@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/dist/workers.js

@@ -0,0 +1,868 @@
+import { installationSchema } from "./apps/installation.js";
+import { registryInstallations } from "./internal/registry-installations.js";
+import { approvedBindingGrants, scopedBindings } from "./apps/gate.js";
+import { appMethodReplySchema } from "@fungi.computer/agar/backend";
+import { nativeGitFrameMethods, nativeGitMethodNameSchema, } from "@fungi.computer/agar/git-rpc";
+import { backgroundOriginKey, actorLane, mayDefer, } from "@fungi.computer/puffball/background-replay";
+import { emptyAppDeclaration, appBackendBindingKinds, } from "@fungi.computer/puffball/app";
+import { defaultTenant, tenantIdSchema, tenantScope, } from "./tenant.js";
+import { decodeGillReply, } from "@fungi.computer/gills";
+import { causeClass, failureDiagnostic } from "./cause-class.js";
+import { ownerKeyAuth } from "./auth.js";
+import { createOysterMcpOwner, remoteOysterMcp, } from "./mcp-owner.js";
+export { createOysterMcpOwner, OysterMcpOwner, } from "./mcp-owner.js";
+import { guestLimits } from "./guest-policy.js";
+import { r2FileSource } from "./r2-files.js";
+import { fileCapabilities } from "./files.js";
+import { DurableObject } from "cloudflare:workers";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import { releaseSchema } from "@fungi.computer/puffball/effect";
+import { AppInstanceError, } from "./index.js";
+import { createCloudflareAppInstance, createCloudflareInvocationGate, decodeFrameBindingProps, captureFrameBindingReply, frameBindingEntrypoint, backgroundFrameMethods, } from "./cloudflare.js";
+import { invocationFactsSchema, assertBackgroundBinding, admitBackgroundFrame, } from "./invocation.js";
+import { deliverBackground, deliverGitPush } from "./internal/delivery.js";
+import { createOyster, verifyRelease, defaultAssetPolicy, } from "./host.js";
+import { createGitPushJournal } from "./git-journal.js";
+import { AppStorageError, } from "@fungi.computer/agar/storage";
+import { storageFrameMethods } from "./storage-frame.js";
+import { catalogFrameMethods, oysterAppCatalog } from "./catalog-frame.js";
+import { appStorageKeyNameSchema, appStorageWriteSchema, appStorageResetSchema, } from "@fungi.computer/agar/storage";
+import { createOysterRootData } from "./root-data.js";
+import { backendCache, resolveBackend, } from "./release.js";
+import { headContentObject } from "./build/content-objects.js";
+import { ensureAppSourceTables, createOysterAppSourceReceipts, createOysterAppRegistrations, createOysterArtifactsRepositoryMetadataStore, } from "./app-sources.js";
+export { r2FileSource, ownerKeyAuth };
+/** Store Release artifacts in an R2 bucket. */
+export function r2ArtifactStore(bucket) {
+    return {
+        head: (artifactRef) => headContentObject(bucket, artifactRef),
+        async get(artifactRef) {
+            const object = await bucket.get(artifactRef);
+            return object === null
+                ? null
+                : new Uint8Array(await object.arrayBuffer());
+        },
+        async put(artifactRef, bytes) {
+            await bucket.put(artifactRef, bytes);
+        },
+    };
+}
+const recordRow = Schema.Struct({
+    installation_id: Schema.String,
+    record: Schema.String,
+});
+/** The installation registry: one SQLite-backed Durable Object per Oyster. */
+export class OysterRegistry extends DurableObject {
+    #rootData;
+    /** Append-only App source seed receipts; a Git-capable subclass forks over these. */
+    appSourceReceipts;
+    /** Team-owned fork registrations, one App publisher record per App. */
+    appRegistrations;
+    /** Durable Artifacts repository provenance for this Oyster's own fork compositions. */
+    artifactsRepositories;
+    constructor(ctx, env) {
+        super(ctx, env);
+        ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS installations (installation_id TEXT PRIMARY KEY, record TEXT NOT NULL) STRICT");
+        ensureAppSourceTables(ctx.storage.sql);
+        this.appSourceReceipts = createOysterAppSourceReceipts(ctx.storage.sql);
+        this.appRegistrations = createOysterAppRegistrations(ctx.storage.sql);
+        this.artifactsRepositories = createOysterArtifactsRepositoryMetadataStore(ctx.storage.sql);
+        this.#rootData = createOysterRootData({
+            sql: ctx.storage.sql,
+            commit: (body) => Effect.try({
+                try: () => ctx.storage.transactionSync(body),
+                catch: (cause) => cause instanceof Error
+                    ? cause
+                    : new Error("Registry commit failed", { cause }),
+            }),
+            installations: {
+                list: () => Promise.resolve(this.list()),
+            },
+            resolveRelease: (release) => verifyRelease(r2ArtifactStore(env.RELEASES), release, defaultAssetPolicy, false),
+        });
+    }
+    /** Current desktop metadata; roles are the ADR's derived default, never Hub's stored choice. */
+    directory() {
+        return this.#rootData.directory();
+    }
+    /** Read one key for the authenticated root owner, under fresh App admission. */
+    storageRead(installationId, ownerId, key) {
+        return this.storageResult(this.storageView(installationId, () => Promise.resolve(ownerId)).read(key));
+    }
+    /** Write one declared key for the authenticated root owner. */
+    storageWrite(installationId, ownerId, input) {
+        return this.storageResult(this.storageView(installationId, () => Promise.resolve(ownerId)).write(input));
+    }
+    /** Reset one declared layer for the authenticated root owner. */
+    storageReset(installationId, ownerId, input) {
+        return this.storageResult(this.storageView(installationId, () => Promise.resolve(ownerId)).reset(input));
+    }
+    /** Storage for a live owner method frame; no guest-selected installation or member. */
+    storageBackend(raw, method, args, tenantId) {
+        const facts = Schema.decodeUnknownSync(invocationFactsSchema, {
+            onExcessProperty: "error",
+        })(raw);
+        const tenant = Schema.decodeUnknownSync(tenantIdSchema)(tenantId);
+        const view = this.storageView(facts.selection.owner.id, () => this.storageOwner(facts, tenant), facts);
+        switch (method) {
+            case "read":
+                return this.storageResult(view.read(Schema.decodeUnknownSync(Schema.Tuple([appStorageKeyNameSchema]), {
+                    onExcessProperty: "error",
+                })(args)[0]));
+            case "write":
+                return this.storageResult(view.write(Schema.decodeUnknownSync(Schema.Tuple([appStorageWriteSchema]), {
+                    onExcessProperty: "error",
+                })(args)[0]));
+            case "reset":
+                return this.storageResult(view.reset(Schema.decodeUnknownSync(Schema.Tuple([appStorageResetSchema]), {
+                    onExcessProperty: "error",
+                })(args)[0]));
+            default:
+                return Promise.resolve({ kind: "rejected", code: "invalid" });
+        }
+    }
+    /** Open the existing App-storage invalidation stream under fresh owner admission. */
+    async storageEvents(installationId, ownerId, key) {
+        const view = this.storageView(installationId, () => Promise.resolve(ownerId));
+        const admitted = await this.storageResult(view.read(key));
+        if (admitted.kind === "rejected")
+            return Response.json(admitted, { status: 403 });
+        return new Response(Stream.toReadableStream(view
+            .events(key)
+            .pipe(Stream.map((event) => new TextEncoder().encode(event === null
+            ? "event: ready\ndata: {}\n\n"
+            : `event: changed\ndata: ${JSON.stringify(event)}\n\n`)))), {
+            headers: {
+                "Content-Type": "text/event-stream",
+                "Cache-Control": "no-store",
+            },
+        });
+    }
+    storageResult(program) {
+        return Effect.runPromise(Effect.match(program, {
+            onSuccess: (value) => ({ kind: "accepted", value }),
+            onFailure: (error) => ({ kind: "rejected", code: error.code }),
+        }));
+    }
+    async storageOwner(facts, tenantId) {
+        const subject = facts.subject;
+        if (subject.kind !== "call")
+            return null;
+        const { actor, role } = subject.context;
+        if (actor.kind === "member")
+            return role === "owner" ? actor.memberId : null;
+        if (actor.kind !== "agent" ||
+            tenantId !== defaultTenant ||
+            this.env.AGENT_DIRECTORY === undefined)
+            return null;
+        const creator = await this.env.AGENT_DIRECTORY.getByName("agents").readCreator(actor.agentId);
+        return creator === null ? null : this.currentOwner(creator, tenantId);
+    }
+    /**
+     * Resolve a stored creator against the live owner. The single-owner root's
+     * owner is the identity its owner key admits; tenant roots override this
+     * with their canonical membership.
+     */
+    currentOwner(memberId, tenantId) {
+        return Promise.resolve(tenantId === defaultTenant &&
+            memberId === (this.env.OYSTER_OWNER_NAME ?? "owner")
+            ? memberId
+            : null);
+    }
+    storageView(installationId, owner, expected) {
+        return this.#rootData.storage.open(() => Effect.tryPromise({
+            try: async () => {
+                const installation = this.get(installationId);
+                if (installation?.status !== "enabled" ||
+                    (expected !== undefined &&
+                        (expected.selection.owner.kind !== "installation" ||
+                            installation.instanceId !== expected.instanceId ||
+                            installation.authorityVersion !==
+                                expected.selection.authorityVersion ||
+                            installation.release.releaseId !==
+                                expected.selection.releaseId ||
+                            installation.release.appId !== expected.selection.appId)))
+                    throw new AppStorageError("unavailable");
+                const resolved = await verifyRelease(r2ArtifactStore(this.env.RELEASES), installation.release, defaultAssetPolicy, false);
+                if (expected !== undefined &&
+                    resolved.backend?.digest !== expected.artifactDigest)
+                    throw new AppStorageError("unavailable");
+                const ownerId = await owner();
+                if (ownerId === null)
+                    throw new AppStorageError("owner_required");
+                const assertCurrent = () => {
+                    if (expected !== undefined && Date.now() >= expected.deadlineAt)
+                        throw new AppStorageError("unavailable");
+                    const current = this.get(installationId);
+                    if (current?.status !== "enabled" ||
+                        current.authorityVersion !== installation.authorityVersion ||
+                        current.release.releaseId !== installation.release.releaseId ||
+                        current.release.artifact.artifactDigest !==
+                            installation.release.artifact.artifactDigest)
+                        throw new AppStorageError("unavailable");
+                };
+                assertCurrent();
+                return {
+                    address: `installation:${installationId}`,
+                    appId: installation.release.appId,
+                    memberId: ownerId,
+                    membershipVersion: 1,
+                    isOwner: true,
+                    keys: resolved.declaration?.storage ?? [],
+                    assertCurrent,
+                };
+            },
+            catch: (cause) => cause instanceof AppStorageError
+                ? cause
+                : new AppStorageError("unavailable", { cause }),
+        }));
+    }
+    /** Every installation record. */
+    list() {
+        return this.ctx.storage.sql
+            .exec("SELECT installation_id, record FROM installations ORDER BY installation_id")
+            .toArray()
+            .map((row) => this.decode(row));
+    }
+    /** One installation record, or `null`. */
+    get(installationId) {
+        const row = this.ctx.storage.sql
+            .exec("SELECT installation_id, record FROM installations WHERE installation_id=?", installationId)
+            .toArray()[0];
+        return row === undefined ? null : this.decode(row);
+    }
+    /** Create or replace one installation record. */
+    async put(installation, tenantId = defaultTenant) {
+        await this.writeInstallation(installation, tenantId);
+    }
+    /** Native RPC returns a closed result; callers never classify a transported Error. */
+    async compareAndPut(installation, expectedAuthorityVersion, tenantId = defaultTenant) {
+        try {
+            await this.writeInstallation(installation, tenantId, expectedAuthorityVersion);
+            return { ok: true };
+        }
+        catch (cause) {
+            if (cause instanceof AppInstanceError && cause.code === "stale_authority")
+                return { ok: false, code: "stale_authority" };
+            throw cause;
+        }
+    }
+    async writeInstallation(installation, tenantId, expectedAuthorityVersion) {
+        const previous = this.get(installation.installationId);
+        if (expectedAuthorityVersion !== undefined &&
+            previous?.authorityVersion !== expectedAuthorityVersion)
+            throw new AppInstanceError("stale_authority");
+        const encode = (value) => JSON.stringify(installationSchema.parse(value));
+        const record = encode(installation);
+        const previousRecord = previous === null ? null : encode(previous);
+        if (previous !== null &&
+            previous.instanceId !== null &&
+            (previous.instanceId !== installation.instanceId ||
+                previous.authorityVersion !== installation.authorityVersion ||
+                previous.status !== installation.status ||
+                previous.release.artifact.artifactDigest !==
+                    installation.release.artifact.artifactDigest))
+            if ((await resolveBackend(r2ArtifactStore(this.env.RELEASES), previous.release)) !== null) {
+                if (expectedAuthorityVersion !== undefined &&
+                    this.get(installation.installationId)?.authorityVersion !==
+                        expectedAuthorityVersion)
+                    throw new AppInstanceError("stale_authority");
+                await this.env.INSTANCES.getByName(previous.instanceId).revoke(previous.installationId, undefined, tenantId);
+            }
+        this.ctx.storage.transactionSync(() => {
+            const current = this.get(installation.installationId);
+            if (expectedAuthorityVersion !== undefined &&
+                current?.authorityVersion !== expectedAuthorityVersion)
+                throw new AppInstanceError("stale_authority");
+            if ((current === null ? null : encode(current)) !== previousRecord)
+                throw new AppInstanceError("stale_authority");
+            this.ctx.storage.sql.exec("INSERT INTO installations(installation_id, record) VALUES(?,?) ON CONFLICT(installation_id) DO UPDATE SET record=excluded.record", installation.installationId, record);
+            if (installation.status === "deleted")
+                this.#rootData.storage.purgeInstallation(`installation:${installation.installationId}`);
+        });
+    }
+    decode(row) {
+        const { record } = Schema.decodeUnknownSync(recordRow)(row);
+        return installationSchema.parse(JSON.parse(record));
+    }
+}
+const releaseRow = Schema.Struct({ release: Schema.String });
+/**
+ * Settle one Instance operation for its host. An unexpected failure is logged
+ * here, beside the error object, because only its closed class crosses RPC.
+ */
+function result(run) {
+    return Effect.runPromise(Effect.match(run, {
+        onSuccess: (value) => ({ ok: true, value }),
+        onFailure: (error) => {
+            if (error instanceof AppInstanceError)
+                return {
+                    ok: false,
+                    causeClass: causeClass(error),
+                    code: error.code,
+                };
+            const diagnostic = failureDiagnostic(error);
+            console.error("AppInstance failure", {
+                stage: "instance_operation",
+                code: "failed",
+                ...diagnostic,
+            });
+            return {
+                ok: false,
+                causeClass: diagnostic.causeClass,
+                code: "failed",
+            };
+        },
+    }));
+}
+/**
+ * The one guest binding entrypoint over `table`. Every binding in a frame is
+ * this export with its own props; each packet returns to its originating
+ * Instance, which serves it from the same table.
+ */
+export function oysterBindingEntrypoint(table) {
+    return frameBindingEntrypoint(Object.fromEntries(Object.values(appBackendBindingKinds).flatMap(({ name }) => {
+        const row = table[name];
+        return row === undefined ? [] : [[name, row.methods]];
+    })), (env, props, method, args) => env.INSTANCES.getByName(props.instanceId).bindingCall(props, method, args));
+}
+const registryOf = (context) => context.env.REGISTRY.getByName(context.scope().durableName("registry"));
+/** The plain Oyster host's bindings: App storage, the read-only catalog and replay admission. */
+export const oysterBindings = {
+    APP_STORAGE: {
+        methods: storageFrameMethods.APP_STORAGE,
+        dispatch: (context, frame, _props, method, args) => registryOf(context).storageBackend(frame.facts, method, args, context.scope().tenantId),
+    },
+    APPS: {
+        methods: catalogFrameMethods.APPS,
+        async dispatch(context, frame) {
+            if (frame.host.declaration?.capabilities.includes("team.workbenchHost") !==
+                true)
+                throw new AppInstanceError("revoked");
+            const catalog = oysterAppCatalog(await registryOf(context).directory());
+            frame.signal.throwIfAborted();
+            return catalog;
+        },
+    },
+    BACKGROUND: {
+        methods: backgroundFrameMethods.BACKGROUND,
+        async dispatch(context, frame, _props, _method, [origin]) {
+            const host = await context.backgroundHost();
+            frame.signal.throwIfAborted();
+            if (host?.backgroundOriginKey === undefined)
+                return { kind: "refused", code: "access_changed" };
+            const key = await host.backgroundOriginKey();
+            frame.signal.throwIfAborted();
+            const decision = await admitBackgroundFrame(key, frame, origin);
+            frame.signal.throwIfAborted();
+            return decision;
+        },
+    },
+};
+/** The plain Oyster Worker's guest binding entrypoint. */
+export class OysterBinding extends oysterBindingEntrypoint(oysterBindings) {
+}
+/** One host-facing handle over an Instance, pinned to `scope` and `budget`. */
+function instanceHandle(target, scope, budget) {
+    const { tenantId, origin } = scope;
+    return {
+        apply: (state, release) => target.apply(state, release, budget, { tenantId, origin }),
+        fetch: (facts, request) => target.backend(facts, request, budget, tenantId),
+        call: async (facts, api, name, input) => {
+            const reply = await target.call(facts, api, name, input, budget, tenantId);
+            return reply.ok
+                ? { ok: true, value: appMethodReplySchema.parse(reply.value) }
+                : reply;
+        },
+        gill: async (facts, api, source, input) => {
+            const reply = await target.gill(facts, api, source, input, budget, tenantId);
+            return reply.ok
+                ? { ok: true, value: decodeGillReply(reply.value) }
+                : reply;
+        },
+        authorizeGitPush: (facts, question) => target.authorizeGitPush(facts, question, budget, tenantId),
+        onGitPush: (facts, fact) => target.onGitPush(facts, fact, budget, tenantId),
+        syncRefused: (facts, refusal) => target.syncRefused(facts, refusal, budget, tenantId),
+    };
+}
+/**
+ * One App Instance: Oyster's lifecycle supervisor in this Durable Object's
+ * SQLite and the App backend in its `app` facet.
+ */
+export class OysterInstance extends DurableObject {
+    /** The bindings this Instance serves; a root's Instance names its own table. */
+    bindings = oysterBindings;
+    /** Stable per Instance; binding rows read the env, pin and root host through it. */
+    #bindingContext;
+    runtime;
+    limits = guestLimits();
+    frames;
+    /** Content-addressed backends are verified once per Instance, not per call. */
+    backends;
+    gitJournal;
+    constructor(ctx, env) {
+        super(ctx, env);
+        ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS oyster_releases (release_id TEXT PRIMARY KEY, release TEXT NOT NULL) STRICT");
+        ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS oyster_owner (id INTEGER PRIMARY KEY CHECK (id = 1), installation_id TEXT NOT NULL) STRICT");
+        ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS oyster_tenant (id INTEGER PRIMARY KEY CHECK (id = 1), tenant_id TEXT NOT NULL, origin TEXT NOT NULL) STRICT");
+        this.#bindingContext = {
+            env,
+            scope: () => this.scope(),
+            backgroundHost: () => this.backgroundHost(),
+        };
+        this.backends = backendCache(r2ArtifactStore(env.RELEASES));
+        this.runtime = this.createRuntime(this.limits);
+        this.frames = createCloudflareInvocationGate(ctx, (frame) => this.closeBackground(frame));
+        // Local delivery avoids calling this Instance's own RPC stub from its alarm.
+        const instances = {
+            get: (instanceId) => this.localInstance(instanceId),
+        };
+        this.gitJournal = ctx.blockConcurrencyWhile(() => createGitPushJournal({
+            owner: ctx.storage,
+            deliver: (installationId, fact) => deliverGitPush({
+                artifacts: r2ArtifactStore(env.RELEASES),
+                installations: registryInstallations(env, this.scope()),
+                guestLimits: this.limits,
+                instances,
+            }, installationId, fact),
+            deliverSync: async (wake) => {
+                const host = await this.backgroundHost();
+                if (host === null)
+                    return "refused";
+                const result = await deliverBackground({ ...host, instances }, wake);
+                if (result.more) {
+                    const { installationId, actor, lane, originMethod, observed } = wake;
+                    await (await this.gitJournal).armSync({
+                        installationId,
+                        actor,
+                        lane,
+                        originMethod,
+                        observed,
+                    });
+                }
+                return {
+                    status: result.status,
+                    receipt: { lane: wake.lane, epoch: wake.epoch },
+                };
+            },
+            scheduleWake: (at) => ctx.storage.transaction(async (transaction) => {
+                const current = await transaction.getAlarm();
+                if (current === null || at < current)
+                    await transaction.setAlarm(at);
+            }),
+        }));
+    }
+    /** The deployable root's host for one pinned tenant; this plain root is the single owner key. */
+    hostFor(scope) {
+        return ownerKeyRootHost(this.env, { scope });
+    }
+    /** Reconstruct current host admission for each wake; non-default tenants get no wakes. */
+    backgroundHost() {
+        if (!Schema.is(Schema.NonEmptyString)(this.env.OYSTER_OWNER_KEY))
+            return Promise.resolve(null);
+        const scope = this.scope();
+        if (scope.tenantId !== defaultTenant)
+            return Promise.resolve(null);
+        return Promise.resolve(this.hostFor(scope));
+    }
+    localInstance(instanceId) {
+        if (instanceId !== this.ctx.id.name)
+            throw new AppInstanceError("instance_identity_mismatch");
+        return instanceHandle(this, this.scope(), undefined);
+    }
+    async closeBackground(frame) {
+        const { subject } = frame.facts;
+        if (subject.kind !== "call" ||
+            subject.replay !== undefined ||
+            subject.method?.effect !== "write" ||
+            subject.context.backgroundLane === undefined ||
+            !mayDefer(subject.context, frame.facts.ancestry) ||
+            frame.host.declaration?.backend?.sync === undefined)
+            return;
+        if (subject.context.actor.kind !== "member" ||
+            subject.context.backgroundLane !== actorLane(subject.context.actor))
+            throw new AppInstanceError("invalid_invocation_facts");
+        await (await this.gitJournal).armSync({
+            installationId: frame.facts.selection.owner.id,
+            actor: subject.context.actor,
+            lane: subject.context.backgroundLane,
+            originMethod: subject.method.name,
+            observed: {
+                authorityVersion: frame.facts.selection.authorityVersion,
+                artifactDigest: frame.facts.artifactDigest,
+            },
+        });
+    }
+    createRuntime(limits) {
+        return createCloudflareAppInstance(this.ctx, this.env.LOADER, (releaseId, scope) => Effect.tryPromise({
+            try: async () => {
+                if (scope.kind === "invocation")
+                    return scope.frame.host.artifact;
+                const release = this.release(releaseId);
+                const resolved = await this.backends(release);
+                if (resolved === null)
+                    throw new Error("Release has no backend");
+                return { release, ...resolved };
+            },
+            catch: (cause) => cause instanceof Error ? cause : new Error("Release unavailable"),
+        }), (frame) => this.guestEnv(frame), limits);
+    }
+    runtimeFor(input) {
+        const limits = guestLimits(input);
+        if (limits.cpuMs !== this.limits.cpuMs ||
+            limits.subRequests !== this.limits.subRequests) {
+            // Supervisor/frame admission owns the permit here. The previous frame's
+            // facet is already aborted before a new budget can select its runtime.
+            this.runtime = this.createRuntime(limits);
+            this.limits = limits;
+        }
+        return this.runtime;
+    }
+    /** The tenant this Instance's host pinned at its first apply; never its guest frame. */
+    scope() {
+        const row = this.ctx.storage.sql
+            .exec("SELECT tenant_id, origin FROM oyster_tenant WHERE id = 1")
+            .toArray()[0];
+        if (row === undefined)
+            throw new AppInstanceError("installation_tenant_mismatch");
+        const pin = Schema.decodeUnknownSync(Schema.Struct({ tenant_id: tenantIdSchema, origin: Schema.String }))(row);
+        return tenantScope(pin.tenant_id, pin.origin);
+    }
+    requireTenant(tenantId) {
+        if (this.scope().tenantId !== tenantId)
+            throw new AppInstanceError("installation_tenant_mismatch");
+    }
+    /** The installation this Instance serves, once an owner state named it. */
+    installationId() {
+        const row = this.ctx.storage.sql
+            .exec("SELECT installation_id FROM oyster_owner WHERE id = 1")
+            .toArray()[0];
+        return row?.installation_id ?? null;
+    }
+    /** Every binding name is the one entrypoint, routed by props; authority is checked per packet. */
+    guestEnv(frame) {
+        if (frame.facts.instanceId !== this.ctx.id.name)
+            throw new AppInstanceError("instance_identity_mismatch");
+        return Object.fromEntries(Object.values(appBackendBindingKinds).map(({ name: binding }) => [
+            binding,
+            this.ctx.exports.OysterBinding({
+                props: {
+                    instanceId: frame.facts.instanceId,
+                    binding,
+                    frameId: frame.frameId,
+                },
+            }),
+        ]));
+    }
+    /** Resolve each guest packet against its immutable frame before any host effect. */
+    async bindingCall(raw, method, input) {
+        return captureFrameBindingReply(() => this.executeBindingCall(raw, method, input));
+    }
+    async executeBindingCall(raw, method, input) {
+        const props = decodeFrameBindingProps(raw);
+        const frame = this.frames.active();
+        if (props.instanceId !== frame.facts.instanceId ||
+            props.frameId !== frame.frameId)
+            throw new AppInstanceError("revoked");
+        assertBackgroundBinding(frame, props.binding);
+        // A guest packet is its own entry: exactly one registry read re-admits it.
+        await this.assertCurrent(frame);
+        const row = this.bindings[props.binding];
+        const descriptor = row?.methods[method];
+        // Operations declared by the verified Release; absent bindings grant nothing.
+        const granted = frame.facts.grants.find((grant) => grant.binding === props.binding)
+            ?.operations ?? [];
+        if (granted.length === 0)
+            throw new AppInstanceError("binding_not_granted");
+        if (row === undefined || descriptor === undefined) {
+            const nativeGitMethod = props.binding === "GIT"
+                ? nativeGitMethodNameSchema.safeParse(method)
+                : null;
+            const required = nativeGitMethod?.success
+                ? nativeGitFrameMethods[nativeGitMethod.data].requiredOperations(input)
+                : [method];
+            if (!required.every((operation) => granted.includes(operation)))
+                throw new AppInstanceError("binding_not_granted");
+            throw new AppInstanceError("binding_unavailable");
+        }
+        const args = descriptor.decodeArgs(input);
+        if (!descriptor
+            .requiredOperations(args)
+            .every((operation) => granted.includes(operation)))
+            throw new AppInstanceError("binding_not_granted");
+        const result = await row.dispatch(this.#bindingContext, frame, props, method, args);
+        if (this.frames.active() !== frame)
+            throw new AppInstanceError("revoked");
+        assertBackgroundBinding(frame, props.binding);
+        return descriptor.decodeResult(result);
+    }
+    /** Last provider-accepted ref recorded by this installation's journal. */
+    async gitTip(installationId, repository, ref, tenantId = defaultTenant) {
+        this.requireTenant(tenantId);
+        if (installationId !== this.installationId())
+            throw new AppInstanceError("instance_owner_mismatch");
+        return (await this.gitJournal).tip(installationId, repository, ref);
+    }
+    /** Join accepted fact identity and Carrier delivery in one local transaction. */
+    async recordGitPush(installationId, fact, tenantId = defaultTenant) {
+        this.requireTenant(tenantId);
+        if (installationId !== this.installationId())
+            throw new AppInstanceError("instance_owner_mismatch");
+        return (await this.gitJournal).accept(installationId, fact);
+    }
+    /** Carrier owns retries, dead letters and retained delivery receipts. */
+    async alarm() {
+        await (await this.gitJournal).alarm();
+    }
+    /** Installation changes end guest work; a Workflow cancel targets only its run. */
+    async revoke(installationId, runId, tenantId = defaultTenant) {
+        this.requireTenant(tenantId);
+        if (installationId !== this.installationId())
+            throw new AppInstanceError("instance_owner_mismatch");
+        await this.frames.revoke(new AppInstanceError("revoked"), runId === undefined ? undefined : { runId });
+    }
+    /** One registry read re-admits a guest binding packet against its frame. */
+    async assertCurrent(frame) {
+        frame.signal.throwIfAborted();
+        const selected = frame.facts.selection;
+        const current = await this.env.REGISTRY.getByName(this.scope().durableName("registry")).get(selected.owner.id);
+        frame.signal.throwIfAborted();
+        if (current === null ||
+            "kind" in current ||
+            current.status !== "enabled" ||
+            current.instanceId !== selected.instanceId ||
+            current.authorityVersion !== selected.authorityVersion ||
+            current.release.releaseId !== selected.releaseId ||
+            current.release.artifact.artifactDigest !==
+                frame.host.artifact.release.artifact.artifactDigest)
+            throw new AppInstanceError("revoked");
+        const approved = approvedBindingGrants(current, frame.host.declaration ?? emptyAppDeclaration);
+        if (frame.facts.grants.some((grant) => grant.binding !== "BACKGROUND" &&
+            grant.operations.some((operation) => approved
+                .find((currentGrant) => currentGrant.binding === grant.binding)
+                ?.operations.includes(operation) !== true)))
+            throw new AppInstanceError("revoked");
+    }
+    async withFrame(raw, limits, work, tenantId = defaultTenant, methodName) {
+        this.requireTenant(tenantId);
+        const facts = Schema.decodeUnknownSync(invocationFactsSchema, {
+            onExcessProperty: "error",
+        })(raw);
+        if (facts.instanceId !== this.ctx.id.name ||
+            facts.selection.owner.kind !== "installation" ||
+            facts.selection.owner.id !== this.installationId())
+            throw new AppInstanceError("instance_identity_mismatch");
+        const release = this.release(facts.selection.releaseId);
+        const resolved = await this.backends(release);
+        if (resolved?.digest !== facts.artifactDigest)
+            throw new AppInstanceError("invalid_invocation_facts");
+        if (facts.subject.kind === "call" &&
+            facts.subject.method !== undefined &&
+            resolved.declaration?.api?.methods[facts.subject.method.name]?.effect !==
+                facts.subject.method.effect)
+            throw new AppInstanceError("invalid_invocation_facts");
+        const bindings = resolved.declaration?.backend?.bindings ?? [];
+        if (facts.grants.some((grant) => {
+            if (grant.binding === "BACKGROUND")
+                return false;
+            const declared = bindings.find((binding) => binding.name === grant.binding);
+            return (declared === undefined ||
+                grant.operations.some((operation) => !declared.operations.includes(operation)));
+        }))
+            throw new AppInstanceError("invalid_invocation_facts");
+        let scoped = facts;
+        if (methodName !== undefined) {
+            const api = resolved.declaration?.api;
+            if (facts.subject.kind !== "call" ||
+                !api ||
+                !Object.hasOwn(api.methods, methodName))
+                throw new AppInstanceError("invalid_invocation_facts");
+            const method = api.methods[methodName];
+            if (method === undefined)
+                throw new AppInstanceError("invalid_invocation_facts");
+            scoped = {
+                ...facts,
+                grants: [
+                    ...scopedBindings(facts.grants.filter((grant) => grant.binding !== "BACKGROUND"), method),
+                    ...facts.grants.filter((grant) => grant.binding === "BACKGROUND"),
+                ],
+            };
+        }
+        let host = {
+            artifact: { release, ...resolved },
+            declaration: resolved.declaration,
+            origin: "unchecked",
+        };
+        if (methodName !== undefined)
+            host = { ...host, method: Object.freeze({ name: methodName }) };
+        // Facts carry the authority admitted at the request's top. The Instance
+        // checks them against the owner state the host applied to it, never by
+        // calling back up to the registry.
+        return this.frames.run(scoped, host, (frame) => work(this.runtimeFor(limits), frame));
+    }
+    release(releaseId) {
+        const row = this.ctx.storage.sql
+            .exec("SELECT release FROM oyster_releases WHERE release_id=?", releaseId)
+            .toArray()[0];
+        if (row === undefined)
+            throw new Error("Release unknown to this Instance");
+        return Schema.decodeUnknownSync(Schema.fromJsonString(releaseSchema))(Schema.decodeUnknownSync(releaseRow)(row).release);
+    }
+    /** Remember `release`, then apply the owner state under the host's tenant pin. */
+    async apply(state, release, limits, tenant) {
+        const selected = tenantScope(Schema.decodeUnknownSync(tenantIdSchema)(tenant.tenantId), tenant.origin);
+        const checkTenant = () => {
+            const stored = this.ctx.storage.sql
+                .exec("SELECT tenant_id, origin FROM oyster_tenant WHERE id = 1")
+                .toArray()[0];
+            if (stored === undefined) {
+                if (this.installationId() !== null)
+                    throw new AppInstanceError("installation_tenant_mismatch");
+                return;
+            }
+            const pin = this.scope();
+            if (pin.tenantId !== selected.tenantId || pin.origin !== selected.origin)
+                throw new AppInstanceError("installation_tenant_mismatch");
+        };
+        checkTenant();
+        await this.frames.revoke();
+        return this.frames.exclusive(async () => {
+            checkTenant();
+            this.ctx.storage.sql.exec("INSERT INTO oyster_releases(release_id, release) VALUES(?,?) ON CONFLICT(release_id) DO NOTHING", release.releaseId, Schema.encodeUnknownSync(Schema.fromJsonString(releaseSchema))(release));
+            const applied = await result(this.runtimeFor(limits).apply(state));
+            if (applied.ok) {
+                this.ctx.storage.sql.exec("INSERT INTO oyster_tenant (id, tenant_id, origin) VALUES (1, ?, ?) ON CONFLICT(id) DO NOTHING", selected.tenantId, selected.origin);
+                this.ctx.storage.sql.exec("INSERT INTO oyster_owner (id, installation_id) VALUES (1, ?) ON CONFLICT(id) DO UPDATE SET installation_id = excluded.installation_id", state.owner.id);
+            }
+            return applied;
+        });
+    }
+    /** Forward an admitted HTTP request to the App backend. */
+    async backend(facts, request, limits, tenantId = defaultTenant) {
+        try {
+            return await this.withFrame(facts, limits, (runtime, frame) => Effect.runPromise(runtime.fetch(frame, request)), tenantId);
+        }
+        catch (error) {
+            return Response.json({ error: error instanceof AppInstanceError ? error.code : "failed" }, { status: error instanceof AppInstanceError ? 403 : 502 });
+        }
+    }
+    /** Deliver a Git push through the same selected-Instance admission as methods. */
+    onGitPush(facts, fact, limits, tenantId = defaultTenant) {
+        return this.withFrame(facts, limits, (runtime, frame) => Effect.runPromise(runtime.onGitPush(frame, fact)), tenantId);
+    }
+    /** Ask the App's declared authorizer through the same frame-bound connection. */
+    authorizeGitPush(facts, question, limits, tenantId = defaultTenant) {
+        return this.withFrame(facts, limits, (runtime, frame) => Effect.runPromise(runtime.authorizeGitPush(frame, question)), tenantId);
+    }
+    /** An available lane settles a refusal under an active frame with no binding grants. */
+    syncRefused(facts, refusal, limits, tenantId = defaultTenant) {
+        return this.withFrame(facts, limits, (runtime, frame) => Effect.runPromise(runtime.syncRefused(frame, refusal)), tenantId);
+    }
+    /** Invoke a Release-declared Gill in a fresh immutable frame. */
+    gill(facts, _api, source, input, limits, tenantId = defaultTenant) {
+        return result(Effect.tryPromise({
+            try: () => this.withFrame(facts, limits, (runtime, frame) => {
+                const api = frame.host.declaration?.api;
+                if (!api || api.methods[source]?.effect !== "read")
+                    throw new AppInstanceError("invalid_invocation_facts");
+                return Effect.runPromise(runtime.gill(frame, api, source, input));
+            }, tenantId, source),
+            catch: (cause) => cause instanceof Error
+                ? cause
+                : new Error("Gill invocation failed", { cause }),
+        }));
+    }
+    /** Invoke one declared App method; the value is its AppMethodReply wire,
+     * which the host handle decodes. */
+    call(facts, _api, name, input, limits, tenantId = defaultTenant) {
+        return result(Effect.tryPromise({
+            try: () => this.withFrame(facts, limits, (runtime, frame) => {
+                const api = frame.host.declaration?.api;
+                if (!api)
+                    throw new AppInstanceError("invalid_invocation_facts");
+                return Effect.runPromise(runtime.call(frame, api, name, input));
+            }, tenantId, name),
+            catch: (cause) => cause instanceof Error
+                ? cause
+                : new Error("App invocation failed", { cause }),
+        }));
+    }
+}
+/** Host adapters for a standalone Oyster Worker over its own bindings. */
+export function oysterWorkerHost(env, auth, options = {}) {
+    const scope = options.scope ?? tenantScope(defaultTenant, env.OYSTER_ORIGIN);
+    const registry = () => env.REGISTRY.getByName(scope.durableName("registry"));
+    const installations = registryInstallations(env, scope);
+    const originSecret = Schema.decodeUnknownOption(Schema.NonEmptyString)(env.OYSTER_OWNER_KEY);
+    let host = {
+        auth,
+        workbench: {
+            directory: async () => {
+                await installations.list();
+                return registry().directory();
+            },
+            storage: (installationId, ownerId) => ({
+                read: (key) => registry().storageRead(installationId, ownerId, key),
+                write: (input) => registry().storageWrite(installationId, ownerId, input),
+                reset: (input) => registry().storageReset(installationId, ownerId, input),
+                events: (key) => registry().storageEvents(installationId, ownerId, key),
+            }),
+        },
+        guestLimits: guestLimits(options.guestLimits),
+        artifacts: r2ArtifactStore(env.RELEASES),
+        // File-only hosts may keep workspace files beside their Release artifacts.
+        capabilities: fileCapabilities(options.workspace?.files ??
+            r2FileSource(env.RELEASES, scope.workspacePrefix)),
+        installations,
+        instances: {
+            get: (instanceId, limits) => instanceHandle(env.INSTANCES.getByName(instanceId), scope, guestLimits(limits)),
+        },
+    };
+    if (originSecret._tag === "Some")
+        host = {
+            ...host,
+            backgroundOriginKey: () => backgroundOriginKey(originSecret.value),
+        };
+    if (options.workspace !== undefined)
+        host = { ...host, computerId: options.workspace.computerId };
+    if (options.workspace?.computer !== undefined)
+        host = { ...host, computer: options.workspace.computer };
+    if (options.appToolPolicy !== undefined)
+        host = { ...host, appToolPolicy: options.appToolPolicy };
+    return {
+        ...host,
+        mcp: {
+            handleRequest: (request) => remoteOysterMcp(env.MCP, scope).handleRequest(request),
+        },
+    };
+}
+/**
+ * The non-git standalone root: the single owner key over the default tenant's
+ * stores. Its HTTP Worker, MCP owner and background wakes all compose here.
+ */
+function ownerKeyRootHost(env, options) {
+    return oysterWorkerHost(env, ownerKeyAuth(env.OYSTER_OWNER_KEY), options);
+}
+/** The non-git standalone root's MCP owner. */
+export class OysterMcp extends createOysterMcpOwner((env, scope) => ownerKeyRootHost(env, { scope })) {
+}
+/**
+ * The standalone Worker's `fetch` handler; frontend hosts are cached per env.
+ * MCP transports belong to the tenant Durable Object, independent of that cache.
+ */
+export function createOysterWorker(options = {}) {
+    const limits = guestLimits(options.guestLimits);
+    const apps = new WeakMap();
+    return {
+        fetch(request, env) {
+            let app = apps.get(env);
+            if (app === undefined) {
+                app = createOyster(ownerKeyRootHost(env, { guestLimits: limits }));
+                apps.set(env, app);
+            }
+            return app.fetch(request);
+        },
+    };
+}