@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/dist/build/build-jobs.js

@@ -0,0 +1,203 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import * as Schema from "effect/Schema";
+import { base64url } from "jose";
+import { workspaceBuildPolicy } from "./build-policy.js";
+/** The secret-free Team job; no provider token enters publication. */
+const jobSchema = Schema.Struct({
+    jobId: Schema.NonEmptyString,
+    computerId: Schema.NonEmptyString,
+    credentialId: Schema.NonEmptyString,
+    issuedAt: Schema.Number,
+    repository: Schema.NonEmptyString,
+    expiresAt: Schema.Number,
+    remote: Schema.NonEmptyString,
+    reportUrl: Schema.NonEmptyString,
+    status: Schema.Literals(["running", "succeeded", "failed", "revoked"]),
+    artifact: Schema.NullOr(Schema.Struct({ digest: Schema.NonEmptyString, bytes: Schema.Number })),
+    detail: Schema.NullOr(Schema.String),
+});
+const executionSchema = Schema.Struct({
+    output: Schema.optional(Schema.NullOr(Schema.Struct({
+        exitCode: Schema.NullOr(Schema.Number),
+        stderr: Schema.optional(Schema.String),
+    }))),
+});
+/** Publisher executes builds; Team retains job authority, Computer runs them. */
+export function createTeamBuildPublisher(options) {
+    const now = options.now ?? Date.now;
+    const maxPermissionAgeMs = options.maxPermissionAgeMs ?? 5 * 60_000;
+    const decodeJob = Schema.decodeUnknownSync(jobSchema);
+    return Object.freeze({
+        mint(input) {
+            return options.team.mintTeamBuildCredential(input);
+        },
+        async read(jobId) {
+            const env_1 = { stack: [], error: void 0, hasError: false };
+            try {
+                const build = __addDisposableResource(env_1, await options.team.build(), false);
+                return await build.read(jobId);
+            }
+            catch (e_1) {
+                env_1.error = e_1;
+                env_1.hasError = true;
+            }
+            finally {
+                __disposeResources(env_1);
+            }
+        },
+        revoke(jobId) {
+            return options.team.revokeTeamBuild(jobId);
+        },
+        async run(input) {
+            const env_2 = { stack: [], error: void 0, hasError: false };
+            try {
+                const build = __addDisposableResource(env_2, await options.team.build(), false);
+                const job = decodeJob(await build.prepare(input.jobId));
+                const issuedAt = now();
+                if (job.status !== "running" || job.expiresAt <= issuedAt)
+                    throw new Error("Team build expired");
+                const computer = options.computer(job.computerId);
+                const decision = {
+                    kind: "build",
+                    schemaVersion: 1,
+                    teamId: options.teamId,
+                    computerId: job.computerId,
+                    jobId: job.jobId,
+                    credentialId: job.credentialId,
+                    operations: ["computer.execute"],
+                    sequence: 1,
+                    issuedAt,
+                    expiresAt: Math.min(job.expiresAt, issuedAt + maxPermissionAgeMs),
+                    status: "allowed",
+                    basis: { credentialExpiresAt: job.expiresAt },
+                };
+                await computer.applyBuildDecision(decision);
+                try {
+                    const result = Schema.decodeUnknownSync(executionSchema)(await computer.execute({
+                        teamId: options.teamId,
+                        computerId: job.computerId,
+                        jobId: job.jobId,
+                        credentialId: job.credentialId,
+                        command: "export TEAM_BUILD_REMOTE=" +
+                            job.remote +
+                            " TEAM_BUILD_REPORT=" +
+                            job.reportUrl +
+                            "\n" +
+                            input.command,
+                        timeoutMs: input.timeoutMs,
+                    }));
+                    await computer.deliverTeamGitEvents();
+                    const current = decodeJob(await build.read(input.jobId));
+                    if (current.status !== "running") {
+                        await build.deliverProjection();
+                        return current;
+                    }
+                    const exitCode = result.output?.exitCode ?? null;
+                    const completed = decodeJob(await build.complete(job.jobId, exitCode === 0 && current.artifact !== null
+                        ? "succeeded"
+                        : "failed", exitCode === 0
+                        ? "Build exited without reporting status"
+                        : "Build exited with " +
+                            String(exitCode) +
+                            ": " +
+                            (result.output?.stderr ?? "").slice(-1_000)));
+                    await build.deliverProjection();
+                    return completed;
+                }
+                finally {
+                    await computer.applyBuildDecision({
+                        ...decision,
+                        sequence: 2,
+                        status: "revoked",
+                        issuedAt: Math.min(now(), decision.expiresAt - 1),
+                    });
+                }
+            }
+            catch (e_2) {
+                env_2.error = e_2;
+                env_2.hasError = true;
+            }
+            finally {
+                __disposeResources(env_2);
+            }
+        },
+    });
+}
+/** Fixed captured builder command; neither source nor the customer supplies shell code. */
+export function teamAppBuildCommand(configuration, uploadGrant) {
+    const encoded = base64url.encode(JSON.stringify({
+        uploadGrant,
+        // A builder that predates this policy refuses the whole request.
+        buildPolicy: workspaceBuildPolicy,
+        appId: configuration.appId,
+        sourceRevision: configuration.sourceRevision,
+        recipe: configuration.source.recipe,
+        buildRecipeDigest: configuration.source.buildRecipeDigest,
+    }));
+    return [
+        "set -eu",
+        // Build scratch (clone, snapshot, installed packages) lives on the
+        // Computer's disk: an on-box VM's /tmp is RAM-backed tmpfs, which a
+        // workspace install fills while the compiler needs that memory.
+        "work=$(mktemp -d /var/tmp/fungi-app-build-XXXXXXXX)",
+        `trap 'rm -rf "$work"' EXIT`,
+        'mkdir "$work/tmp"',
+        'export TMPDIR="$work/tmp"',
+        "clone_started=$(date +%s%3N)",
+        'git clone -q --no-checkout -- "$TEAM_BUILD_REMOTE" "$work/source" 2>/dev/null',
+        // The builder reports each phase's duration with its outcome.
+        "export TEAM_BUILD_CLONE_MS=$(( $(date +%s%3N) - clone_started ))",
+        `node /opt/fungi/team-candidate-builder.mjs '${encoded}' "$work/source" "$work/candidate"`,
+    ].join("\n");
+}

package/dist/build/build-policy.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The pinned workspace build policy: how a captured workspace's manifests
+ * build (`package.json#fungi.build`). v2 lets a dependency name its own
+ * package build script, which only an admitted Computer build runs.
+ *
+ * It is part of every workspace HTML recipe's toolchain, so its digest moves
+ * with it, and the Computer build request carries it at the top level, where
+ * a builder compiled before it existed refuses the request outright.
+ */
+export declare const workspaceBuildPolicy = "package-json-fungi-build-v2";

package/dist/build/build-policy.js

@@ -0,0 +1,10 @@
+/**
+ * The pinned workspace build policy: how a captured workspace's manifests
+ * build (`package.json#fungi.build`). v2 lets a dependency name its own
+ * package build script, which only an admitted Computer build runs.
+ *
+ * It is part of every workspace HTML recipe's toolchain, so its digest moves
+ * with it, and the Computer build request carries it at the top level, where
+ * a builder compiled before it existed refuses the request outright.
+ */
+export const workspaceBuildPolicy = "package-json-fungi-build-v2";

package/dist/build/build-step.d.ts

@@ -0,0 +1,37 @@
+import * as Schema from "effect/Schema";
+/**
+ * One captured dependency build step. Paths are relative to the captured
+ * snapshot root. A TypeScript step compiles one config; a Tailwind step
+ * compiles one stylesheet input into its output (the same path for an App's
+ * own stylesheet, which compiles in place). A script step runs the one
+ * `package.json` script a workspace dependency names as its build
+ * (`fungi.build.script`), with pnpm, in that package's directory; only an
+ * admitted Computer build executes it.
+ */
+export declare const workspaceBuildStepSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"typescript">;
+    readonly config: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"tailwind">;
+    readonly input: Schema.String;
+    readonly output: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"script">;
+    readonly directory: Schema.String;
+    readonly script: Schema.String;
+}>]>;
+/** One captured dependency build step. */
+export type WorkspaceBuildStep = Schema.Schema.Type<typeof workspaceBuildStepSchema>;
+/** The steps one dependency-build process runs, encoded as one argument. */
+export declare const workspaceBuildStepsJsonSchema: Schema.fromJsonString<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"typescript">;
+    readonly config: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"tailwind">;
+    readonly input: Schema.String;
+    readonly output: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"script">;
+    readonly directory: Schema.String;
+    readonly script: Schema.String;
+}>]>>>;

package/dist/build/build-step.js

@@ -0,0 +1,28 @@
+import * as Schema from "effect/Schema";
+/**
+ * One captured dependency build step. Paths are relative to the captured
+ * snapshot root. A TypeScript step compiles one config; a Tailwind step
+ * compiles one stylesheet input into its output (the same path for an App's
+ * own stylesheet, which compiles in place). A script step runs the one
+ * `package.json` script a workspace dependency names as its build
+ * (`fungi.build.script`), with pnpm, in that package's directory; only an
+ * admitted Computer build executes it.
+ */
+export const workspaceBuildStepSchema = Schema.Union([
+    Schema.Struct({
+        kind: Schema.Literal("typescript"),
+        config: Schema.String,
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("tailwind"),
+        input: Schema.String,
+        output: Schema.String,
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("script"),
+        directory: Schema.String,
+        script: Schema.String,
+    }),
+]);
+/** The steps one dependency-build process runs, encoded as one argument. */
+export const workspaceBuildStepsJsonSchema = Schema.fromJsonString(Schema.Array(workspaceBuildStepSchema));

package/dist/build/bundled-html.d.ts

@@ -0,0 +1,7 @@
+import type { PinnedRecipe, RawBuildOutput } from "./effect.js";
+/** Read only regular files under the captured entry's directory. No scripts,
+ * dependency hydration, URL rewriting, or access to the producer's live build.
+ */
+export declare function readBundledHtml(snapshot: string, recipe: PinnedRecipe): Promise<Extract<RawBuildOutput, {
+    kind: "assets";
+}>>;

package/dist/build/bundled-html.js

@@ -0,0 +1,64 @@
+import { lstat, opendir, readFile } from "node:fs/promises";
+import { dirname, extname, join } from "node:path";
+import * as Schema from "effect/Schema";
+import { assetPathSchema } from "@fungi.computer/puffball/assets";
+import { boundedBundlePolicy, bundledHtmlRecipe } from "./html-recipe.js";
+/** Read only regular files under the captured entry's directory. No scripts,
+ * dependency hydration, URL rewriting, or access to the producer's live build.
+ */
+export async function readBundledHtml(snapshot, recipe) {
+    const policy = recipe.assets;
+    if (!policy ||
+        !recipe.assetBase ||
+        !recipe.entry.endsWith("/index.html") ||
+        !boundedBundlePolicy(policy, recipe.maxOutputBytes))
+        throw new Error("Invalid bundled HTML policy");
+    // Check every ancestor before descending: a symlink is not a bundle root.
+    const parts = dirname(recipe.entry).split("/");
+    let root = snapshot;
+    for (const part of parts) {
+        if (!part || part === "." || part === ".." || part.includes("\\"))
+            throw new Error("Invalid bundle directory");
+        root = join(root, part);
+        if (!(await lstat(root)).isDirectory())
+            throw new Error("Bundle directory must be a captured directory");
+    }
+    const assets = [];
+    let total = 0;
+    let entries = 0;
+    const visit = async (directory, prefix) => {
+        const children = await opendir(directory);
+        for await (const child of children) {
+            // Bound traversal too, including empty directories.
+            if (++entries > policy.maxObjects * 2)
+                throw new Error("Bundle directory count exceeds policy");
+            const path = Schema.decodeUnknownSync(assetPathSchema)(`${prefix}/${child.name}`);
+            const source = join(directory, child.name);
+            if (child.isDirectory()) {
+                await visit(source, path);
+                continue;
+            }
+            if (!child.isFile() ||
+                !bundledHtmlRecipe.extensions.includes(extname(child.name)))
+                throw new Error("Bundle contains an unsupported file type");
+            if (assets.length >= policy.maxObjects)
+                throw new Error("Bundle file count exceeds policy");
+            const stat = await lstat(source);
+            total += stat.size;
+            if (!stat.isFile() ||
+                stat.size > policy.maxObjectBytes ||
+                !Number.isSafeInteger(total) ||
+                total > policy.maxTotalBytes)
+                throw new Error("Bundle bytes exceed policy");
+            const bytes = await readFile(source);
+            if (bytes.byteLength !== stat.size)
+                throw new Error("Bundle changed during capture");
+            assets.push({ path, bytes });
+        }
+    };
+    await visit(root, "");
+    if (!assets.some((asset) => asset.path === "/index.html"))
+        throw new Error("Bundle is missing its HTML entry");
+    assets.sort((a, b) => a.path.localeCompare(b.path));
+    return { kind: "assets", base: recipe.assetBase, assets };
+}

package/dist/build/candidate-builder.d.ts

@@ -0,0 +1,68 @@
+import * as Schema from "effect/Schema";
+export declare class TeamCandidateBuildError extends Error {
+    readonly code: "invalid_recipe" | "output_limit" | "report_failed";
+    constructor(code: "invalid_recipe" | "output_limit" | "report_failed");
+}
+export declare const teamCandidateConfigurationSchema: Schema.Struct<{
+    /** The build policy the host expects; a builder that predates it refuses
+     * the request, and this one refuses any other. */
+    readonly buildPolicy: Schema.Literal<"package-json-fungi-build-v2">;
+    readonly appId: Schema.refine<import("@fungi.computer/puffball").AppId, Schema.String>;
+    readonly sourceRevision: Schema.refine<import("@fungi.computer/puffball").SourceRevision, Schema.String>;
+    readonly recipe: Schema.Struct<{
+        readonly kind: Schema.optional<Schema.Literals<readonly ["bundled-html", "source-html"]>>;
+        readonly bundle: Schema.Literal<true>;
+        readonly entry: Schema.String;
+        readonly format: Schema.Literals<readonly ["html", "esm", "assets"]>;
+        readonly assets: Schema.optional<Schema.Struct<{
+            readonly maxManifestBytes: Schema.Number;
+            readonly maxObjects: Schema.Number;
+            readonly maxObjectBytes: Schema.Number;
+            readonly maxTotalBytes: Schema.Number;
+        }>>;
+        readonly assetBase: Schema.optionalKey<Schema.String>;
+        readonly toolchain: Schema.$Record<Schema.String, Schema.String>;
+        readonly maxOutputBytes: Schema.Number;
+        readonly platform: Schema.Literals<readonly ["browser", "neutral"]>;
+        readonly backend: Schema.Union<readonly [Schema.Null, Schema.Struct<{
+            readonly entry: Schema.optional<Schema.String>;
+            readonly runtime: Schema.Struct<{
+                readonly kind: Schema.Literal<"durable-facet">;
+                readonly stateSchema: Schema.Number;
+            }>;
+            readonly compatibilityDate: Schema.String;
+            readonly exportName: Schema.String;
+        }>]>;
+        readonly target: Schema.Tuple<readonly [Schema.Literal<"es2022">]>;
+    }>;
+    readonly buildRecipeDigest: Schema.refine<import("@fungi.computer/puffball").Sha256Digest, Schema.String>;
+}>;
+/** Where a built candidate's manifest and its objects are written. */
+export declare function teamCandidateLayout(outputPath: string): {
+    manifest: string;
+    object: (digest: string) => string;
+};
+/**
+ * Runs inside the admitted Computer, using Oyster's captured builder.
+ * This is the one composition that runs a dependency's declared package
+ * build script; its executor refuses a recipe pinned under another policy.
+ * It writes a new directory: each built object under its digest, and the
+ * small manifest that names them, ready to upload one at a time.
+ */
+export declare function buildTeamCandidate(input: {
+    configuration: unknown;
+    repositoryPath: string;
+    /** A directory this build creates; it must not exist yet. */
+    outputPath: string;
+    /** Trusted Computer-local cache; never part of customer configuration. */
+    packageStoreDirectory?: string;
+}): Promise<Readonly<{
+    digest: string;
+    bytes: number;
+    /** Milliseconds: capturing the cloned source, installing, compiling. */
+    phases: Readonly<{
+        capture: number;
+        install: number;
+        build: number;
+    }>;
+}>>;

package/dist/build/candidate-builder.js

@@ -0,0 +1,91 @@
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { appIdSchema, sourceRevisionSchema, sha256DigestSchema, } from "@fungi.computer/puffball/effect";
+import { parseReleaseId } from "@fungi.computer/puffball";
+import { capturedPinnedRecipeSchema, createCapturedCandidatePreparer, digestPinnedRecipe, encodeTeamAppCandidateManifest, TEAM_APP_CANDIDATE_MANIFEST_MAX_BYTES, workspaceBuildPolicy, } from "../build-contract.js";
+import { createLocalCommitSourceCapture, createLocalBuildExecutor, stageBuildOutput, } from "../build.js";
+export class TeamCandidateBuildError extends Error {
+    code;
+    constructor(code) {
+        super(`Team candidate ${code}`);
+        this.code = code;
+        this.name = "TeamCandidateBuildError";
+    }
+}
+export const teamCandidateConfigurationSchema = Schema.Struct({
+    /** The build policy the host expects; a builder that predates it refuses
+     * the request, and this one refuses any other. */
+    buildPolicy: Schema.Literal(workspaceBuildPolicy),
+    appId: appIdSchema,
+    sourceRevision: sourceRevisionSchema,
+    recipe: capturedPinnedRecipeSchema,
+    buildRecipeDigest: sha256DigestSchema,
+});
+/** Where a built candidate's manifest and its objects are written. */
+export function teamCandidateLayout(outputPath) {
+    return {
+        manifest: join(outputPath, "manifest.json"),
+        object: (digest) => join(outputPath, "objects", digest.replace(":", "-")),
+    };
+}
+/**
+ * Runs inside the admitted Computer, using Oyster's captured builder.
+ * This is the one composition that runs a dependency's declared package
+ * build script; its executor refuses a recipe pinned under another policy.
+ * It writes a new directory: each built object under its digest, and the
+ * small manifest that names them, ready to upload one at a time.
+ */
+export async function buildTeamCandidate(input) {
+    const config = Schema.decodeUnknownSync(teamCandidateConfigurationSchema, {
+        onExcessProperty: "error",
+    })(input.configuration);
+    if (digestPinnedRecipe(config.recipe) !== config.buildRecipeDigest)
+        throw new TeamCandidateBuildError("invalid_recipe");
+    const phases = { install: 0, build: 0 };
+    const onPhase = (phase, milliseconds) => {
+        phases[phase] += milliseconds;
+    };
+    const prepareStarted = performance.now();
+    const candidate = await Effect.runPromise(createCapturedCandidatePreparer(config, {
+        sourceCapture: createLocalCommitSourceCapture(input.repositoryPath, config.sourceRevision),
+        buildExecutor: createLocalBuildExecutor(input.packageStoreDirectory === undefined
+            ? { packageScripts: "run", onPhase }
+            : {
+                packageScripts: "run",
+                packageStoreDirectory: input.packageStoreDirectory,
+                onPhase,
+            }),
+    }).prepareCandidate(parseReleaseId("rel_build")));
+    const prepared = performance.now() - prepareStarted;
+    const staged = stageBuildOutput(candidate.output);
+    const bytes = Buffer.from(encodeTeamAppCandidateManifest({
+        appId: candidate.appId,
+        output: staged.manifest,
+        provenance: candidate.provenance,
+    }));
+    if (bytes.byteLength > TEAM_APP_CANDIDATE_MANIFEST_MAX_BYTES)
+        throw new TeamCandidateBuildError("output_limit");
+    const layout = teamCandidateLayout(input.outputPath);
+    // A new directory: an earlier build's output is never mixed in.
+    await mkdir(input.outputPath, { mode: 0o700 });
+    await mkdir(join(input.outputPath, "objects"), { mode: 0o700 });
+    for (const object of staged.objects)
+        await writeFile(layout.object(object.digest), object.bytes, {
+            flag: "wx",
+            mode: 0o600,
+        });
+    await writeFile(layout.manifest, bytes, { flag: "wx", mode: 0o600 });
+    return {
+        digest: `sha256:${createHash("sha256").update(bytes).digest("hex")}`,
+        bytes: bytes.byteLength,
+        phases: {
+            // Snapshot capture and staging: everything but the install and compile.
+            capture: Math.max(0, prepared - phases.install - phases.build),
+            install: phases.install,
+            build: phases.build,
+        },
+    };
+}

package/dist/build/candidate-cli.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/build/candidate-cli.js

@@ -0,0 +1,119 @@
+import * as Schema from "effect/Schema";
+import { releaseSchema } from "@fungi.computer/puffball/effect";
+import { readFile } from "node:fs/promises";
+import { candidateManifestObjects, teamAppCandidateManifestSchema, } from "../build-contract.js";
+import { buildTeamCandidate, teamCandidateConfigurationSchema, teamCandidateLayout, TeamCandidateBuildError, } from "./candidate-builder.js";
+/** Objects in flight at once; each is read from disk only while it uploads. */
+const uploadConcurrency = 4;
+/** Attempts per object when its connection drops before a response. */
+const uploadAttempts = 3;
+/** Report a failed build to the host's build output: its kind, never its text. */
+function reportFailure(cause) {
+    process.stderr.write(`${JSON.stringify({
+        source: "oyster-candidate-builder",
+        failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+    })}\n`);
+}
+const [configuration, repositoryPath, outputPath] = process.argv.slice(2);
+if (!configuration || !repositoryPath || !outputPath)
+    throw new Error("Usage: team-candidate-builder CONFIG_BASE64 REPOSITORY OUTPUT_DIRECTORY");
+try {
+    const { uploadGrant, ...config } = Schema.decodeUnknownSync(Schema.Struct({
+        ...teamCandidateConfigurationSchema.fields,
+        uploadGrant: Schema.String,
+    }), { onExcessProperty: "error" })(JSON.parse(Buffer.from(configuration, "base64url").toString("utf8")));
+    const { phases, ...artifact } = await buildTeamCandidate({
+        configuration: config,
+        repositoryPath,
+        outputPath,
+        // Computer scratch survives captured snapshot cleanup, without a global or durable Workspace store.
+        packageStoreDirectory: "/var/tmp/fungi-app-package-store",
+    });
+    const reportUrl = process.env.TEAM_BUILD_REPORT;
+    if (!reportUrl)
+        throw new TeamCandidateBuildError("report_failed");
+    const layout = teamCandidateLayout(outputPath);
+    const manifestBytes = await readFile(layout.manifest);
+    const manifest = Schema.decodeUnknownSync(Schema.fromJsonString(teamAppCandidateManifestSchema))(new TextDecoder().decode(manifestBytes));
+    // Every object first, each streamed alone; the manifest only names them.
+    const uploadStarted = performance.now();
+    const pending = [...candidateManifestObjects(manifest.output)];
+    // A write-once PUT is safe to repeat, so a dropped connection is retried.
+    const put = async (object) => {
+        for (let attempt = 1;; attempt += 1) {
+            const stored = await fetch(`${reportUrl}/objects/${object.digest.replace(":", "-")}`, {
+                method: "PUT",
+                headers: {
+                    "Content-Type": object.mediaType,
+                    "X-Team-App-Build": uploadGrant,
+                },
+                body: await readFile(layout.object(object.digest)),
+            }).catch((cause) => {
+                if (attempt >= uploadAttempts)
+                    throw cause;
+                return null;
+            });
+            await stored?.body?.cancel();
+            if (stored?.ok)
+                return;
+            if (stored !== null || attempt >= uploadAttempts)
+                throw new TeamCandidateBuildError("report_failed");
+        }
+    };
+    const upload = async () => {
+        for (let object = pending.shift(); object; object = pending.shift())
+            await put(object);
+    };
+    await Promise.all(Array.from({ length: uploadConcurrency }, upload));
+    const candidate = await fetch(`${reportUrl}/candidate`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "X-Team-App-Build": uploadGrant,
+        },
+        body: manifestBytes,
+    });
+    if (!candidate.ok)
+        throw new TeamCandidateBuildError("report_failed");
+    const receipt = Schema.decodeUnknownSync(Schema.Struct({
+        kind: Schema.Literal("submitted"),
+        release: releaseSchema,
+    }))(await candidate.json());
+    const recorded = await fetch(`${reportUrl}/artifact`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(artifact),
+    });
+    if (!recorded.ok)
+        throw new TeamCandidateBuildError("report_failed");
+    await recorded.body?.cancel();
+    const uploaded = performance.now() - uploadStarted;
+    // The success detail reports where the build's time went; the owner reads
+    // it with the build. The clone ran before this program (TEAM_BUILD_CLONE_MS).
+    const cloned = Number(process.env.TEAM_BUILD_CLONE_MS ?? "0");
+    const status = await fetch(`${reportUrl}/status`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            status: "succeeded",
+            detail: JSON.stringify({
+                phasesMs: {
+                    clone: Math.round((Number.isFinite(cloned) ? cloned : 0) + phases.capture),
+                    install: Math.round(phases.install),
+                    build: Math.round(phases.build),
+                    upload: Math.round(uploaded),
+                },
+            }),
+        }),
+    });
+    if (!status.ok)
+        throw new TeamCandidateBuildError("report_failed");
+    await status.body?.cancel();
+    process.stdout.write(JSON.stringify({ ...artifact, release: receipt.release }));
+}
+catch (cause) {
+    reportFailure(cause);
+    // Customer source and provider messages can contain secrets; only expose the stage.
+    process.stderr.write("Team App source/build failed\n");
+    process.exitCode = 1;
+}