@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/docs/api/invocation.md

@@ -0,0 +1,738 @@
+<!-- Generated by Botanical API docs (TypeDoc + typedoc-plugin-markdown). Do not edit. -->
+
+[**@fungi.computer/oyster**](README.md)
+
+---
+
+[@fungi.computer/oyster](modules.md) / invocation
+
+# invocation
+
+## Type Aliases
+
+### InvocationFacts
+
+```ts
+type InvocationFacts = typeof invocationFactsSchema.Type;
+```
+
+The immutable authority and attribution supplied at host admission.
+
+---
+
+### InvocationMethod
+
+```ts
+type InvocationMethod = NonNullable<
+  Extract<
+    InvocationFacts["subject"],
+    {
+      kind: "call";
+    }
+  >["method"]
+>;
+```
+
+Method name/effect taken from a verified API; raw backend requests have no
+method.
+
+---
+
+### InvocationAgentPolicy
+
+```ts
+type InvocationAgentPolicy = NonNullable<
+  Extract<
+    InvocationFacts["subject"],
+    {
+      kind: "call";
+    }
+  >["agentPolicy"]
+>;
+```
+
+Captured policy identity; the Agent id remains on the canonical call actor.
+
+---
+
+### InvocationFrame
+
+```ts
+type InvocationFrame<Host> = Readonly<{
+  frameId: string;
+  facts: InvocationFacts;
+  host: Host;
+  signal: AbortSignal;
+}>;
+```
+
+A live frame stays inside its Instance; host state and signals never cross RPC.
+
+#### Type Parameters
+
+| Type Parameter | Default type |
+| -------------- | ------------ |
+| `Host`         | `unknown`    |
+
+---
+
+### BackgroundFrameState
+
+```ts
+type BackgroundFrameState = object;
+```
+
+One mutable origin latch on the host state of one invocation, never shared
+across frames.
+
+#### Properties
+
+##### origin
+
+```ts
+origin: "unchecked" | "admitted" | "refused";
+```
+
+This frame's one claimed-origin decision; never carried into another frame.
+
+---
+
+### InvocationGatePorts
+
+```ts
+type InvocationGatePorts<Host> = Readonly<{
+  abortGuest: () => Promise<void>;
+  close: (frame) => Promise<void>;
+  now?: () => number;
+}>;
+```
+
+The host's native guest-abort and authority-close hooks.
+
+#### Type Parameters
+
+| Type Parameter |
+| -------------- |
+| `Host`         |
+
+---
+
+### InvocationGate
+
+```ts
+type InvocationGate<Host> = Readonly<{
+  run: <A>(facts, host, work) => Promise<A>;
+  active: () => InvocationFrame<Host>;
+  revoke: (reason?, target?) => Promise<void>;
+  exclusive: <A>(work) => Promise<A>;
+}>;
+```
+
+One invocation owner shared by Hub shards and standalone Instances.
+
+#### Type Parameters
+
+| Type Parameter |
+| -------------- |
+| `Host`         |
+
+---
+
+### InvocationAuthority
+
+```ts
+type InvocationAuthority = Omit<InvocationFacts, "subject" | "deadlineAt">;
+```
+
+Verified selection, artifact and binding grants before caller attribution.
+
+---
+
+### InvocationDeadline
+
+```ts
+type InvocationDeadline = Readonly<{
+  deadlineAt: number;
+  grantExpiresAt: number;
+}>;
+```
+
+The host supplies both deadlines; the frame cannot outlive either.
+
+## Variables
+
+### APP\_INVOCATION\_CEILING\_MS
+
+```ts
+const APP_INVOCATION_CEILING_MS: 60000 = 60_000;
+```
+
+One App invocation may hold authority for at most the Hub grant's lifetime.
+
+---
+
+### invocationFactsSchema
+
+```ts
+const invocationFactsSchema: Struct<{
+  instanceId: Codec<InstanceId, string, never, never>;
+  selection: Struct<{
+     instanceId: Codec<InstanceId, string, never, never>;
+     owner: Struct<{
+        kind: Literals<readonly ["installation", "deployment"]>;
+        id: NonEmptyString;
+     }>;
+     appId: refine<AppId, String>;
+     releaseId: refine<ReleaseId, String>;
+     authorityVersion: Number;
+  }>;
+  artifactDigest: refine<Sha256Digest, String>;
+  subject: Union<readonly [Struct<{
+     kind: Literal<"call">;
+     context: declareConstructor<{
+        computerId: string | null;
+        actor:   | {
+           kind: "member";
+           memberId: string;
+         }
+           | {
+           kind: "agent";
+           agentId: string;
+         }
+           | {
+           kind: "team-key";
+           keyId: string;
+         };
+        backgroundLane?: string;
+        backgroundOrigin?: {
+           method: string;
+           seal: string;
+        };
+        role?: "member" | "owner";
+        soleMember?: true;
+        workflow?: {
+           workflowId: string;
+           runId: string;
+           nodeId: string;
+           armedBy: ... | ... | ...;
+        };
+        idempotencyKey?: string;
+      }, {
+        computerId: string | null;
+        actor:   | {
+           kind: "member";
+           memberId: string;
+         }
+           | {
+           kind: "agent";
+           agentId: string;
+         }
+           | {
+           kind: "team-key";
+           keyId: string;
+         };
+        backgroundLane?: string;
+        backgroundOrigin?: {
+           method: string;
+           seal: string;
+        };
+        role?: "member" | "owner";
+        soleMember?: true;
+        workflow?: {
+           workflowId: string;
+           runId: string;
+           nodeId: string;
+           armedBy: ... | ... | ...;
+        };
+        idempotencyKey?: string;
+      }, readonly [], {
+        computerId: string | null;
+        actor:   | {
+           kind: "member";
+           memberId: string;
+         }
+           | {
+           kind: "agent";
+           agentId: string;
+         }
+           | {
+           kind: "team-key";
+           keyId: string;
+         };
+        backgroundLane?: string;
+        backgroundOrigin?: {
+           method: string;
+           seal: string;
+        };
+        role?: "member" | "owner";
+        soleMember?: true;
+        workflow?: {
+           workflowId: string;
+           runId: string;
+           nodeId: string;
+           armedBy: ... | ... | ...;
+        };
+        idempotencyKey?: string;
+     }>;
+     sessionId: optionalKey<String>;
+     agentPolicy: optionalKey<Struct<{
+        policyRevision: NonEmptyString;
+        grantorMemberId: NonEmptyString;
+     }>>;
+     method: optionalKey<Struct<{
+        name: String;
+        effect: Literals<readonly [..., ..., ...]>;
+     }>>;
+     replay: optionalKey<Struct<{
+        lane: NonEmptyString;
+        epoch: Number;
+        admitted: $Array<String>;
+     }>>;
+   }>, Struct<{
+     kind: Literal<"lifecycle">;
+     name: Literal<"onGitPush">;
+     eventId: NonEmptyString;
+   }>, Struct<{
+     kind: Literal<"lifecycle">;
+     name: Literal<"syncRefused">;
+     lane: String;
+     code: Literals<("access_changed" | "installation_unavailable")[]>;
+  }>]>;
+  grants: $Array<Struct<{
+     binding: refine<
+        | "BACKGROUND"
+        | "GIT"
+        | "EVENTS"
+        | "APPS"
+        | "WORKFLOWS"
+        | "APP_STORAGE"
+        | "MEDIA"
+        | "COMPUTER"
+        | "INBOX"
+       | "AGENTS", String>;
+     operations: $Array<NonEmptyString>;
+  }>>;
+  deadlineAt: Number;
+  ancestry: $Array<Codec<InstanceId, string, never, never>>;
+}>;
+```
+
+Host-admitted facts; shape decoding does not establish host authority.
+
+---
+
+### invocationFrameIdSchema
+
+```ts
+const invocationFrameIdSchema: String;
+```
+
+Decode only identities minted from the invocation-frame ID family.
+
+---
+
+### invocationFacts
+
+```ts
+const invocationFacts: object;
+```
+
+Shared host-held caller/Workflow fact builders, never guest argument decoders.
+
+#### Type Declaration
+
+| Name                                                        | Type                                                                                      | Description                                                                     |
+| ----------------------------------------------------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
+| <a id="property-fromcaller"></a> `fromCaller()`             | (`authority`, `context`, `deadline`, `method?`, `sessionId?`, `agentPolicy?`) => `object` | Combine host-admitted caller facts with the invocation and grant deadlines.     |
+| <a id="property-fromworkflownode"></a> `fromWorkflowNode()` | (`authority`, `input`, `deadline`) => `object`                                            | Attribute an already host-admitted published node to its retained arming actor. |
+
+## Functions
+
+### assertBackgroundBinding()
+
+```ts
+function assertBackgroundBinding(frame, binding): void;
+```
+
+Block replay capability effects before job-origin admission; storage permits
+claiming/settling.
+
+#### Parameters
+
+| Parameter | Type                                                                                                                                               |
+| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `frame`   | [`InvocationFrame`](#invocationframe)\<[`BackgroundFrameState`](#backgroundframestate)\>                                                           |
+| `binding` | \| `"BACKGROUND"` \| `"GIT"` \| `"EVENTS"` \| `"APPS"` \| `"WORKFLOWS"` \| `"APP_STORAGE"` \| `"MEDIA"` \| `"COMPUTER"` \| `"INBOX"` \| `"AGENTS"` |
+
+#### Returns
+
+`void`
+
+---
+
+### admitBackgroundFrame()
+
+```ts
+function admitBackgroundFrame(
+  key,
+  frame,
+  raw,
+): Promise<
+  | {
+      kind: "admitted";
+    }
+  | {
+      kind: "refused";
+      code: "access_changed";
+    }
+>;
+```
+
+Consume this frame's one origin check before awaiting verification, then retain
+only its decision.
+
+#### Parameters
+
+| Parameter | Type                                                                                     |
+| --------- | ---------------------------------------------------------------------------------------- |
+| `key`     | `CryptoKey`                                                                              |
+| `frame`   | [`InvocationFrame`](#invocationframe)\<[`BackgroundFrameState`](#backgroundframestate)\> |
+| `raw`     | `unknown`                                                                                |
+
+#### Returns
+
+`Promise`\< \| \{ `kind`: `"admitted"`; \} \| \{ `kind`: `"refused"`; `code`:
+`"access_changed"`; \}\>
+
+---
+
+### createInvocationGate()
+
+```ts
+function createInvocationGate<Host>(ports): InvocationGate<Host>;
+```
+
+Serialize authority, preempt replay only for verified writes, and close each
+guest before admission.
+
+#### Type Parameters
+
+| Type Parameter |
+| -------------- |
+| `Host`         |
+
+#### Parameters
+
+| Parameter | Type                                                    |
+| --------- | ------------------------------------------------------- |
+| `ports`   | [`InvocationGatePorts`](#invocationgateports)\<`Host`\> |
+
+#### Returns
+
+[`InvocationGate`](#invocationgate)\<`Host`\>
+
+---
+
+### invocationCallerContext()
+
+```ts
+function invocationCallerContext(principal, computerId): object;
+```
+
+Project an admitted principal into App attribution; only the host chooses the
+fixed Computer context. The App caller grammar has no visitor actor, so the
+anonymous public reader is attributed as the reserved `visitor` key without a
+Computer. Host admission reads the principal, never this projection.
+
+#### Parameters
+
+| Parameter    | Type                                         |
+| ------------ | -------------------------------------------- |
+| `principal`  | [`OysterPrincipal`](host.md#oysterprincipal) |
+| `computerId` | `string` \| `null`                           |
+
+#### Returns
+
+`object`
+
+| Name                      | Type                                                                                                                                                  |
+| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `computerId`              | `string` \| `null`                                                                                                                                    |
+| `actor`                   | \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \} |
+| `backgroundLane?`         | `string`                                                                                                                                              |
+| `backgroundOrigin?`       | `object`                                                                                                                                              |
+| `backgroundOrigin.method` | `string`                                                                                                                                              |
+| `backgroundOrigin.seal`   | `string`                                                                                                                                              |
+| `role?`                   | `"member"` \| `"owner"`                                                                                                                               |
+| `soleMember?`             | `true`                                                                                                                                                |
+| `workflow?`               | `object`                                                                                                                                              |
+| `workflow.workflowId`     | `string`                                                                                                                                              |
+| `workflow.runId`          | `string`                                                                                                                                              |
+| `workflow.nodeId`         | `string`                                                                                                                                              |
+| `workflow.armedBy`        | \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \} |
+| `idempotencyKey?`         | `string`                                                                                                                                              |
+
+---
+
+### invocationAuthorityOf()
+
+```ts
+function invocationAuthorityOf(
+  installation,
+  release,
+  ancestry?,
+): InvocationAuthority;
+```
+
+Authority comes from the admitted installation and its verified backend bytes.
+
+#### Parameters
+
+| Parameter      | Type                                           | Default value |
+| -------------- | ---------------------------------------------- | ------------- |
+| `installation` | [`Installation`](apps.md#installation)         | `undefined`   |
+| `release`      | [`VerifiedRelease`](host.md#verifiedrelease)   | `undefined`   |
+| `ancestry`     | readonly [`InstanceId`](index.md#instanceid)[] | `[]`          |
+
+#### Returns
+
+[`InvocationAuthority`](#invocationauthority)
+
+---
+
+### admittedCallerFacts()
+
+```ts
+function admittedCallerFacts(
+  installation,
+  release,
+  context,
+  grants,
+  ancestry?,
+  sessionId?,
+  agentPolicy?,
+  method?,
+  origin?,
+): object;
+```
+
+Mint standalone facts only after host caller and Release admission.
+
+#### Parameters
+
+| Parameter                          | Type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Default value                          |
+| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- |
+| `installation`                     | [`Installation`](apps.md#installation)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `undefined`                            |
+| `release`                          | [`VerifiedRelease`](host.md#verifiedrelease)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `undefined`                            |
+| `context`                          | \{ `computerId`: `string` \| `null`; `actor`: \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}; `backgroundLane?`: `string`; `backgroundOrigin?`: \{ `method`: `string`; `seal`: `string`; \}; `role?`: `"member"` \| `"owner"`; `soleMember?`: `true`; `workflow?`: \{ `workflowId`: `string`; `runId`: `string`; `nodeId`: `string`; `armedBy`: \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}; \}; `idempotencyKey?`: `string`; \} | `undefined`                            |
+| `context.computerId`               | `string` \| `null`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `undefined`                            |
+| `context.actor`                    | \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `undefined`                            |
+| `context.backgroundLane?`          | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.backgroundOrigin?`        | \{ `method`: `string`; `seal`: `string`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `undefined`                            |
+| `context.backgroundOrigin.method?` | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.backgroundOrigin.seal?`   | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.role?`                    | `"member"` \| `"owner"`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `undefined`                            |
+| `context.soleMember?`              | `true`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `undefined`                            |
+| `context.workflow?`                | \{ `workflowId`: `string`; `runId`: `string`; `nodeId`: `string`; `armedBy`: \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}; \}                                                                                                                                                                                                                                                                                                                                                                                                            | `undefined`                            |
+| `context.workflow.workflowId?`     | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.workflow.runId?`          | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.workflow.nodeId?`         | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.workflow.armedBy?`        | \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `undefined`                            |
+| `context.idempotencyKey?`          | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `grants?`                          | readonly `object`[]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `undefined`                            |
+| `ancestry?`                        | readonly [`InstanceId`](index.md#instanceid)[]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `[]`                                   |
+| `sessionId?`                       | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `agentPolicy?`                     | \{ `policyRevision`: `string`; `grantorMemberId`: `string`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `undefined`                            |
+| `agentPolicy.policyRevision?`      | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `appToolPolicySchema.fields.revision`  |
+| `agentPolicy.grantorMemberId?`     | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `appToolPolicySchema.fields.grantedBy` |
+| `method?`                          | \{ `name`: `string`; `effect`: `"read"` \| `"write"` \| `"external"`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `method.name?`                     | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `appApiMethodNameSchema`               |
+| `method.effect?`                   | `"read"` \| `"write"` \| `"external"`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `...`                                  |
+| `origin?`                          | \{ `method`: `string`; `seal`: `string`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `undefined`                            |
+| `origin.method?`                   | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `origin.seal?`                     | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+
+#### Returns
+
+`object`
+
+| Name                         | Type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Default value           |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------- |
+| `instanceId`                 | [`InstanceId`](index.md#instanceid)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `instanceIdSchema`      |
+| `selection`                  | `object`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `selectionSchema`       |
+| `selection.instanceId`       | [`InstanceId`](index.md#instanceid)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `instanceIdSchema`      |
+| `selection.owner`            | `object`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `ownerSchema`           |
+| `selection.owner.kind`       | `"installation"` \| `"deployment"`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | -                       |
+| `selection.owner.id`         | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `Schema.NonEmptyString` |
+| `selection.appId`            | `AppId`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `appIdSchema`           |
+| `selection.releaseId`        | `ReleaseId`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `releaseIdSchema`       |
+| `selection.authorityVersion` | `number`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | -                       |
+| `artifactDigest`             | `Sha256Digest`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `sha256DigestSchema`    |
+| `subject`                    | \| \{ `kind`: `"call"`; `context`: \{ `computerId`: `string` \| `null`; `actor`: \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}; `backgroundLane?`: `string`; `backgroundOrigin?`: \{ `method`: `string`; `seal`: `string`; \}; `role?`: `"member"` \| `"owner"`; `soleMember?`: `true`; `workflow?`: \{ `workflowId`: `string`; `runId`: `string`; `nodeId`: `string`; `armedBy`: \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}; \}; `idempotencyKey?`: `string`; \}; `sessionId?`: `string`; `agentPolicy?`: \{ `policyRevision`: `string`; `grantorMemberId`: `string`; \}; `method?`: \{ `name`: `string`; `effect`: `"read"` \| `"write"` \| `"external"`; \}; `replay?`: \{ `lane`: `string`; `epoch`: `number`; `admitted`: readonly `string`[]; \}; \} \| \{ `kind`: `"lifecycle"`; `name`: `"onGitPush"`; `eventId`: `string`; \} \| \{ `kind`: `"lifecycle"`; `name`: `"syncRefused"`; `lane`: `string`; `code`: `"access_changed"` \| `"installation_unavailable"`; \} | -                       |
+| `grants`                     | readonly `object`[]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `grantsSchema`          |
+| `deadlineAt`                 | `number`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | -                       |
+| `ancestry`                   | readonly [`InstanceId`](index.md#instanceid)[]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | -                       |
+
+---
+
+### admittedMethodCallerFacts()
+
+```ts
+function admittedMethodCallerFacts(
+  host,
+  installation,
+  release,
+  context,
+  grants,
+  method,
+  ancestry?,
+  sessionId?,
+  agentPolicy?,
+): Promise<{
+  instanceId: InstanceId;
+  selection: {
+    instanceId: InstanceId;
+    owner: {
+      kind: "installation" | "deployment";
+      id: string;
+    };
+    appId: AppId;
+    releaseId: ReleaseId;
+    authorityVersion: number;
+  };
+  artifactDigest: Sha256Digest;
+  subject:
+    | {
+        kind: "call";
+        context: {
+          computerId: string | null;
+          actor:
+            | {
+                kind: "member";
+                memberId: string;
+              }
+            | {
+                kind: "agent";
+                agentId: string;
+              }
+            | {
+                kind: "team-key";
+                keyId: string;
+              };
+          backgroundLane?: string;
+          backgroundOrigin?: {
+            method: string;
+            seal: string;
+          };
+          role?: "member" | "owner";
+          soleMember?: true;
+          workflow?: {
+            workflowId: string;
+            runId: string;
+            nodeId: string;
+            armedBy:
+              | {
+                  kind: "member";
+                  memberId: string;
+                }
+              | {
+                  kind: "agent";
+                  agentId: string;
+                }
+              | {
+                  kind: "team-key";
+                  keyId: string;
+                };
+          };
+          idempotencyKey?: string;
+        };
+        sessionId?: string;
+        agentPolicy?: {
+          policyRevision: string;
+          grantorMemberId: string;
+        };
+        method?: {
+          name: string;
+          effect: "read" | "write" | "external";
+        };
+        replay?: {
+          lane: string;
+          epoch: number;
+          admitted: readonly string[];
+        };
+      }
+    | {
+        kind: "lifecycle";
+        name: "onGitPush";
+        eventId: string;
+      }
+    | {
+        kind: "lifecycle";
+        name: "syncRefused";
+        lane: string;
+        code: "access_changed" | "installation_unavailable";
+      };
+  grants: readonly object[];
+  deadlineAt: number;
+  ancestry: readonly InstanceId[];
+}>;
+```
+
+Seal the host-verified named method after its current admission checks.
+
+#### Parameters
+
+| Parameter                          | Type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Default value                          |
+| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- |
+| `host`                             | `Pick`\<[`OysterHost`](host.md#oysterhost), `"backgroundOriginKey"`\>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `undefined`                            |
+| `installation`                     | [`Installation`](apps.md#installation)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `undefined`                            |
+| `release`                          | [`VerifiedRelease`](host.md#verifiedrelease)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `undefined`                            |
+| `context`                          | \{ `computerId`: `string` \| `null`; `actor`: \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}; `backgroundLane?`: `string`; `backgroundOrigin?`: \{ `method`: `string`; `seal`: `string`; \}; `role?`: `"member"` \| `"owner"`; `soleMember?`: `true`; `workflow?`: \{ `workflowId`: `string`; `runId`: `string`; `nodeId`: `string`; `armedBy`: \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}; \}; `idempotencyKey?`: `string`; \} | `undefined`                            |
+| `context.computerId`               | `string` \| `null`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `undefined`                            |
+| `context.actor`                    | \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `undefined`                            |
+| `context.backgroundLane?`          | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.backgroundOrigin?`        | \{ `method`: `string`; `seal`: `string`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `undefined`                            |
+| `context.backgroundOrigin.method?` | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.backgroundOrigin.seal?`   | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.role?`                    | `"member"` \| `"owner"`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `undefined`                            |
+| `context.soleMember?`              | `true`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `undefined`                            |
+| `context.workflow?`                | \{ `workflowId`: `string`; `runId`: `string`; `nodeId`: `string`; `armedBy`: \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}; \}                                                                                                                                                                                                                                                                                                                                                                                                            | `undefined`                            |
+| `context.workflow.workflowId?`     | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.workflow.runId?`          | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.workflow.nodeId?`         | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `context.workflow.armedBy?`        | \| \{ `kind`: `"member"`; `memberId`: `string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`; `keyId`: `string`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `undefined`                            |
+| `context.idempotencyKey?`          | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `grants?`                          | readonly `object`[]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `undefined`                            |
+| `method?`                          | \{ `name`: `string`; `effect`: `"read"` \| `"write"` \| `"external"`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `method.name?`                     | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `appApiMethodNameSchema`               |
+| `method.effect?`                   | `"read"` \| `"write"` \| `"external"`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `...`                                  |
+| `ancestry?`                        | readonly [`InstanceId`](index.md#instanceid)[]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `[]`                                   |
+| `sessionId?`                       | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `undefined`                            |
+| `agentPolicy?`                     | \{ `policyRevision`: `string`; `grantorMemberId`: `string`; \}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `undefined`                            |
+| `agentPolicy.policyRevision?`      | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `appToolPolicySchema.fields.revision`  |
+| `agentPolicy.grantorMemberId?`     | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `appToolPolicySchema.fields.grantedBy` |
+
+#### Returns
+
+`Promise`\<\{ `instanceId`: [`InstanceId`](index.md#instanceid); `selection`: \{
+`instanceId`: [`InstanceId`](index.md#instanceid); `owner`: \{ `kind`:
+`"installation"` \| `"deployment"`; `id`: `string`; \}; `appId`: `AppId`;
+`releaseId`: `ReleaseId`; `authorityVersion`: `number`; \}; `artifactDigest`:
+`Sha256Digest`; `subject`: \| \{ `kind`: `"call"`; `context`: \{ `computerId`:
+`string` \| `null`; `actor`: \| \{ `kind`: `"member"`; `memberId`: `string`; \}
+\| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`: `"team-key"`;
+`keyId`: `string`; \}; `backgroundLane?`: `string`; `backgroundOrigin?`: \{
+`method`: `string`; `seal`: `string`; \}; `role?`: `"member"` \| `"owner"`;
+`soleMember?`: `true`; `workflow?`: \{ `workflowId`: `string`; `runId`:
+`string`; `nodeId`: `string`; `armedBy`: \| \{ `kind`: `"member"`; `memberId`:
+`string`; \} \| \{ `kind`: `"agent"`; `agentId`: `string`; \} \| \{ `kind`:
+`"team-key"`; `keyId`: `string`; \}; \}; `idempotencyKey?`: `string`; \};
+`sessionId?`: `string`; `agentPolicy?`: \{ `policyRevision`: `string`;
+`grantorMemberId`: `string`; \}; `method?`: \{ `name`: `string`; `effect`:
+`"read"` \| `"write"` \| `"external"`; \}; `replay?`: \{ `lane`: `string`;
+`epoch`: `number`; `admitted`: readonly `string`[]; \}; \} \| \{ `kind`:
+`"lifecycle"`; `name`: `"onGitPush"`; `eventId`: `string`; \} \| \{ `kind`:
+`"lifecycle"`; `name`: `"syncRefused"`; `lane`: `string`; `code`:
+`"access_changed"` \| `"installation_unavailable"`; \}; `grants`: readonly
+`object`[]; `deadlineAt`: `number`; `ancestry`: readonly
+[`InstanceId`](index.md#instanceid)[]; \}\>