return resolveBackend(r2ArtifactStore(env.RELEASES), current.release);
+            };
+            const currentInstallation = async () => {
+                beforeProvider();
+                const current = await installations.get(installation.installationId);
+                beforeProvider();
+                if (current?.status !== "enabled" ||
+                    current.instanceId !== installation.instanceId ||
+                    current.authorityVersion !== installation.authorityVersion ||
+                    current.release.appId !== installation.release.appId ||
+                    current.release.releaseId !== installation.release.releaseId ||
+                    current.release.artifact.artifactRef !==
+                        installation.release.artifact.artifactRef ||
+                    current.release.artifact.artifactDigest !==
+                        installation.release.artifact.artifactDigest)
+                    return null;
+                return current;
+            };
+            const raw = frame?.store ??
+                createArtifactsGit(artifactsOf(env), scope.repositoryPrefix(installation.installationId), {
+                    operations: ["create", "fork", "read", "write", "exchange"],
+                    beforeProvider,
+                });
+            return Promise.resolve(createAdmittedGit({
+                installationId: installation.installationId,
+                beforeProvider,
+                store: {
+                    ...raw,
+                    cloneUrl: (name) => Promise.resolve(`${scope.origin}/git/${installation.installationId}/${name}.git`),
+                },
+                grants: {
+                    admits: createInstallationGitAdmission({
+                        currentInstallation,
+                        declaration: async (current) => (await backendFor(current))?.declaration ?? null,
+                    }),
+                },
+                policy: {
+                    authorize: async (question) => {
+                        const current = await currentInstallation();
+                        if (current?.instanceId == null)
+                            throw new AppInstanceError("revoked");
+                        const backend = await backendFor(current);
+                        if (backend === null)
+                            throw new AppInstanceError("revoked");
+                        const deadlineAt = Math.min(Date.now() + APP_INVOCATION_CEILING_MS, invocation?.facts.deadlineAt ?? Infinity);
+                        const context = {
+                            computerId: null,
+                            actor: question.writer.actor,
+                        };
+                        if (question.writer.role !== undefined)
+                            context.role = question.writer.role;
+                        if (question.writer.workflow !== undefined)
+                            context.workflow = workflowAttestationSchema.parse(question.writer.workflow);
+                        const facts = invocationFacts.fromCaller({
+                            instanceId: current.instanceId,
+                            selection: selectionOf(current),
+                            artifactDigest: backend.digest,
+                            grants: [],
+                            ancestry: [],
+                        }, parseAppMethodCallContext(context), { deadlineAt, grantExpiresAt: deadlineAt });
+                        return stub.authorizeGitPush(facts, question, undefined, scope.tenantId);
+                    },
+                },
+                journal: {
+                    tip: (name, ref) => stub.gitTip(installation.installationId, name, ref, scope.tenantId),
+                    record: async (fact) => {
+                        await stub.recordGitPush(installation.installationId, fact, scope.tenantId);
+                    },
+                },
+            }));
+        },
+    };
+    const { workflowGitPass, buildGitPass } = options;
+    let admitted = git;
+    if (workflowGitPass !== undefined)
+        admitted = {
+            ...admitted,
+            workflowPass: (pass, target) => workflowGitPass(env, scope, pass, target),
+        };
+    if (buildGitPass !== undefined)
+        admitted = {
+            ...admitted,
+            buildPass: (pass, target) => buildGitPass(env, scope, pass, target),
+        };
+    return admitted;
+}
+/**
+ * One selected tenant's whole host from a root's options. Roots reach it through
+ * `oysterGitRoot(options).hostFor`; a cold directory passes its own resolved tenant.
+ */
+export function oysterGitWorkerHost(env, options, selected) {
+    const { scope, auth } = selected;
+    // The one path to a key's liveness: the stored owner id is re-checked
+    // against the live, current owner on every read (S3 inherits this port,
+    // so this is the one place that check needs to live), the same discipline
+    // ownerOrKeyAuth already applies at authentication. `host.keys.live` below
+    // and the workspace/capabilities callbacks above it both reach a key only
+    // through this one closure, never `env.KEYS` directly.
+    const keysLive = async (keyId) => {
+        const key = await env.KEYS.getByName(scope.durableName("keys")).live(keyId);
+        if (key === null)
+            return null;
+        const current = await auth.resolve({
+            kind: "member",
+            memberId: key.owner,
+        });
+        return current !== null && oysterPrincipalIsOwner(current) ? key : null;
+    };
+    const workspace = options.workspace?.(env, keysLive) ?? {
+        computerId: scope.computerName("workspace"),
+        files: r2FileSource(env.RELEASES, scope.workspacePrefix),
+    };
+    const agents = options.agents?.(env, scope);
+    let policyOptions = {
+        workspace,
+        scope,
+    };
+    if (agents !== undefined)
+        policyOptions = {
+            ...policyOptions,
+            appToolPolicy: (principal) => agents.appToolPolicy(principal),
+        };
+    const base = oysterWorkerHost(env, auth, policyOptions);
+    const capabilities = [
+        ...(base.capabilities ?? []),
+        ...(agents === undefined ? [] : agentCapabilities(agents)),
+        ...(options.capabilities?.(env, workspace, keysLive) ?? []),
+    ];
+    let gitOptions = { scope };
+    if (options.workflowGitPass !== undefined)
+        gitOptions = { ...gitOptions, workflowGitPass: options.workflowGitPass };
+    if (options.buildGitPass !== undefined)
+        gitOptions = { ...gitOptions, buildGitPass: options.buildGitPass };
+    const git = oysterWorkerGit(env, gitOptions);
+    const ownerRoutes = gitAdminRoutes(env, scope);
+    const hostOwnerRoutes = options.ownerRoutes?.(env, scope);
+    if (hostOwnerRoutes !== undefined)
+        ownerRoutes.route("/", hostOwnerRoutes);
+    if (agents !== undefined) {
+        ownerRoutes.route("/", agentApprovalRoutes(agents));
+        ownerRoutes.route("/", agentMcpServerRoutes(agents));
+    }
+    let host = {
+        ...base,
+        capabilities,
+        git,
+        ownerRoutes,
+        keys: { live: keysLive },
+    };
+    if (options.pageScript !== undefined)
+        host = { ...host, pageScript: options.pageScript };
+    if (options.homeInstallationId !== undefined)
+        host = { ...host, homeInstallationId: options.homeInstallationId(env) };
+    return host;
+}
+/**
+ * Authenticate against the pinned tenant. A request admitted at the Worker's
+ * top reuses that one admission; any other entry resolves its own.
+ */
+function pinnedTenantAuth(tenancy, scope, admissions) {
+    const admitted = async (incoming) => admissions.get(incoming) ?? (await tenancy.resolve(incoming));
+    return {
+        resolve: async (actor) => {
+            const current = await tenancy.resolve(new Request(scope.origin));
+            if (current?.scope.tenantId !== scope.tenantId ||
+                current.scope.origin !== scope.origin)
+                return null;
+            return current.auth.resolve(actor);
+        },
+        authenticate: async (incoming) => {
+            const current = await admitted(incoming);
+            if (current?.scope.tenantId !== scope.tenantId ||
+                current.scope.origin !== scope.origin)
+                return { kind: "refused", status: 404 };
+            return current.auth.authenticate(incoming);
+        },
+        login: async (incoming) => {
+            const current = await admitted(incoming);
+            if (current?.scope.tenantId !== scope.tenantId ||
+                current.scope.origin !== scope.origin)
+                return new Response("Not found", { status: 404 });
+            return (current.auth.login?.(incoming) ??
+                new Response("Sign-in is not available", { status: 404 }));
+        },
+    };
+}
+/** Deploy the MCP owner from the same root as createOysterGitWorker. */
+export function createOysterGitMcpOwner(root) {
+    return createOysterMcpOwner((env, scope) => root.hostFor(env, scope));
+}