@fungi.computer/oyster 0.0.1 → 0.2.0

package/dist/standalone/workflow-binding.d.ts

@@ -0,0 +1,216 @@
+import * as S from "effect/Schema";
+import { z } from "zod";
+import { eventDisarmInputSchema, scheduleDisarmInputSchema } from "@fungi.computer/workflows-wire";
+import type { Installation } from "../apps/index.js";
+import type { WorkflowGitPassResult } from "@fungi.computer/agar/computer-contracts";
+import { type AppEventFact } from "@fungi.computer/puffball/app-event-facts";
+import type { HostRecipientEvent } from "../workers-git.js";
+import type { FrameBindingProps } from "../cloudflare.js";
+import type { InvocationFacts, InvocationFrame } from "../invocation.js";
+import type { OysterJson } from "../host.js";
+import type { StandaloneWorkflowRunsBase } from "./workflows.js";
+export declare const runKey: S.Struct<{
+    readonly runId: S.String;
+}>;
+export declare const reviewKey: S.Struct<{
+    readonly runId: S.String;
+    readonly nodeId: S.String;
+    readonly iteration: S.String;
+    readonly answer: S.Union<readonly [S.Struct<{
+        readonly approved: S.Boolean;
+    }>, S.Struct<{
+        readonly choice: S.String;
+        readonly note: S.optionalKey<S.String>;
+    }>]>;
+}>;
+/** The App supplies its immutable publication row; the host supplies the library. */
+export declare const triggerArmTargetSchema: z.ZodObject<{
+    digest: z.ZodString & z.ZodType<string & {
+        readonly appReleaseKind: "Sha256Digest";
+    }, string, z.core.$ZodTypeInternals<string & {
+        readonly appReleaseKind: "Sha256Digest";
+    }, string>>;
+    bindings: z.ZodRecord<z.ZodLazy<z.ZodString>, z.ZodUnion<readonly [z.ZodString, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"team-source">;
+    }, z.core.$strict>>]>>;
+    workflowId: z.ZodString;
+    delivery: z.ZodOptional<z.ZodCustom<{
+        readonly agentId: string;
+        readonly sessionId: string;
+    }, {
+        readonly agentId: string;
+        readonly sessionId: string;
+    }>>;
+    triggerId: z.ZodString;
+    commit: z.ZodString;
+}, z.core.$strict>;
+export type TriggerArmTarget = z.output<typeof triggerArmTargetSchema>;
+export type ScheduleDisarmInput = z.output<typeof scheduleDisarmInputSchema>;
+export type EventDisarmInput = z.output<typeof eventDisarmInputSchema>;
+/** The frame gate needs only these run-owner calls; it re-decodes each reply with the method's owner schema. */
+export type WorkflowRunCalls = Pick<StandaloneWorkflowRunsBase, "catalog" | "start" | "status" | "cancel" | "answerReview" | "armSchedule" | "disarmSchedule" | "schedules" | "armEventTrigger" | "disarmEventTrigger" | "eventTriggers" | "runs">;
+export type WorkflowBindingEnv = Readonly<{
+    WORKFLOW_RUNS: Readonly<{
+        getByName(installationId: string): WorkflowRunCalls;
+    }>;
+}>;
+/** Each Workflows library receives emitted App events at its run owner. */
+export type WorkflowEventEnv = Readonly<{
+    WORKFLOW_RUNS: Readonly<{
+        getByName(installationId: string): Readonly<{
+            deliverEvent(fact: AppEventFact): Promise<"accepted">;
+        }>;
+    }>;
+}>;
+/** The guest factory and the live Instance gate consume the same owner grammars. */
+export declare const workflowFrameMethods: {
+    WORKFLOWS: {
+        [k: string]: {
+            decodeArgs: ((input: unknown, options?: import("effect/SchemaAST").ParseOptions) => readonly [{
+                readonly installationId?: string | undefined;
+            }]) | ((input: unknown, options?: import("effect/SchemaAST").ParseOptions) => readonly [{
+                readonly input: {
+                    readonly [x: string]: S.Json;
+                };
+                readonly bindings: Record<string, string | {
+                    kind: "team-source";
+                }>;
+                readonly requestId: string;
+                readonly definition: unknown;
+                readonly delivery?: {
+                    readonly agentId: string;
+                    readonly sessionId: string;
+                } | undefined;
+                readonly published?: undefined;
+            } | {
+                readonly input: {
+                    readonly [x: string]: S.Json;
+                };
+                readonly bindings: Record<string, string | {
+                    kind: "team-source";
+                }>;
+                readonly requestId: string;
+                readonly published: {
+                    workflowId: string;
+                    commit: string;
+                    digest: string & {
+                        readonly appReleaseKind: "Sha256Digest";
+                    };
+                };
+                readonly definition: S.Json;
+                readonly delivery?: {
+                    readonly agentId: string;
+                    readonly sessionId: string;
+                } | undefined;
+            }]) | ((input: unknown, options?: import("effect/SchemaAST").ParseOptions) => readonly [{
+                readonly runId: string;
+            }]) | ((input: unknown, options?: import("effect/SchemaAST").ParseOptions) => readonly [{
+                readonly runId: string;
+                readonly nodeId: string;
+                readonly iteration: string;
+                readonly answer: {
+                    readonly approved: boolean;
+                } | {
+                    readonly choice: string;
+                    readonly note?: string | undefined;
+                };
+            }]) | ((args: unknown) => [{
+                digest: string & {
+                    readonly appReleaseKind: "Sha256Digest";
+                };
+                bindings: Record<string, string | {
+                    kind: "team-source";
+                }>;
+                workflowId: string;
+                triggerId: string;
+                commit: string;
+                delivery?: {
+                    readonly agentId: string;
+                    readonly sessionId: string;
+                } | undefined;
+            }]) | ((args: unknown) => [{
+                scheduleId: string;
+            }]) | ((args: unknown) => [Record<string, never>]) | ((args: unknown) => [{
+                digest: string & {
+                    readonly appReleaseKind: "Sha256Digest";
+                };
+                bindings: Record<string, string | {
+                    kind: "team-source";
+                }>;
+                workflowId: string;
+                triggerId: string;
+                commit: string;
+                delivery?: {
+                    readonly agentId: string;
+                    readonly sessionId: string;
+                } | undefined;
+            }]) | ((args: unknown) => [{
+                eventTriggerId: string;
+            }]) | ((args: unknown) => [Record<string, never>]) | ((args: unknown) => [{
+                workflowId?: string | undefined;
+            }]);
+            decodeResult: (value: unknown) => z.core.util.JSONType;
+            requiredOperations: () => ("catalog" | "runGraph" | "armSchedule" | "disarmSchedule" | "schedules" | "armEventTrigger" | "disarmEventTrigger" | "eventTriggers" | "cancel" | "answerReview" | "graphStatus" | "runs")[];
+        };
+    };
+};
+/**
+ * The host recipients of an App's accepted EVENTS.emit: every enabled
+ * Workflows library approved to arm triggers. The host records one durable
+ * delivery per library and returns; the emit never waits on a library.
+ */
+export declare function workflowEventRecipients(installations: Readonly<{
+    list(): Promise<readonly Pick<Installation, "installationId" | "status" | "approvedGrants">[]>;
+}>): Promise<readonly string[]>;
+/**
+ * One recorded delivery to one library: the host-attested fact reaches its
+ * run owner, which fires only its own armed triggers and replays by event id,
+ * so the delivery owner's retries never start a run twice.
+ */
+export declare function deliverWorkflowEvent(env: WorkflowEventEnv, libraryId: string, event: HostRecipientEvent): Promise<void>;
+/** What a Workflow node frame attests when it asks for its Git step's pass. */
+export declare const workflowGitPassRequestSchema: z.ZodLazy<z.ZodObject<{
+    installationId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    workflow: import("zod/mini").ZodMiniObject<{
+        workflowId: import("zod/mini").ZodMiniString<string>;
+        runId: import("zod/mini").ZodMiniString<string>;
+        nodeId: import("zod/mini").ZodMiniString<string>;
+        armedBy: import("zod/mini").ZodMiniDiscriminatedUnion<[import("zod/mini").ZodMiniObject<{
+            kind: import("zod/mini").ZodMiniLiteral<"member">;
+            memberId: import("zod/mini").ZodMiniString<string>;
+        }, z.core.$strip>, import("zod/mini").ZodMiniObject<{
+            kind: import("zod/mini").ZodMiniLiteral<"agent">;
+            agentId: import("zod/mini").ZodMiniString<string>;
+        }, z.core.$strip>, import("zod/mini").ZodMiniObject<{
+            kind: import("zod/mini").ZodMiniLiteral<"team-key">;
+            keyId: import("zod/mini").ZodMiniString<string>;
+        }, z.core.$strip>], "kind">;
+    }, z.core.$strip>;
+    memberId: z.ZodString;
+    computerId: z.ZodString;
+}, z.core.$strict>>;
+export type WorkflowGitPassRequest = z.output<typeof workflowGitPassRequestSchema>;
+/** The library run owners a node frame's pass request may reach. */
+export type WorkflowGitPassEnv = Readonly<{
+    OYSTER_COMPUTER_ID: string;
+    WORKFLOW_RUNS: Readonly<{
+        getByName(installationId: string): Readonly<{
+            openWorkflowGitPass(request: WorkflowGitPassRequest): Promise<WorkflowGitPassResult | null>;
+        }>;
+    }>;
+}>;
+/**
+ * COMPUTER.workflowGitPass from a published Workflow node frame. Only the
+ * frame's host-attested Workflow, call key, member and pinned Computer cross;
+ * the library that dispatched that Git step derives the scope from its own
+ * stored run and mints or renews the pass.
+ */
+export declare function openWorkflowGitPass(env: WorkflowGitPassEnv, installations: Readonly<{
+    list(): Promise<readonly Pick<Installation, "installationId" | "status" | "approvedGrants">[]>;
+}>, frame: Readonly<{
+    facts: InvocationFacts;
+    signal: AbortSignal;
+}>, args: readonly unknown[]): Promise<WorkflowGitPassResult>;
+/** Called only after the Instance's shared gate resolves this live frame. */
+export declare function dispatchWorkflowBinding(env: WorkflowBindingEnv, frame: InvocationFrame, props: FrameBindingProps, method: string, args: readonly unknown[]): Promise<OysterJson>;

package/dist/standalone/workflow-binding.js

@@ -0,0 +1,217 @@
+import * as S from "effect/Schema";
+import { z } from "zod";
+import { graphReviewSchema, reviewAnswerSchema } from "@fungi.computer/braid";
+import { graphStartRequestSchema, workflowTriggerTargetSchema, } from "@fungi.computer/braid/runtime";
+import { runReply, answerReviewReply, catalogReplySchema, statusReply, cancelReplySchema, runsReplySchema, runsInputSchema, eventArmReplySchema, eventDisarmInputSchema, eventTriggersReplySchema, scheduleArmReplySchema, scheduleDisarmInputSchema, schedulesReplySchema, triggerDisarmReplySchema, triggerListInputSchema, } from "@fungi.computer/workflows-wire";
+import { workflowAttestationSchema } from "@fungi.computer/puffball/app-method-runtime";
+import { appEventFactSchema, } from "@fungi.computer/puffball/app-event-facts";
+import { AppInstanceError } from "../index.js";
+export const runKey = S.Struct({ runId: S.String });
+export const reviewKey = S.Struct({
+    runId: graphReviewSchema.fields.runId,
+    nodeId: graphReviewSchema.fields.nodeId,
+    iteration: graphReviewSchema.fields.iteration,
+    answer: reviewAnswerSchema,
+});
+/** The App supplies its immutable publication row; the host supplies the library. */
+export const triggerArmTargetSchema = workflowTriggerTargetSchema.omit({
+    installationId: true,
+});
+const effectArgs = (schema) => S.decodeUnknownSync(schema, { onExcessProperty: "error" });
+const workflowArgs = {
+    catalog: effectArgs(S.Tuple([S.Struct({ installationId: S.optionalKey(S.String) })])),
+    runGraph: effectArgs(S.Tuple([graphStartRequestSchema])),
+    graphStatus: effectArgs(S.Tuple([runKey])),
+    cancel: effectArgs(S.Tuple([runKey])),
+    answerReview: effectArgs(S.Tuple([reviewKey])),
+    armSchedule: (args) => z.tuple([triggerArmTargetSchema]).parse(args),
+    disarmSchedule: (args) => z.tuple([scheduleDisarmInputSchema]).parse(args),
+    schedules: (args) => z.tuple([triggerListInputSchema]).parse(args),
+    armEventTrigger: (args) => z.tuple([triggerArmTargetSchema]).parse(args),
+    disarmEventTrigger: (args) => z.tuple([eventDisarmInputSchema]).parse(args),
+    eventTriggers: (args) => z.tuple([triggerListInputSchema]).parse(args),
+    runs: (args) => z.tuple([runsInputSchema]).parse(args),
+};
+const workflowResults = {
+    catalog: catalogReplySchema,
+    runGraph: runReply,
+    graphStatus: statusReply,
+    cancel: cancelReplySchema,
+    answerReview: answerReviewReply,
+    armSchedule: scheduleArmReplySchema,
+    disarmSchedule: triggerDisarmReplySchema,
+    schedules: schedulesReplySchema,
+    armEventTrigger: eventArmReplySchema,
+    disarmEventTrigger: triggerDisarmReplySchema,
+    eventTriggers: eventTriggersReplySchema,
+    runs: runsReplySchema,
+};
+const workflowMethod = z.enum([
+    "catalog",
+    "runGraph",
+    "graphStatus",
+    "cancel",
+    "answerReview",
+    "armSchedule",
+    "disarmSchedule",
+    "schedules",
+    "armEventTrigger",
+    "disarmEventTrigger",
+    "eventTriggers",
+    "runs",
+]);
+/** The guest factory and the live Instance gate consume the same owner grammars. */
+export const workflowFrameMethods = {
+    WORKFLOWS: Object.fromEntries(workflowMethod.options.map((method) => [
+        method,
+        {
+            decodeArgs: workflowArgs[method],
+            decodeResult: (value) => z.json().parse(workflowResults[method].parse(value)),
+            requiredOperations: () => [method],
+        },
+    ])),
+};
+/**
+ * The host recipients of an App's accepted EVENTS.emit: every enabled
+ * Workflows library approved to arm triggers. The host records one durable
+ * delivery per library and returns; the emit never waits on a library.
+ */
+export async function workflowEventRecipients(installations) {
+    return (await installations.list())
+        .filter((installation) => installation.status === "enabled" &&
+        installation.approvedGrants.some((grant) => grant.capability === "workflow.arm"))
+        .map((installation) => installation.installationId);
+}
+/**
+ * One recorded delivery to one library: the host-attested fact reaches its
+ * run owner, which fires only its own armed triggers and replays by event id,
+ * so the delivery owner's retries never start a run twice.
+ */
+export async function deliverWorkflowEvent(env, libraryId, event) {
+    const fact = appEventFactSchema.parse({
+        type: event.type,
+        payload: event.payload,
+        eventId: event.eventId,
+        installationId: event.source.installationId,
+        appId: event.source.appId,
+        releaseId: event.source.releaseId,
+    });
+    await env.WORKFLOW_RUNS.getByName(libraryId).deliverEvent(fact);
+}
+/** What a Workflow node frame attests when it asks for its Git step's pass. */
+export const workflowGitPassRequestSchema = z.lazy(() => z.strictObject({
+    installationId: z.string().min(1).max(256),
+    idempotencyKey: z.string().min(1).max(128),
+    workflow: workflowAttestationSchema,
+    memberId: z.string().min(1).max(256),
+    computerId: z.string().min(1).max(256),
+}));
+/**
+ * COMPUTER.workflowGitPass from a published Workflow node frame. Only the
+ * frame's host-attested Workflow, call key, member and pinned Computer cross;
+ * the library that dispatched that Git step derives the scope from its own
+ * stored run and mints or renews the pass.
+ */
+export async function openWorkflowGitPass(env, installations, frame, args) {
+    z.tuple([z.strictObject({})]).parse(args);
+    const { subject, selection } = frame.facts;
+    if (subject.kind !== "call" ||
+        subject.context.workflow === undefined ||
+        subject.context.idempotencyKey === undefined ||
+        subject.context.actor.kind !== "member" ||
+        subject.context.computerId !== env.OYSTER_COMPUTER_ID ||
+        selection.owner.kind !== "installation")
+        throw new AppInstanceError("revoked");
+    const request = workflowGitPassRequestSchema.parse({
+        installationId: selection.owner.id,
+        idempotencyKey: subject.context.idempotencyKey,
+        workflow: subject.context.workflow,
+        memberId: subject.context.actor.memberId,
+        computerId: subject.context.computerId,
+    });
+    const libraries = (await installations.list()).filter((installation) => installation.status === "enabled" &&
+        installation.approvedGrants.some((grant) => grant.capability === "workflow.run"));
+    for (const library of libraries) {
+        frame.signal.throwIfAborted();
+        const pass = await env.WORKFLOW_RUNS.getByName(library.installationId).openWorkflowGitPass(request);
+        if (pass !== null)
+            return pass;
+    }
+    throw new AppInstanceError("revoked");
+}
+/** Called only after the Instance's shared gate resolves this live frame. */
+export async function dispatchWorkflowBinding(env, frame, props, method, args) {
+    frame.signal.throwIfAborted();
+    if (props.binding !== "WORKFLOWS" ||
+        frame.facts.subject.kind !== "call" ||
+        frame.facts.selection.owner.kind !== "installation")
+        throw new AppInstanceError("revoked");
+    const runs = env.WORKFLOW_RUNS.getByName(frame.facts.selection.owner.id);
+    let result;
+    switch (method) {
+        case "catalog": {
+            const [input] = workflowArgs.catalog(args);
+            result = await runs.catalog(frame.facts, input);
+            break;
+        }
+        case "runGraph": {
+            const [input] = workflowArgs.runGraph(args);
+            result = await runs.start(frame.facts, input);
+            break;
+        }
+        case "graphStatus": {
+            const [input] = workflowArgs.graphStatus(args);
+            result = await runs.status(frame.facts, input);
+            break;
+        }
+        case "cancel": {
+            const [input] = workflowArgs.cancel(args);
+            result = await runs.cancel(frame.facts, input);
+            break;
+        }
+        case "answerReview": {
+            const [input] = workflowArgs.answerReview(args);
+            result = await runs.answerReview(frame.facts, input);
+            break;
+        }
+        case "armSchedule": {
+            const [input] = workflowArgs.armSchedule(args);
+            result = await runs.armSchedule(frame.facts, input);
+            break;
+        }
+        case "disarmSchedule": {
+            const [input] = workflowArgs.disarmSchedule(args);
+            result = await runs.disarmSchedule(frame.facts, input);
+            break;
+        }
+        case "schedules":
+            workflowArgs.schedules(args);
+            result = await runs.schedules(frame.facts);
+            break;
+        case "armEventTrigger": {
+            const [input] = workflowArgs.armEventTrigger(args);
+            result = await runs.armEventTrigger(frame.facts, input);
+            break;
+        }
+        case "disarmEventTrigger": {
+            const [input] = workflowArgs.disarmEventTrigger(args);
+            result = await runs.disarmEventTrigger(frame.facts, input);
+            break;
+        }
+        case "eventTriggers":
+            workflowArgs.eventTriggers(args);
+            result = await runs.eventTriggers(frame.facts);
+            break;
+        case "runs": {
+            const [input] = workflowArgs.runs(args);
+            result = await runs.runs(frame.facts, input.workflowId === undefined ? {} : { workflowId: input.workflowId });
+            break;
+        }
+        default:
+            throw new AppInstanceError("revoked");
+    }
+    frame.signal.throwIfAborted();
+    return z
+        .json()
+        .parse(workflowResults[workflowMethod.parse(method)].parse(result));
+}

package/dist/standalone/workflow-events.d.ts

@@ -0,0 +1,46 @@
+import { createWorkflowEventRouter } from "@fungi.computer/braid/runtime";
+import type { AppEventFact } from "@fungi.computer/puffball/app-event-facts";
+import { type EventDisarmInput, type TriggerArmTarget } from "./workflow-binding.js";
+import type { TriggerAdmission } from "./workflow-schedules.js";
+export type EventTriggerOperation = "armEventTrigger" | "disarmEventTrigger" | "eventTriggers";
+/** Host controls and App-event delivery compose the shared event router unchanged. */
+export declare function createStandaloneWorkflowEvents<Frame>(options: Parameters<typeof createWorkflowEventRouter>[0] & {
+    admitInvocation(frame: Frame, operation: EventTriggerOperation): Promise<TriggerAdmission>;
+}): {
+    /** A host-recorded App event; matching armed triggers start their runs. */
+    deliver: (fact: AppEventFact) => Promise<"accepted">;
+    arm(frame: Frame, raw: TriggerArmTarget): Promise<{
+        kind: "armed";
+        eventTriggerId: string;
+    } | {
+        error: string;
+        kind?: undefined;
+        reason?: undefined;
+    } | {
+        kind: "refused";
+        reason: string;
+        readonly error?: undefined;
+    }>;
+    disarm(frame: Frame, raw: EventDisarmInput): Promise<{
+        kind: "disarmed";
+    } | {
+        kind: "not_found";
+    } | {
+        error: string;
+    }>;
+    list(frame: Frame): Promise<{
+        error: string;
+        eventTriggers?: undefined;
+    } | {
+        eventTriggers: {
+            eventTriggerId: string;
+            workflowId: string;
+            triggerId: string;
+            emitterInstallationId: string;
+            event: string;
+            state: "active" | "paused";
+            lastError: string | null;
+        }[];
+        readonly error?: undefined;
+    }>;
+};

package/dist/standalone/workflow-events.js

@@ -0,0 +1,39 @@
+import { createWorkflowEventRouter } from "@fungi.computer/braid/runtime";
+import { eventDisarmInputSchema } from "@fungi.computer/workflows-wire";
+import { triggerArmTargetSchema, } from "./workflow-binding.js";
+/** Host controls and App-event delivery compose the shared event router unchanged. */
+export function createStandaloneWorkflowEvents(options) {
+    const router = createWorkflowEventRouter(options);
+    return {
+        /** A host-recorded App event; matching armed triggers start their runs. */
+        deliver: (fact) => router.deliver(fact),
+        async arm(frame, raw) {
+            const target = triggerArmTargetSchema.parse(raw);
+            const { libraryId, context, installationAuthority } = await options.admitInvocation(frame, "armEventTrigger");
+            if (context.actor.kind !== "member")
+                return { error: "not_granted" };
+            if (context.computerId === null)
+                return {
+                    kind: "refused",
+                    reason: "Select a Computer before arming an event trigger",
+                };
+            // Standalone has no Agent arming source: the owner arms as themself.
+            return router.arm({ armedBy: context.actor.memberId, armedVia: null }, { ...target, installationId: libraryId }, context.computerId, installationAuthority);
+        },
+        async disarm(frame, raw) {
+            const { eventTriggerId } = eventDisarmInputSchema.parse(raw);
+            const { libraryId, context } = await options.admitInvocation(frame, "disarmEventTrigger");
+            if (context.actor.kind !== "member")
+                return { error: "not_granted" };
+            return router.disarm({ kind: "member", memberId: context.actor.memberId }, libraryId, eventTriggerId);
+        },
+        async list(frame) {
+            const { libraryId, context } = await options.admitInvocation(frame, "eventTriggers");
+            if (context.actor.kind !== "member")
+                return { error: "not_granted" };
+            return {
+                eventTriggers: await router.list({ kind: "member", memberId: context.actor.memberId }, libraryId),
+            };
+        },
+    };
+}

package/dist/standalone/workflow-git-capture.d.ts

@@ -0,0 +1,7 @@
+import type { WorkflowCeilingCapturePorts } from "@fungi.computer/braid/runtime";
+import type { StandaloneWorkflowNodeCaptureOptions } from "./workflow-node-capture.js";
+/** Installation Git only; Team-source needs its separate authoritative namespace owner. */
+export declare function createStandaloneWorkflowInstallationGitCapture(options: Readonly<{
+    host: Pick<StandaloneWorkflowNodeCaptureOptions["host"], "auth" | "artifacts" | "installations">;
+    readers: Pick<StandaloneWorkflowNodeCaptureOptions["readers"], "member">;
+}>): WorkflowCeilingCapturePorts["git"];

package/dist/standalone/workflow-git-capture.js

@@ -0,0 +1,62 @@
+import { repositoryRefSchema } from "@fungi.computer/agar/git";
+import { approvedBindingGrants } from "../apps/index.js";
+import { createInstallationGitAdmission } from "../git.js";
+import { oysterPrincipalIsOwner, resolveBackend } from "../host.js";
+import { invocationCallerContext } from "../invocation.js";
+/** Installation Git only; Team-source needs its separate authoritative namespace owner. */
+export function createStandaloneWorkflowInstallationGitCapture(options) {
+    const { host, readers } = options;
+    return async (actor, member, raw, scope) => {
+        const repository = repositoryRefSchema.parse(raw);
+        if (repository.kind !== "installation")
+            return false;
+        const before = await readers.member(actor.memberId);
+        if (before?.membershipVersion !== member.membershipVersion)
+            return false;
+        const principal = await host.auth.resolve(actor);
+        if (principal === null || !oysterPrincipalIsOwner(principal))
+            return false;
+        const caller = invocationCallerContext(principal, null);
+        if (caller.actor.kind !== "member" ||
+            caller.actor.memberId !== actor.memberId)
+            return false;
+        const installation = await host.installations.get(repository.installationId);
+        if (installation?.status !== "enabled" ||
+            installation.instanceId === null ||
+            installation.installationId !== repository.installationId)
+            return false;
+        const currentInstallation = async () => {
+            const current = await host.installations.get(repository.installationId);
+            if (current?.status !== "enabled" ||
+                current.installationId !== installation.installationId ||
+                current.instanceId !== installation.instanceId ||
+                current.authorityVersion !== installation.authorityVersion ||
+                current.declaredOperationsDigest !==
+                    installation.declaredOperationsDigest ||
+                current.release.appId !== installation.release.appId ||
+                current.release.releaseId !== installation.release.releaseId ||
+                current.release.artifact.artifactRef !==
+                    installation.release.artifact.artifactRef ||
+                current.release.artifact.artifactDigest !==
+                    installation.release.artifact.artifactDigest)
+                return null;
+            return current;
+        };
+        const admits = createInstallationGitAdmission({
+            currentInstallation,
+            declaration: async (current) => {
+                const backend = await resolveBackend(host.artifacts, current.release);
+                const declaration = backend?.declaration;
+                if (declaration == null ||
+                    !approvedBindingGrants(current, declaration).some((binding) => binding.binding === "GIT" && binding.operations.includes(scope)))
+                    return null;
+                return declaration;
+            },
+        });
+        if (!(await admits({ kind: "actor", actor: caller.actor }, repository.repository, scope)))
+            return false;
+        const after = await readers.member(actor.memberId);
+        return (after?.membershipVersion === member.membershipVersion &&
+            (await currentInstallation()) !== null);
+    };
+}